Analysis
-
max time kernel
127s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
29-01-2025 04:56
Behavioral task
behavioral1
Sample
Client.exe
Resource
win7-20240903-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
Client.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
18 signatures
150 seconds
General
-
Target
Client.exe
-
Size
158KB
-
MD5
a413b202d9cb6afd42608d30d2f0257c
-
SHA1
63984f92d8d9ba7a4e78094cf1283e296beb3a57
-
SHA256
94e424eb08567f890a6136f9018d8255d509cf583c7551b56a4e51ce295f48de
-
SHA512
5e7dab0f4cdf7ed397e3e9d134265cac13cd3746daf62376ec92a96dc32c3dbc36afc84fa173dd6df017fd98b78186691fae4f2c0468de7f0ba1cab4df805f34
-
SSDEEP
3072:rbzyH+0OoCthfbEFtbcfjF45gjryKKqH6JY2doszEmQotEPPcfPjRO8Y:rbzye0ODhTEPgnjuIJzo+PPcfPjc8
Score
10/10
Malware Config
Extracted
Family
arrowrat
Botnet
Client
C2
understanding-described.gl.at.ply.gg:3953
Mutex
ylYRZGgFZ
Signatures
-
Arrowrat family
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe -
Suspicious behavior: EnumeratesProcesses 31 IoCs
pid Process 2376 Client.exe 2376 Client.exe 2376 Client.exe 2376 Client.exe 2376 Client.exe 2376 Client.exe 2376 Client.exe 2376 Client.exe 2376 Client.exe 2376 Client.exe 2376 Client.exe 2376 Client.exe 2376 Client.exe 2376 Client.exe 2376 Client.exe 2376 Client.exe 2376 Client.exe 2376 Client.exe 2376 Client.exe 2376 Client.exe 2376 Client.exe 2376 Client.exe 2376 Client.exe 2376 Client.exe 2376 Client.exe 2376 Client.exe 2376 Client.exe 2376 Client.exe 2376 Client.exe 2376 Client.exe 2376 Client.exe -
Suspicious use of AdjustPrivilegeToken 13 IoCs
description pid Process Token: SeDebugPrivilege 2376 Client.exe Token: SeShutdownPrivilege 2520 explorer.exe Token: SeShutdownPrivilege 2520 explorer.exe Token: SeShutdownPrivilege 2520 explorer.exe Token: SeShutdownPrivilege 2520 explorer.exe Token: SeShutdownPrivilege 2520 explorer.exe Token: SeShutdownPrivilege 2520 explorer.exe Token: SeShutdownPrivilege 2520 explorer.exe Token: SeShutdownPrivilege 2520 explorer.exe Token: SeShutdownPrivilege 2520 explorer.exe Token: SeShutdownPrivilege 2520 explorer.exe Token: SeShutdownPrivilege 2520 explorer.exe Token: SeShutdownPrivilege 2520 explorer.exe -
Suspicious use of FindShellTrayWindow 27 IoCs
pid Process 2520 explorer.exe 2520 explorer.exe 2520 explorer.exe 2520 explorer.exe 2520 explorer.exe 2520 explorer.exe 2520 explorer.exe 2520 explorer.exe 2520 explorer.exe 2520 explorer.exe 2520 explorer.exe 2520 explorer.exe 2520 explorer.exe 2520 explorer.exe 2520 explorer.exe 2520 explorer.exe 2520 explorer.exe 2520 explorer.exe 2520 explorer.exe 2520 explorer.exe 2520 explorer.exe 2520 explorer.exe 2520 explorer.exe 2520 explorer.exe 2520 explorer.exe 2520 explorer.exe 2520 explorer.exe -
Suspicious use of SendNotifyMessage 17 IoCs
pid Process 2520 explorer.exe 2520 explorer.exe 2520 explorer.exe 2520 explorer.exe 2520 explorer.exe 2520 explorer.exe 2520 explorer.exe 2520 explorer.exe 2520 explorer.exe 2520 explorer.exe 2520 explorer.exe 2520 explorer.exe 2520 explorer.exe 2520 explorer.exe 2520 explorer.exe 2520 explorer.exe 2520 explorer.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2376 Client.exe -
Suspicious use of WriteProcessMemory 46 IoCs
