Analysis
-
max time kernel
127s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
03-11-2024 02:57
Behavioral task
behavioral1
Sample
6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe
Resource
win7-20240903-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
18 signatures
150 seconds
General
-
Target
6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe
-
Size
138KB
-
MD5
348c70b182eb53d74fe080f57c7265bc
-
SHA1
42e3e7c848fc8774dd7bd6be1e3bdfe98fc86e06
-
SHA256
6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090
-
SHA512
3b2c3f04443e76371fdd03aae0b4c846bcf585ad69d235ff595612f24a96607b7c44b5182a66c87b589044a5d3b2b77839c384b5ccc7fc65b8b10c40982ada12
-
SSDEEP
3072:Jbvs5mz7Bqh1v59Y08mAjs0Ltel+qOeJHlpV8b+Y/Yl:JbvES7BqjjYHdrqkL/
Score
10/10
Malware Config
Extracted
Family
arrowrat
Botnet
BRASIL
C2
chromedata.accesscam.org:1338
Mutex
imfoNeSSi
Signatures
-
Arrowrat family
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Processes:
explorer.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Modifies registry class 5 IoCs
Processes:
explorer.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_Classes\Local Settings explorer.exe -
Suspicious behavior: EnumeratesProcesses 21 IoCs
Processes:
6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exepid Process 276 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 276 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 276 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 276 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 276 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 276 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 276 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 276 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 276 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 276 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 276 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 276 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 276 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 276 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 276 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 276 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 276 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 276 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 276 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 276 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 276 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes:
6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exeexplorer.exedescription pid Process Token: SeDebugPrivilege 276 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe Token: SeShutdownPrivilege 2360 explorer.exe Token: SeShutdownPrivilege 2360 explorer.exe Token: SeShutdownPrivilege 2360 explorer.exe Token: SeShutdownPrivilege 2360 explorer.exe Token: SeShutdownPrivilege 2360 explorer.exe Token: SeShutdownPrivilege 2360 explorer.exe Token: SeShutdownPrivilege 2360 explorer.exe Token: SeShutdownPrivilege 2360 explorer.exe Token: SeShutdownPrivilege 2360 explorer.exe Token: SeShutdownPrivilege 2360 explorer.exe Token: SeShutdownPrivilege 2360 explorer.exe -
Suspicious use of FindShellTrayWindow 27 IoCs
Processes:
explorer.exepid Process 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe -
Suspicious use of SendNotifyMessage 17 IoCs
Processes:
explorer.exepid Process 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe 2360 explorer.exe -
Suspicious use of WriteProcessMemory 46 IoCs
Processes:
6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exeexplorer.exedescription pid Process procid_target PID 276 wrote to memory of 2360 276 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 31 PID 276 wrote to memory of 2360 276 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 31 PID 276 wrote to memory of 2360 276 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 31 PID 2360 wrote to memory of 2072 2360 explorer.exe 33 PID 2360 wrote to memory of 2072 2360 explorer.exe 33 PID 2360 wrote to memory of 2072 2360 explorer.exe 33 PID 276 wrote to memory of 2080 276 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 32 PID 276 wrote to memory of 2080 276 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 32 PID 276 wrote to memory of 2080 276 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 32 PID 276 wrote to memory of 2080 276 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 32 PID 276 wrote to memory of 484 276 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 34 PID 276 wrote to memory of 484 276 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 34 PID 276 wrote to memory of 484 276 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 34 PID 276 wrote to memory of 484 276 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 34 PID 276 wrote to memory of 2264 276 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 35 PID 276 wrote to memory of 2264 276 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 35 PID 276 wrote to memory of 2264 276 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 35 PID 276 wrote to memory of 2264 276 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 35 PID 276 wrote to memory of 3052 276 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 36 PID 276 wrote to memory of 3052 276 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 36 PID 276 wrote to memory of 3052 276 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 36 PID 276 wrote to memory of 3052 276 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 36 PID 276 wrote to memory of 2652 276 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 37 PID 276 wrote to memory of 2652 276 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 37 PID 276 wrote to memory of 2652 276 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 37 PID 276 wrote to memory of 2652 276 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 37 PID 276 wrote to memory of 2268 276 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 38 PID 276 wrote to memory of 2268 276 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 38 PID 276 wrote to memory of 2268 276 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 38 PID 276 wrote to memory of 2268 276 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 38 PID 276 wrote to memory of 2672 276 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 39 PID 276 wrote to memory of 2672 276 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 39 PID 276 wrote to memory of 2672 276 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 39 PID 276 wrote to memory of 2672 276 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 39 PID 276 wrote to memory of 2708 276 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 40 PID 276 wrote to memory of 2708 276 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 40 PID 276 wrote to memory of 2708 276 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 40 PID 276 wrote to memory of 2708 276 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 40 PID 276 wrote to memory of 2772 276 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 41 PID 276 wrote to memory of 2772 276 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 41 PID 276 wrote to memory of 2772 276 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 41 PID 276 wrote to memory of 2772 276 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 41 PID 276 wrote to memory of 2792 276 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 42 PID 276 wrote to memory of 2792 276 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 42 PID 276 wrote to memory of 2792 276 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 42 PID 276 wrote to memory of 2792 276 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 42 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe"C:\Users\Admin\AppData\Local\Temp\6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:276 -
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Windows\system32\ctfmon.exectfmon.exe3⤵PID:2072
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" BRASIL chromedata.accesscam.org 1338 imfoNeSSi2⤵PID:2080
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" BRASIL chromedata.accesscam.org 1338 imfoNeSSi2⤵PID:484
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" BRASIL chromedata.accesscam.org 1338 imfoNeSSi2⤵PID:2264
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" BRASIL chromedata.accesscam.org 1338 imfoNeSSi2⤵PID:3052
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" BRASIL chromedata.accesscam.org 1338 imfoNeSSi2⤵PID:2652
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" BRASIL chromedata.accesscam.org 1338 imfoNeSSi2⤵PID:2268
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" BRASIL chromedata.accesscam.org 1338 imfoNeSSi2⤵PID:2672
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" BRASIL chromedata.accesscam.org 1338 imfoNeSSi2⤵PID:2708
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" BRASIL chromedata.accesscam.org 1338 imfoNeSSi2⤵PID:2772
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" BRASIL chromedata.accesscam.org 1338 imfoNeSSi2⤵PID:2792
-