Overview

overview

10

Static

static

10

b766c8001c...02.exe

windows7-x64

10

b766c8001c...02.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    127s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    25-09-2024 02:24

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b766c8001cc928c65188a80a149d8eb11c59178b68cee4437659e67d2f02c402.exe

  • Size

    138KB

  • MD5

    6787bc47fb117dd9ee565060bf696218

  • SHA1

    e11600ca6afb97abbb9c42f1ded0d6afc6daef12

  • SHA256

    b766c8001cc928c65188a80a149d8eb11c59178b68cee4437659e67d2f02c402

  • SHA512

    506c26e3803d30983b8b4e925d5e78e3e27c953d708d5f1fbdbf79a0d2a23d2c299e7021e33c2feccba1de57e1de9ac1b3c6ad5e89bd0e67fdf617ad509105f4

  • SSDEEP

    3072:qbvc5mz7Bqh1v59Y08mAjs0Ltel+qOeJHlpV8b+Y/YS:qbvUS7BqjjYHdrqkL/

Score
10/10
arrowratvenomhvncpersistencerat

Malware Config

Extracted

Family

arrowrat

Botnet

VenomHVNC

C2

84.17.59.86:10018

Mutex

IDgbBCwxP

Signatures

  • ArrowRat

    Remote access tool with various capabilities first seen in late 2021.

    ratarrowrat
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 21 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of FindShellTrayWindow 27 IoCs
  • Suspicious use of SendNotifyMessage 17 IoCs
  • Suspicious use of WriteProcessMemory 46 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\b766c8001cc928c65188a80a149d8eb11c59178b68cee4437659e67d2f02c402.exe
    "C:\Users\Admin\AppData\Local\Temp\b766c8001cc928c65188a80a149d8eb11c59178b68cee4437659e67d2f02c402.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2400
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2696
      • C:\Windows\system32\ctfmon.exe
        ctfmon.exe
        3⤵
          PID:2564
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC 84.17.59.86 10018 IDgbBCwxP
        2⤵
          PID:2732
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC 84.17.59.86 10018 IDgbBCwxP
          2⤵
            PID:2772
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC 84.17.59.86 10018 IDgbBCwxP
            2⤵
              PID:2984
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC 84.17.59.86 10018 IDgbBCwxP
              2⤵
                PID:2692
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC 84.17.59.86 10018 IDgbBCwxP
                2⤵
                  PID:2664
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC 84.17.59.86 10018 IDgbBCwxP
                  2⤵
                    PID:2548
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC 84.17.59.86 10018 IDgbBCwxP
                    2⤵
                      PID:2360
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC 84.17.59.86 10018 IDgbBCwxP
                      2⤵
                        PID:2844
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC 84.17.59.86 10018 IDgbBCwxP
                        2⤵
                          PID:2700
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC 84.17.59.86 10018 IDgbBCwxP
                          2⤵
                            PID:2756

                        Network

                        MITRE ATT&CK Enterprise v15

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • memory/2400-0-0x000007FEF6233000-0x000007FEF6234000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/2400-1-0x00000000012E0000-0x0000000001308000-memory.dmp

                          Filesize

                          160KB

                          Download