Analysis
-
max time kernel
127s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
29-01-2025 04:55
Behavioral task
behavioral1
Sample
Client.exe
Resource
win7-20240903-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
Client.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
19 signatures
150 seconds
General
-
Target
Client.exe
-
Size
158KB
-
MD5
d8fdc3e470f0d242e52ba6d2678749d0
-
SHA1
3d33f93355bfe9f1575219cc73485d67371ef1a0
-
SHA256
c5d3e50be9fa5152dcb8855ec98bb0432a02f123d1493c84cc56b9f880517717
-
SHA512
cc2c8c728e7de468cbc58dda017cc2f847e9b04e55211a0a351a6aed3d21681a7225fb24d60d410e49489da4966819c316e9401021f747c2ee706d4fecb98bf6
-
SSDEEP
3072:rbziH+0OoCthfbEFtbcfjF45gjryKKqH6JY2doszEmQotEPPcfPJRO8Y:rbzie0ODhTEPgnjuIJzo+PPcfPJc8
Score
10/10
Malware Config
Extracted
Family
arrowrat
Botnet
Client
C2
understanding-described.gl.at.ply.gg:3953
Mutex
UmvLBIzwz
Signatures
-
Arrowrat family
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, C:\\Users\\Admin\\AppData\\Local\\Temp\\Pan\\dora" Client.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Modifies registry class 5 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe -
Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 2392 Client.exe 2392 Client.exe 2392 Client.exe 2392 Client.exe 2392 Client.exe 2392 Client.exe 2392 Client.exe 2392 Client.exe 2392 Client.exe 2392 Client.exe 2392 Client.exe 2392 Client.exe 2392 Client.exe 2392 Client.exe 2392 Client.exe 2392 Client.exe 2392 Client.exe 2392 Client.exe 2392 Client.exe 2392 Client.exe 2392 Client.exe 2392 Client.exe -
Suspicious use of AdjustPrivilegeToken 13 IoCs
description pid Process Token: SeDebugPrivilege 2392 Client.exe Token: SeShutdownPrivilege 3052 explorer.exe Token: SeShutdownPrivilege 3052 explorer.exe Token: SeShutdownPrivilege 3052 explorer.exe Token: SeShutdownPrivilege 3052 explorer.exe Token: SeShutdownPrivilege 3052 explorer.exe Token: SeShutdownPrivilege 3052 explorer.exe Token: SeShutdownPrivilege 3052 explorer.exe Token: SeShutdownPrivilege 3052 explorer.exe Token: SeShutdownPrivilege 3052 explorer.exe Token: SeShutdownPrivilege 3052 explorer.exe Token: SeShutdownPrivilege 3052 explorer.exe Token: SeShutdownPrivilege 3052 explorer.exe -
Suspicious use of FindShellTrayWindow 27 IoCs
pid Process 3052 explorer.exe 3052 explorer.exe 3052 explorer.exe 3052 explorer.exe 3052 explorer.exe 3052 explorer.exe 3052 explorer.exe 3052 explorer.exe 3052 explorer.exe 3052 explorer.exe 3052 explorer.exe 3052 explorer.exe 3052 explorer.exe 3052 explorer.exe 3052 explorer.exe 3052 explorer.exe 3052 explorer.exe 3052 explorer.exe 3052 explorer.exe 3052 explorer.exe 3052 explorer.exe 3052 explorer.exe 3052 explorer.exe 3052 explorer.exe 3052 explorer.exe 3052 explorer.exe 3052 explorer.exe -
Suspicious use of SendNotifyMessage 17 IoCs
pid Process 3052 explorer.exe 3052 explorer.exe 3052 explorer.exe 3052 explorer.exe 3052 explorer.exe 3052 explorer.exe 3052 explorer.exe 3052 explorer.exe 3052 explorer.exe 3052 explorer.exe 3052 explorer.exe 3052 explorer.exe 3052 explorer.exe 3052 explorer.exe 3052 explorer.exe 3052 explorer.exe 3052 explorer.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2392 Client.exe -
Suspicious use of WriteProcessMemory 46 IoCs
