1001fdf77dfa3f34ae1a7e6d32776dcdd94365dc4785a8b82e96834c9d0f60bd

Analysis

max time kernel
35s
max time network
37s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04-07-2024 14:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Celestial Rat/Celestial.exe
Size

9.4MB
MD5

86cae458b120a8c8f336d30590cc3c4f
SHA1

68f0a11a37c01f79db978ef19c03ee9c3457a6db
SHA256

4a9d64583260db1c1e4ff7d763341a1ab2bdf1d6e840dd622efad07da12a1d32
SHA512

489eb0bc1d465c713e4670a2743499ed256bd535332e211fd37f900f3d4a707c35d9dbee391e33d07eb4a9421f4312f74ecaf924f0b86ddecfe4190186093dbb
SSDEEP

196608:8o/0CasEDPZ2lB54SY3KTBRYIzH7IXB0wnlnmELgaJitOsFo:8o/TTAPcf5Bqa3zzH7IB00nn4OsFo

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/4680-1-0x000001C4B86C0000-0x000001C4B9C00000-memory.dmp	themida

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4680	Celestial.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1724	taskmgr.exe
Token: SeSystemProfilePrivilege	1724	taskmgr.exe
Token: SeCreateGlobalPrivilege	1724	taskmgr.exe

Suspicious use of FindShellTrayWindow 39 IoCs

pid	Process
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe

Suspicious use of SendNotifyMessage 38 IoCs

pid	Process
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe
1724	taskmgr.exe

C:\Users\Admin\AppData\Local\Temp\Celestial Rat\Celestial.exe
"C:\Users\Admin\AppData\Local\Temp\Celestial Rat\Celestial.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4680

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1724-15-0x00000205D24E0000-0x00000205D24E1000-memory.dmp

Filesize
4KB

Download
memory/1724-5-0x00000205D24E0000-0x00000205D24E1000-memory.dmp

Filesize
4KB

Download
memory/1724-4-0x00000205D24E0000-0x00000205D24E1000-memory.dmp

Filesize
4KB

Download
memory/1724-3-0x00000205D24E0000-0x00000205D24E1000-memory.dmp

Filesize
4KB

Download
memory/1724-14-0x00000205D24E0000-0x00000205D24E1000-memory.dmp

Filesize
4KB

Download
memory/1724-13-0x00000205D24E0000-0x00000205D24E1000-memory.dmp

Filesize
4KB

Download
memory/1724-12-0x00000205D24E0000-0x00000205D24E1000-memory.dmp

Filesize
4KB

Download
memory/1724-11-0x00000205D24E0000-0x00000205D24E1000-memory.dmp

Filesize
4KB

Download
memory/1724-10-0x00000205D24E0000-0x00000205D24E1000-memory.dmp

Filesize
4KB

Download
memory/1724-9-0x00000205D24E0000-0x00000205D24E1000-memory.dmp

Filesize
4KB

Download
memory/4680-1-0x000001C4B86C0000-0x000001C4B9C00000-memory.dmp

Filesize
21.2MB

Download
memory/4680-2-0x000001C4B9F90000-0x000001C4B9F91000-memory.dmp

Filesize
4KB

Download
memory/4680-0-0x00007FFC66BF3000-0x00007FFC66BF5000-memory.dmp

Filesize
8KB

Download