Overview

overview

10

Static

static

10

Client.exe

windows10-1703-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    01-08-2024 09:52

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Client.exe

  • Size

    158KB

  • MD5

    c9b05ce95678b667df6592f2c3377038

  • SHA1

    e4d39867452c5fbbc9cd8a260d31fcf0d780073f

  • SHA256

    c914cd27a6ab9740086e3c8cc4ff26316315b6c91edd96f18c7ecb60161cd656

  • SHA512

    58be1ebf5b3b6daad04bfae7120780a07b0f09b88cd0717a65f6447c416ee166a61c26d72e77c7f7100e7fc83a601c790e1be699c839708dca4c7a93f20ce46f

  • SSDEEP

    3072:KbzOH+0OoCthfbEFtbcfjF45gjryKKqH6JY2doszEmQotEPPcfPLxO8Y:KbzOe0ODhTEPgnjuIJzo+PPcfPL88

Score
10/10
arrowrattestcredential_accessdiscoverypersistenceratstealer

Malware Config

Extracted

Family

arrowrat

Botnet

test

C2

and-statements.gl.at.ply.gg:43442

Mutex

URuzXlMdC

Signatures

  • ArrowRat

    Remote access tool with various capabilities first seen in late 2021.

    ratarrowrat
  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 22 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 35 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 27 IoCs
  • Suspicious use of FindShellTrayWindow 34 IoCs
  • Suspicious use of SendNotifyMessage 21 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Client.exe
    "C:\Users\Admin\AppData\Local\Temp\Client.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Suspicious use of SetThreadContext
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4764
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2236
      • C:\Windows\system32\ctfmon.exe
        ctfmon.exe
        3⤵
          PID:4712
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" test and-statements.gl.at.ply.gg 43442 URuzXlMdC
        2⤵
        • System Location Discovery: System Language Discovery
        PID:4532
      • C:\Windows\System32\ComputerDefaults.exe
        "C:\Windows\System32\ComputerDefaults.exe"
        2⤵
          PID:4884
      • C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
        1⤵
        • Drops file in Windows directory
        • Enumerates system info in registry
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:2952

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Roaming\temp0923
        Filesize

        10B

        MD5

        82c8be87d88e7d1ce57025d03b210d8e

        SHA1

        20c356eacf2c03c0a254c83d130c7e12d689f7c9

        SHA256

        7e26471598288821940284c3a32dc53a0b487c73f4bfa76938f52d495d88bcaf

        SHA512

        27930195026f54f68a2a8a251a26d045106a3e9d8975670c9b8a354c9e4dd8d75fa7e269550d71b8ac5e702b23b31c47e72dee50e2774a2382f890cbe6abc77d

        Download Submit

      • memory/2236-16-0x0000000002FA0000-0x0000000002FA1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2952-49-0x0000018D4CFE0000-0x0000018D4D000000-memory.dmp

        Filesize

        128KB

        Download

      • memory/2952-25-0x0000018D4CCC0000-0x0000018D4CCE0000-memory.dmp

        Filesize

        128KB

        Download

      • memory/2952-22-0x0000018D4C700000-0x0000018D4C800000-memory.dmp

        Filesize

        1024KB

        Download

      • memory/4532-7-0x0000000008E50000-0x0000000008EEC000-memory.dmp

        Filesize

        624KB

        Download

      • memory/4532-9-0x0000000009B60000-0x0000000009BC6000-memory.dmp

        Filesize

        408KB

        Download

      • memory/4532-12-0x0000000009D20000-0x0000000009D70000-memory.dmp

        Filesize

        320KB

        Download

      • memory/4532-8-0x00000000094F0000-0x00000000099EE000-memory.dmp

        Filesize

        5.0MB

        Download

      • memory/4532-6-0x0000000008DB0000-0x0000000008E42000-memory.dmp

        Filesize

        584KB

        Download

      • memory/4532-2-0x0000000000400000-0x0000000000418000-memory.dmp

        Filesize

        96KB

        Download

      • memory/4764-15-0x00007FFFF2EF0000-0x00007FFFF38DC000-memory.dmp

        Filesize

        9.9MB

        Download

      • memory/4764-0-0x00007FFFF2EF3000-0x00007FFFF2EF4000-memory.dmp

        Filesize

        4KB

        Download

      • memory/4764-1-0x000001B36D110000-0x000001B36D13E000-memory.dmp

        Filesize

        184KB

        Download

      • memory/4764-130-0x00007FFFF2EF3000-0x00007FFFF2EF4000-memory.dmp

        Filesize

        4KB

        Download

      • memory/4764-136-0x00007FFFF2EF0000-0x00007FFFF38DC000-memory.dmp

        Filesize

        9.9MB

        Download