description pid Process procid_target PID 2392 wrote to memory of 3052 2392 Client.exe 30 PID 2392 wrote to memory of 3052 2392 Client.exe 30 PID 2392 wrote to memory of 3052 2392 Client.exe 30 PID 2392 wrote to memory of 2052 2392 Client.exe 31 PID 2392 wrote to memory of 2052 2392 Client.exe 31 PID 2392 wrote to memory of 2052 2392 Client.exe 31 PID 2392 wrote to memory of 2052 2392 Client.exe 31 PID 2392 wrote to memory of 2336 2392 Client.exe 32 PID 2392 wrote to memory of 2336 2392 Client.exe 32 PID 2392 wrote to memory of 2336 2392 Client.exe 32 PID 2392 wrote to memory of 2336 2392 Client.exe 32 PID 2392 wrote to memory of 2496 2392 Client.exe 33 PID 2392 wrote to memory of 2496 2392 Client.exe 33 PID 2392 wrote to memory of 2496 2392 Client.exe 33 PID 2392 wrote to memory of 2496 2392 Client.exe 33 PID 2392 wrote to memory of 2276 2392 Client.exe 34 PID 2392 wrote to memory of 2276 2392 Client.exe 34 PID 2392 wrote to memory of 2276 2392 Client.exe 34 PID 2392 wrote to memory of 2276 2392 Client.exe 34 PID 2392 wrote to memory of 2304 2392 Client.exe 35 PID 2392 wrote to memory of 2304 2392 Client.exe 35 PID 2392 wrote to memory of 2304 2392 Client.exe 35 PID 2392 wrote to memory of 2304 2392 Client.exe 35 PID 2392 wrote to memory of 2284 2392 Client.exe 36 PID 2392 wrote to memory of 2284 2392 Client.exe 36 PID 2392 wrote to memory of 2284 2392 Client.exe 36 PID 2392 wrote to memory of 2284 2392 Client.exe 36 PID 2392 wrote to memory of 2116 2392 Client.exe 37 PID 2392 wrote to memory of 2116 2392 Client.exe 37 PID 2392 wrote to memory of 2116 2392 Client.exe 37 PID 2392 wrote to memory of 2116 2392 Client.exe 37 PID 2392 wrote to memory of 2800 2392 Client.exe 38 PID 2392 wrote to memory of 2800 2392 Client.exe 38 PID 2392 wrote to memory of 2800 2392 Client.exe 38 PID 2392 wrote to memory of 2800 2392 Client.exe 38 PID 2392 wrote to memory of 2904 2392 Client.exe 39 PID 2392 wrote to memory of 2904 2392 Client.exe 39 PID 2392 wrote to memory of 2904 2392 Client.exe 39 PID 2392 wrote to memory of 2904 2392 Client.exe 39 PID 2392 wrote to memory of 2200 2392 Client.exe 40 PID 2392 wrote to memory of 2200 2392 Client.exe 40 PID 2392 wrote to memory of 2200 2392 Client.exe 40 PID 2392 wrote to memory of 2200 2392 Client.exe 40 PID 3052 wrote to memory of 2260 3052 explorer.exe 41 PID 3052 wrote to memory of 2260 3052 explorer.exe 41 PID 3052 wrote to memory of 2260 3052 explorer.exe 41 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"1⤵
- Modifies WinLogon for persistence
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Windows\system32\ctfmon.exectfmon.exe3⤵PID:2260
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client understanding-described.gl.at.ply.gg 3953 UmvLBIzwz2⤵PID:2052
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client understanding-described.gl.at.ply.gg 3953 UmvLBIzwz2⤵PID:2336
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client understanding-described.gl.at.ply.gg 3953 UmvLBIzwz2⤵PID:2496
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client understanding-described.gl.at.ply.gg 3953 UmvLBIzwz2⤵PID:2276
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client understanding-described.gl.at.ply.gg 3953 UmvLBIzwz2⤵PID:2304
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client understanding-described.gl.at.ply.gg 3953 UmvLBIzwz2⤵PID:2284
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client understanding-described.gl.at.ply.gg 3953 UmvLBIzwz2⤵PID:2116
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client understanding-described.gl.at.ply.gg 3953 UmvLBIzwz2⤵PID:2800
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client understanding-described.gl.at.ply.gg 3953 UmvLBIzwz2⤵PID:2904
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client understanding-described.gl.at.ply.gg 3953 UmvLBIzwz2⤵PID:2200
-