0ca290414a9c534768b3d2f227f34f4e7e5847e8021074c33e19012e7451c99a

Analysis

max time kernel
18s
platform
windows11-21h2_x64
resource
win11-20250207-en
resource tags

arch:x64arch:x86image:win11-20250207-enlocale:en-usos:windows11-21h2-x64system
submitted
07-02-2025 22:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CellikRat 4.0.1.7z
Size

312.4MB
MD5

9d602c95fc1fa17dfc8fc10071849b6b
SHA1

a1f9f65f7789ee61fe0fd2b0287ce9e870e41dda
SHA256

0ca290414a9c534768b3d2f227f34f4e7e5847e8021074c33e19012e7451c99a
SHA512

efd8c296510986e5f8942e13551b06608cc926f16906af10994d9a691ecfa95293a59af434de8c81cb78f774077fc19099607eb2b23fd382aff347e504e0a10d
SSDEEP

6291456:bt89et6TpL2RyM/iwVVE3BHlBlUyFp1P5NpoZYsq/M1lL5:p89f+YwVi9lBqyFSY/M1ll

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2852	CellikRat 4.0.1.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2852	CellikRat 4.0.1.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CellikRat 4.0.1.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3183222884-3758288823-2808636388-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3496	7zFM.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	3496	7zFM.exe
Token: 35	3496	7zFM.exe
Token: SeSecurityPrivilege	3496	7zFM.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3496	7zFM.exe
3496	7zFM.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3172	MiniSearchHost.exe
2852	CellikRat 4.0.1.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\CellikRat 4.0.1.7z"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3496

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3172

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3548

C:\Users\Admin\Desktop\CellikRat 4.0.1\CellikRat 4.0.1.exe
"C:\Users\Admin\Desktop\CellikRat 4.0.1\CellikRat 4.0.1.exe"
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
23KB

MD5
cd5ddedbaa093531fb6cc36a4ce9c7e2

SHA1
41d9c133ca4a965c425175b7c793186bce452a17

SHA256
10d0aa8d5745328b850780174938aff867432f168ec18a2df992fc5ccc0d0fe8

SHA512
568d1997af163344ccaca7976eed2ac80f5a9d29777701cf8be502d56e48b4f17cbcc90e105c0298bc6d5af2ffc1f615455a6e5f1824539997408195de489e58

Download Submit
memory/2852-1047-0x0000000000090000-0x00000000054C8000-memory.dmp

Filesize
84.2MB

Download
memory/2852-1049-0x0000000000090000-0x00000000054C8000-memory.dmp

Filesize
84.2MB

Download