1001fdf77dfa3f34ae1a7e6d32776dcdd94365dc4785a8b82e96834c9d0f60bd

Analysis

max time kernel
146s
max time network
155s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
23-05-2024 12:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Celestial_Rat.rar
Size

13.1MB
MD5

30496f3a3ebd66dd1e1a9c98f0c2972c
SHA1

40571b3491c032ab1c28ebc24859a0d01300fafe
SHA256

1001fdf77dfa3f34ae1a7e6d32776dcdd94365dc4785a8b82e96834c9d0f60bd
SHA512

ba6fb9e5b555b20c5d0c14ab209890948982849d3da4bc0f336db1b3baf7d212e50b8ca6a1db89fc2679eb008021e9651b4795ea6990fc2b9915c8156695ec5f
SSDEEP

393216:uoUU21bSb/2r7fIKXX/XapCaNtmWGTpVlPchk5k:uoUnFDfXitmWVv

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

OpenWith.exe

pid process

1468 OpenWith.exe

Suspicious use of SetWindowsHookEx 11 IoCs

Processes:

OpenWith.exe

pid	process
1468	OpenWith.exe
1468	OpenWith.exe
1468	OpenWith.exe
1468	OpenWith.exe
1468	OpenWith.exe
1468	OpenWith.exe
1468	OpenWith.exe
1468	OpenWith.exe
1468	OpenWith.exe
1468	OpenWith.exe
1468	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Celestial_Rat.rar
1⤵
- Modifies registry class
PID:232

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1468

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5112

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads