arrowrat | 0e128c8329b4ac17b548b4e78ee4ac813a938d1b6bcf1dceff816ba97202a1e4

Analysis

max time kernel
130s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
18-07-2024 15:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sqjxHtZQi8.ps1
Size

1.2MB
MD5

ca1aa65d11c546f737d20939aac7577f
SHA1

ba6ac400f4729fc1d25bdbe7b46e18fc203c8d8b
SHA256

0e128c8329b4ac17b548b4e78ee4ac813a938d1b6bcf1dceff816ba97202a1e4
SHA512

b3e43ca2617fed5862d7e25e1ab02dadbdb666a7e75eb07d65ee9065c0b1ce741a3213f744972d18574b05fe7b283bf3dc69ab05abf20f051c02b86792b53242
SSDEEP

12288:iZmTk3LmZmTk3Lv2RDsUU1VG2RDsUU1VP2RDsUU1V/:iZmTAKZmTAr25gG25gP25g/

Score

10^/10

arrowrat r00t execution persistence rat

Malware Config

Extracted

Family

arrowrat

Botnet

r00t

necessary-sick.gl.at.ply.gg:32835

Mutex

DsCbljCVL

Signatures

ArrowRat
Remote access tool with various capabilities first seen in late 2021.
rat arrowrat

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

powershell.exeRegSvcs.exe

description	pid	Process	procid_target
PID 2512 set thread context of 2688	2512	powershell.exe	32
PID 2688 set thread context of 2700	2688	RegSvcs.exe	34

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

Processes:

powershell.exe

pid	Process
2512	powershell.exe

Modifies registry class 5 IoCs

Processes:

explorer.exe

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exeRegSvcs.exe

pid	Process
2512	powershell.exe
2688	RegSvcs.exe
2688	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

Processes:

powershell.exeRegSvcs.exeexplorer.exe

description	pid	Process
Token: SeDebugPrivilege	2512	powershell.exe
Token: SeDebugPrivilege	2688	RegSvcs.exe
Token: SeShutdownPrivilege	2940	explorer.exe
Token: SeShutdownPrivilege	2940	explorer.exe
Token: SeShutdownPrivilege	2940	explorer.exe
Token: SeShutdownPrivilege	2940	explorer.exe
Token: SeShutdownPrivilege	2940	explorer.exe
Token: SeShutdownPrivilege	2940	explorer.exe
Token: SeShutdownPrivilege	2940	explorer.exe
Token: SeShutdownPrivilege	2940	explorer.exe
Token: SeShutdownPrivilege	2940	explorer.exe
Token: SeShutdownPrivilege	2940	explorer.exe
Token: SeShutdownPrivilege	2940	explorer.exe

Suspicious use of FindShellTrayWindow 27 IoCs

Processes:

explorer.exe

pid	Process
2940	explorer.exe
2940	explorer.exe
2940	explorer.exe
2940	explorer.exe
2940	explorer.exe
2940	explorer.exe
2940	explorer.exe
2940	explorer.exe
2940	explorer.exe
2940	explorer.exe
2940	explorer.exe
2940	explorer.exe
2940	explorer.exe
2940	explorer.exe
2940	explorer.exe
2940	explorer.exe
2940	explorer.exe
2940	explorer.exe
2940	explorer.exe
2940	explorer.exe
2940	explorer.exe
2940	explorer.exe
2940	explorer.exe
2940	explorer.exe
2940	explorer.exe
2940	explorer.exe
2940	explorer.exe

Suspicious use of SendNotifyMessage 16 IoCs

Processes:

explorer.exe

pid	Process
2940	explorer.exe
2940	explorer.exe
2940	explorer.exe
2940	explorer.exe
2940	explorer.exe
2940	explorer.exe
2940	explorer.exe
2940	explorer.exe
2940	explorer.exe
2940	explorer.exe
2940	explorer.exe
2940	explorer.exe
2940	explorer.exe
2940	explorer.exe
2940	explorer.exe
2940	explorer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

RegSvcs.exe

pid	Process
2688	RegSvcs.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

powershell.exeRegSvcs.exeexplorer.exe

description	pid	Process	procid_target
PID 2512 wrote to memory of 2688	2512	powershell.exe	32
PID 2512 wrote to memory of 2688	2512	powershell.exe	32
PID 2512 wrote to memory of 2688	2512	powershell.exe	32
PID 2512 wrote to memory of 2688	2512	powershell.exe	32
PID 2512 wrote to memory of 2688	2512	powershell.exe	32
PID 2512 wrote to memory of 2688	2512	powershell.exe	32
PID 2512 wrote to memory of 2688	2512	powershell.exe	32
PID 2512 wrote to memory of 2688	2512	powershell.exe	32
PID 2512 wrote to memory of 2688	2512	powershell.exe	32
PID 2512 wrote to memory of 2688	2512	powershell.exe	32
PID 2512 wrote to memory of 2688	2512	powershell.exe	32
PID 2512 wrote to memory of 2688	2512	powershell.exe	32
PID 2688 wrote to memory of 2940	2688	RegSvcs.exe	33
PID 2688 wrote to memory of 2940	2688	RegSvcs.exe	33
PID 2688 wrote to memory of 2940	2688	RegSvcs.exe	33
PID 2688 wrote to memory of 2940	2688	RegSvcs.exe	33
PID 2688 wrote to memory of 2700	2688	RegSvcs.exe	34
PID 2688 wrote to memory of 2700	2688	RegSvcs.exe	34
PID 2688 wrote to memory of 2700	2688	RegSvcs.exe	34
PID 2688 wrote to memory of 2700	2688	RegSvcs.exe	34
PID 2688 wrote to memory of 2700	2688	RegSvcs.exe	34
PID 2688 wrote to memory of 2700	2688	RegSvcs.exe	34
PID 2688 wrote to memory of 2700	2688	RegSvcs.exe	34
PID 2688 wrote to memory of 2700	2688	RegSvcs.exe	34
PID 2688 wrote to memory of 2700	2688	RegSvcs.exe	34
PID 2940 wrote to memory of 2552	2940	explorer.exe	36
PID 2940 wrote to memory of 2552	2940	explorer.exe	36
PID 2940 wrote to memory of 2552	2940	explorer.exe	36

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\sqjxHtZQi8.ps1
1⤵
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2688
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2940
  - - C:\Windows\system32\ctfmon.exe
      ctfmon.exe
      4⤵
      PID:2552
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" r00t necessary-sick.gl.at.ply.gg 32835 DsCbljCVL
    3⤵
    PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2512-38-0x000007FEF5A30000-0x000007FEF63CD000-memory.dmp

Filesize
9.6MB

Download
memory/2512-21-0x0000000002A80000-0x0000000002A98000-memory.dmp

Filesize
96KB

Download
memory/2512-6-0x0000000002770000-0x0000000002778000-memory.dmp

Filesize
32KB

Download
memory/2512-8-0x000007FEF5A30000-0x000007FEF63CD000-memory.dmp

Filesize
9.6MB

Download
memory/2512-9-0x000007FEF5A30000-0x000007FEF63CD000-memory.dmp

Filesize
9.6MB

Download
memory/2512-7-0x000007FEF5A30000-0x000007FEF63CD000-memory.dmp

Filesize
9.6MB

Download
memory/2512-40-0x000007FEF5A30000-0x000007FEF63CD000-memory.dmp

Filesize
9.6MB

Download
memory/2512-11-0x000007FEF5A30000-0x000007FEF63CD000-memory.dmp

Filesize
9.6MB

Download
memory/2512-12-0x0000000002A80000-0x0000000002AA0000-memory.dmp

Filesize
128KB

Download
memory/2512-13-0x000007FEF5A30000-0x000007FEF63CD000-memory.dmp

Filesize
9.6MB

Download
memory/2512-14-0x0000000002A80000-0x0000000002A98000-memory.dmp

Filesize
96KB

Download
memory/2512-25-0x0000000002A80000-0x0000000002A98000-memory.dmp

Filesize
96KB

Download
memory/2512-23-0x0000000002A80000-0x0000000002A98000-memory.dmp

Filesize
96KB

Download
memory/2512-17-0x0000000002A80000-0x0000000002A98000-memory.dmp

Filesize
96KB

Download
memory/2512-15-0x0000000002A80000-0x0000000002A98000-memory.dmp

Filesize
96KB

Download
memory/2512-5-0x000000001B7B0000-0x000000001BA92000-memory.dmp

Filesize
2.9MB

Download
memory/2512-19-0x0000000002A80000-0x0000000002A98000-memory.dmp

Filesize
96KB

Download
memory/2512-4-0x000007FEF5CEE000-0x000007FEF5CEF000-memory.dmp

Filesize
4KB

Download
memory/2512-10-0x000007FEF5A30000-0x000007FEF63CD000-memory.dmp

Filesize
9.6MB

Download
memory/2688-30-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2688-26-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2688-37-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2688-35-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2688-31-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2688-33-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2688-32-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2688-39-0x000000007408E000-0x000000007408F000-memory.dmp

Filesize
4KB

Download
memory/2688-28-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2688-61-0x0000000074080000-0x000000007476E000-memory.dmp

Filesize
6.9MB

Download
memory/2688-60-0x000000007408E000-0x000000007408F000-memory.dmp

Filesize
4KB

Download
memory/2688-55-0x0000000074080000-0x000000007476E000-memory.dmp

Filesize
6.9MB

Download
memory/2700-52-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2700-49-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2700-47-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2700-50-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2700-51-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2700-43-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2700-45-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2700-41-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2940-67-0x0000000003DC0000-0x0000000003DD0000-memory.dmp

Filesize
64KB

Download