Overview

overview

10

Static

static

10

Client.exe

windows10-1703-x64

10

Analysis

  • max time kernel
    1771s
  • max time network
    1797s
  • platform
    windows10-1703_x64
  • resource
    win10-20240611-en
  • resource tags

    arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system
  • submitted
    02-09-2024 18:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Client.exe

  • Size

    158KB

  • MD5

    ff04efb632b00fdd46fd3fe992ea8a37

  • SHA1

    8a6f3fd785ac3d78e8de79656a9fa8f0c9527fb7

  • SHA256

    dee58e8a247eab9726675a03ddc8485c66a204d7b9f2211d8fea89729d45e7a5

  • SHA512

    a5747653fcaa76aea2cf7bc601b87e583c37f9fa34e399f30d4eaa816655b04c1ec14807477ddb965d6f276e4023560618550d124483e9608585fcbf392dde5a

  • SSDEEP

    3072:qbzGH+0OoCthfbEFtbcfjF45gjryKKqH6JY2doszEmQotEPPcfPTKO8Y:qbzGe0ODhTEPgnjuIJzo+PPcfPT18

Score
10/10
arrowratclientcredential_accessdiscoverypersistenceratstealer

Malware Config

Extracted

Family

arrowrat

Botnet

Client

C2

6.tcp.eu.ngrok.io:13114

Mutex

rLGiSBuYa

Signatures

  • ArrowRat

    Remote access tool with various capabilities first seen in late 2021.

    ratarrowrat
  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 10 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 22 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 35 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 31 IoCs
  • Suspicious use of FindShellTrayWindow 33 IoCs
  • Suspicious use of SendNotifyMessage 20 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Client.exe
    "C:\Users\Admin\AppData\Local\Temp\Client.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Suspicious use of SetThreadContext
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3904
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:996
      • C:\Windows\system32\ctfmon.exe
        ctfmon.exe
        3⤵
          PID:4528
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client 6.tcp.eu.ngrok.io 13114 rLGiSBuYa
        2⤵
        • System Location Discovery: System Language Discovery
        PID:2488
      • C:\Windows\System32\ComputerDefaults.exe
        "C:\Windows\System32\ComputerDefaults.exe"
        2⤵
          PID:3300
      • C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
        1⤵
        • Drops file in Windows directory
        • Enumerates system info in registry
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4524

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Roaming\temp0923
        Filesize

        10B

        MD5

        a2eefac598e19dd75f45bb7655747d8a

        SHA1

        f6cf361e2ecbb156930da84dc04bfe306728153c

        SHA256

        e0a081a574451a21603ff5f391a19c251fd6132a72c589a76c08c0ed2f2bd264

        SHA512

        da952b6f24d34d13b7baf421ec71e45a4546f3b1e99175475f0a3c716afb626ec5a1aba13e160fda2aae24bcbf54f1b15dedb86f553b73e9ffa22cadcc04e162

        Download Submit

      • memory/996-21-0x0000000003700000-0x0000000003701000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2488-13-0x0000000009DC0000-0x0000000009E10000-memory.dmp

        Filesize

        320KB

        Download

      • memory/2488-2-0x0000000000400000-0x0000000000418000-memory.dmp

        Filesize

        96KB

        Download

      • memory/2488-7-0x0000000008F10000-0x0000000008FAC000-memory.dmp

        Filesize

        624KB

        Download

      • memory/2488-8-0x00000000095F0000-0x0000000009AEE000-memory.dmp

        Filesize

        5.0MB

        Download

      • memory/2488-6-0x0000000008E70000-0x0000000008F02000-memory.dmp

        Filesize

        584KB

        Download

      • memory/2488-10-0x0000000009AF0000-0x0000000009B56000-memory.dmp

        Filesize

        408KB

        Download

      • memory/3904-9-0x00007FFA741A0000-0x00007FFA74B8C000-memory.dmp

        Filesize

        9.9MB

        Download

      • memory/3904-0-0x00007FFA741A3000-0x00007FFA741A4000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3904-1-0x00000249D4F80000-0x00000249D4FAE000-memory.dmp

        Filesize

        184KB

        Download

      • memory/3904-104-0x00007FFA741A3000-0x00007FFA741A4000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3904-108-0x00007FFA741A0000-0x00007FFA74B8C000-memory.dmp

        Filesize

        9.9MB

        Download

      • memory/4524-25-0x0000029469C10000-0x0000029469D10000-memory.dmp

        Filesize

        1024KB

        Download

      • memory/4524-33-0x000002946A3C0000-0x000002946A3E0000-memory.dmp

        Filesize

        128KB

        Download

      • memory/4524-54-0x000002946A540000-0x000002946A560000-memory.dmp

        Filesize

        128KB

        Download