Analysis
-
max time kernel
128s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04-11-2024 00:06
Behavioral task
behavioral1
Sample
6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe
Resource
win7-20240903-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
18 signatures
150 seconds
General
-
Target
6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe
-
Size
138KB
-
MD5
348c70b182eb53d74fe080f57c7265bc
-
SHA1
42e3e7c848fc8774dd7bd6be1e3bdfe98fc86e06
-
SHA256
6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090
-
SHA512
3b2c3f04443e76371fdd03aae0b4c846bcf585ad69d235ff595612f24a96607b7c44b5182a66c87b589044a5d3b2b77839c384b5ccc7fc65b8b10c40982ada12
-
SSDEEP
3072:Jbvs5mz7Bqh1v59Y08mAjs0Ltel+qOeJHlpV8b+Y/Yl:JbvES7BqjjYHdrqkL/
Score
10/10
Malware Config
Extracted
Family
arrowrat
Botnet
BRASIL
C2
chromedata.accesscam.org:1338
Mutex
imfoNeSSi
Signatures
-
Arrowrat family
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Modifies registry class 5 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe -
Suspicious behavior: EnumeratesProcesses 21 IoCs
pid Process 2548 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 2548 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 2548 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 2548 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 2548 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 2548 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 2548 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 2548 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 2548 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 2548 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 2548 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 2548 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 2548 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 2548 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 2548 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 2548 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 2548 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 2548 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 2548 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 2548 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 2548 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeDebugPrivilege 2548 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe Token: SeShutdownPrivilege 2056 explorer.exe Token: SeShutdownPrivilege 2056 explorer.exe Token: SeShutdownPrivilege 2056 explorer.exe Token: SeShutdownPrivilege 2056 explorer.exe Token: SeShutdownPrivilege 2056 explorer.exe Token: SeShutdownPrivilege 2056 explorer.exe Token: SeShutdownPrivilege 2056 explorer.exe Token: SeShutdownPrivilege 2056 explorer.exe Token: SeShutdownPrivilege 2056 explorer.exe Token: SeShutdownPrivilege 2056 explorer.exe Token: SeShutdownPrivilege 2056 explorer.exe -
Suspicious use of FindShellTrayWindow 27 IoCs
pid Process 2056 explorer.exe 2056 explorer.exe 2056 explorer.exe 2056 explorer.exe 2056 explorer.exe 2056 explorer.exe 2056 explorer.exe 2056 explorer.exe 2056 explorer.exe 2056 explorer.exe 2056 explorer.exe 2056 explorer.exe 2056 explorer.exe 2056 explorer.exe 2056 explorer.exe 2056 explorer.exe 2056 explorer.exe 2056 explorer.exe 2056 explorer.exe 2056 explorer.exe 2056 explorer.exe 2056 explorer.exe 2056 explorer.exe 2056 explorer.exe 2056 explorer.exe 2056 explorer.exe 2056 explorer.exe -
Suspicious use of SendNotifyMessage 16 IoCs
pid Process 2056 explorer.exe 2056 explorer.exe 2056 explorer.exe 2056 explorer.exe 2056 explorer.exe 2056 explorer.exe 2056 explorer.exe 2056 explorer.exe 2056 explorer.exe 2056 explorer.exe 2056 explorer.exe 2056 explorer.exe 2056 explorer.exe 2056 explorer.exe 2056 explorer.exe 2056 explorer.exe -
Suspicious use of WriteProcessMemory 46 IoCs
description pid Process procid_target PID 2548 wrote to memory of 2056 2548 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 30 PID 2548 wrote to memory of 2056 2548 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 30 PID 2548 wrote to memory of 2056 2548 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 30 PID 2056 wrote to memory of 1068 2056 explorer.exe 32 PID 2056 wrote to memory of 1068 2056 explorer.exe 32 PID 2056 wrote to memory of 1068 2056 explorer.exe 32 PID 2548 wrote to memory of 2088 2548 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 31 PID 2548 wrote to memory of 2088 2548 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 31 PID 2548 wrote to memory of 2088 2548 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 31 PID 2548 wrote to memory of 2088 2548 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 31 PID 2548 wrote to memory of 332 2548 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 33 PID 2548 wrote to memory of 332 2548 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 33 PID 2548 wrote to memory of 332 2548 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 33 PID 2548 wrote to memory of 332 2548 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 33 PID 2548 wrote to memory of 2704 2548 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 34 PID 2548 wrote to memory of 2704 2548 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 34 PID 2548 wrote to memory of 2704 2548 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 34 PID 2548 wrote to memory of 2704 2548 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 34 PID 2548 wrote to memory of 2456 2548 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 35 PID 2548 wrote to memory of 2456 2548 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 35 PID 2548 wrote to memory of 2456 2548 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 35 PID 2548 wrote to memory of 2456 2548 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 35 PID 2548 wrote to memory of 2740 2548 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 36 PID 2548 wrote to memory of 2740 2548 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 36 PID 2548 wrote to memory of 2740 2548 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 36 PID 2548 wrote to memory of 2740 2548 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 36 PID 2548 wrote to memory of 2744 2548 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 37 PID 2548 wrote to memory of 2744 2548 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 37 PID 2548 wrote to memory of 2744 2548 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 37 PID 2548 wrote to memory of 2744 2548 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 37 PID 2548 wrote to memory of 2788 2548 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 38 PID 2548 wrote to memory of 2788 2548 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 38 PID 2548 wrote to memory of 2788 2548 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 38 PID 2548 wrote to memory of 2788 2548 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 38 PID 2548 wrote to memory of 2804 2548 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 39 PID 2548 wrote to memory of 2804 2548 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 39 PID 2548 wrote to memory of 2804 2548 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 39 PID 2548 wrote to memory of 2804 2548 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 39 PID 2548 wrote to memory of 2876 2548 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 40 PID 2548 wrote to memory of 2876 2548 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 40 PID 2548 wrote to memory of 2876 2548 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 40 PID 2548 wrote to memory of 2876 2548 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 40 PID 2548 wrote to memory of 3012 2548 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 41 PID 2548 wrote to memory of 3012 2548 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 41 PID 2548 wrote to memory of 3012 2548 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 41 PID 2548 wrote to memory of 3012 2548 6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe 41 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe"C:\Users\Admin\AppData\Local\Temp\6aad7dead2ff9aa2996314a6c73f3043513ed155ed36507411efb7b38343c090.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Windows\system32\ctfmon.exectfmon.exe3⤵PID:1068
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" BRASIL chromedata.accesscam.org 1338 imfoNeSSi2⤵PID:2088
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" BRASIL chromedata.accesscam.org 1338 imfoNeSSi2⤵PID:332
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" BRASIL chromedata.accesscam.org 1338 imfoNeSSi2⤵PID:2704
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" BRASIL chromedata.accesscam.org 1338 imfoNeSSi2⤵PID:2456
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" BRASIL chromedata.accesscam.org 1338 imfoNeSSi2⤵PID:2740
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" BRASIL chromedata.accesscam.org 1338 imfoNeSSi2⤵PID:2744
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" BRASIL chromedata.accesscam.org 1338 imfoNeSSi2⤵PID:2788
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" BRASIL chromedata.accesscam.org 1338 imfoNeSSi2⤵PID:2804
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" BRASIL chromedata.accesscam.org 1338 imfoNeSSi2⤵PID:2876
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" BRASIL chromedata.accesscam.org 1338 imfoNeSSi2⤵PID:3012
-