description pid Process procid_target PID 2376 wrote to memory of 2520 2376 Client.exe 30 PID 2376 wrote to memory of 2520 2376 Client.exe 30 PID 2376 wrote to memory of 2520 2376 Client.exe 30 PID 2520 wrote to memory of 2992 2520 explorer.exe 32 PID 2520 wrote to memory of 2992 2520 explorer.exe 32 PID 2520 wrote to memory of 2992 2520 explorer.exe 32 PID 2376 wrote to memory of 2504 2376 Client.exe 31 PID 2376 wrote to memory of 2504 2376 Client.exe 31 PID 2376 wrote to memory of 2504 2376 Client.exe 31 PID 2376 wrote to memory of 2504 2376 Client.exe 31 PID 2376 wrote to memory of 2548 2376 Client.exe 33 PID 2376 wrote to memory of 2548 2376 Client.exe 33 PID 2376 wrote to memory of 2548 2376 Client.exe 33 PID 2376 wrote to memory of 2548 2376 Client.exe 33 PID 2376 wrote to memory of 1788 2376 Client.exe 34 PID 2376 wrote to memory of 1788 2376 Client.exe 34 PID 2376 wrote to memory of 1788 2376 Client.exe 34 PID 2376 wrote to memory of 1788 2376 Client.exe 34 PID 2376 wrote to memory of 2196 2376 Client.exe 35 PID 2376 wrote to memory of 2196 2376 Client.exe 35 PID 2376 wrote to memory of 2196 2376 Client.exe 35 PID 2376 wrote to memory of 2196 2376 Client.exe 35 PID 2376 wrote to memory of 2148 2376 Client.exe 36 PID 2376 wrote to memory of 2148 2376 Client.exe 36 PID 2376 wrote to memory of 2148 2376 Client.exe 36 PID 2376 wrote to memory of 2148 2376 Client.exe 36 PID 2376 wrote to memory of 2864 2376 Client.exe 37 PID 2376 wrote to memory of 2864 2376 Client.exe 37 PID 2376 wrote to memory of 2864 2376 Client.exe 37 PID 2376 wrote to memory of 2864 2376 Client.exe 37 PID 2376 wrote to memory of 1656 2376 Client.exe 38 PID 2376 wrote to memory of 1656 2376 Client.exe 38 PID 2376 wrote to memory of 1656 2376 Client.exe 38 PID 2376 wrote to memory of 1656 2376 Client.exe 38 PID 2376 wrote to memory of 2128 2376 Client.exe 39 PID 2376 wrote to memory of 2128 2376 Client.exe 39 PID 2376 wrote to memory of 2128 2376 Client.exe 39 PID 2376 wrote to memory of 2128 2376 Client.exe 39 PID 2376 wrote to memory of 1056 2376 Client.exe 40 PID 2376 wrote to memory of 1056 2376 Client.exe 40 PID 2376 wrote to memory of 1056 2376 Client.exe 40 PID 2376 wrote to memory of 1056 2376 Client.exe 40 PID 2376 wrote to memory of 824 2376 Client.exe 41 PID 2376 wrote to memory of 824 2376 Client.exe 41 PID 2376 wrote to memory of 824 2376 Client.exe 41 PID 2376 wrote to memory of 824 2376 Client.exe 41 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Windows\system32\ctfmon.exectfmon.exe3⤵PID:2992
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client understanding-described.gl.at.ply.gg 3953 ylYRZGgFZ2⤵PID:2504
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client understanding-described.gl.at.ply.gg 3953 ylYRZGgFZ2⤵PID:2548
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client understanding-described.gl.at.ply.gg 3953 ylYRZGgFZ2⤵PID:1788
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client understanding-described.gl.at.ply.gg 3953 ylYRZGgFZ2⤵PID:2196
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client understanding-described.gl.at.ply.gg 3953 ylYRZGgFZ2⤵PID:2148
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client understanding-described.gl.at.ply.gg 3953 ylYRZGgFZ2⤵PID:2864
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client understanding-described.gl.at.ply.gg 3953 ylYRZGgFZ2⤵PID:1656
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client understanding-described.gl.at.ply.gg 3953 ylYRZGgFZ2⤵PID:2128
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client understanding-described.gl.at.ply.gg 3953 ylYRZGgFZ2⤵PID:1056
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client understanding-described.gl.at.ply.gg 3953 ylYRZGgFZ2⤵PID:824
-