Analysis
-
max time kernel
127s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
14/02/2025, 19:28
Behavioral task
behavioral1
Sample
Client.exe
Resource
win7-20240903-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
Client.exe
Resource
win10v2004-20250211-en
windows10-2004-x64
17 signatures
150 seconds
General
-
Target
Client.exe
-
Size
158KB
-
MD5
0664ef4233864e722f5f0405d95d4383
-
SHA1
0740cba3719bd0637d3a3888f0cbe588e05c9466
-
SHA256
69676e5b1f323b61cb1847b46dbab99c649759ae90f38910e3de24e592990a56
-
SHA512
db56f8da7e66f7022f71e74867249aa8c3bf9065f7a5c62762aafc2e713e9dac3905cae235cdec6ddd10386e8f107672450aa4d43e42190cd36d196f94b5c22c
-
SSDEEP
3072:MbzrH+0OoCthfbEFtbcfjF45gjryKKqH6JY2doszEmQotEPPcfPUOO8Y:Mbzre0ODhTEPgnjuIJzo+PPcfPUB8
Score
10/10
Malware Config
Extracted
Family
arrowrat
Botnet
Client
C2
79.110.49.241:6969
Mutex
QZuBsJcIj
Signatures
-
Arrowrat family
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Modifies registry class 5 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe -
Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 2676 Client.exe 2676 Client.exe 2676 Client.exe 2676 Client.exe 2676 Client.exe 2676 Client.exe 2676 Client.exe 2676 Client.exe 2676 Client.exe 2676 Client.exe 2676 Client.exe 2676 Client.exe 2676 Client.exe 2676 Client.exe 2676 Client.exe 2676 Client.exe 2676 Client.exe 2676 Client.exe 2676 Client.exe 2676 Client.exe 2676 Client.exe 2676 Client.exe -
Suspicious use of AdjustPrivilegeToken 13 IoCs
description pid Process Token: SeDebugPrivilege 2676 Client.exe Token: SeShutdownPrivilege 2784 explorer.exe Token: SeShutdownPrivilege 2784 explorer.exe Token: SeShutdownPrivilege 2784 explorer.exe Token: SeShutdownPrivilege 2784 explorer.exe Token: SeShutdownPrivilege 2784 explorer.exe Token: SeShutdownPrivilege 2784 explorer.exe Token: SeShutdownPrivilege 2784 explorer.exe Token: SeShutdownPrivilege 2784 explorer.exe Token: SeShutdownPrivilege 2784 explorer.exe Token: SeShutdownPrivilege 2784 explorer.exe Token: SeShutdownPrivilege 2784 explorer.exe Token: SeShutdownPrivilege 2784 explorer.exe -
Suspicious use of FindShellTrayWindow 27 IoCs
pid Process 2784 explorer.exe 2784 explorer.exe 2784 explorer.exe 2784 explorer.exe 2784 explorer.exe 2784 explorer.exe 2784 explorer.exe 2784 explorer.exe 2784 explorer.exe 2784 explorer.exe 2784 explorer.exe 2784 explorer.exe 2784 explorer.exe 2784 explorer.exe 2784 explorer.exe 2784 explorer.exe 2784 explorer.exe 2784 explorer.exe 2784 explorer.exe 2784 explorer.exe 2784 explorer.exe 2784 explorer.exe 2784 explorer.exe 2784 explorer.exe 2784 explorer.exe 2784 explorer.exe 2784 explorer.exe -
Suspicious use of SendNotifyMessage 17 IoCs
pid Process 2784 explorer.exe 2784 explorer.exe 2784 explorer.exe 2784 explorer.exe 2784 explorer.exe 2784 explorer.exe 2784 explorer.exe 2784 explorer.exe 2784 explorer.exe 2784 explorer.exe 2784 explorer.exe 2784 explorer.exe 2784 explorer.exe 2784 explorer.exe 2784 explorer.exe 2784 explorer.exe 2784 explorer.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2676 Client.exe -
Suspicious use of WriteProcessMemory 49 IoCs
description pid Process procid_target PID 2676 wrote to memory of 2784 2676 Client.exe 31 PID 2676 wrote to memory of 2784 2676 Client.exe 31 PID 2676 wrote to memory of 2784 2676 Client.exe 31 PID 2676 wrote to memory of 2864 2676 Client.exe 32 PID 2676 wrote to memory of 2864 2676 Client.exe 32 PID 2676 wrote to memory of 2864 2676 Client.exe 32 PID 2676 wrote to memory of 2864 2676 Client.exe 32 PID 2676 wrote to memory of 2812 2676 Client.exe 33 PID 2676 wrote to memory of 2812 2676 Client.exe 33 PID 2676 wrote to memory of 2812 2676 Client.exe 33 PID 2676 wrote to memory of 2812 2676 Client.exe 33 PID 2676 wrote to memory of 2768 2676 Client.exe 34 PID 2676 wrote to memory of 2768 2676 Client.exe 34 PID 2676 wrote to memory of 2768 2676 Client.exe 34 PID 2676 wrote to memory of 2768 2676 Client.exe 34 PID 2676 wrote to memory of 2128 2676 Client.exe 35 PID 2676 wrote to memory of 2128 2676 Client.exe 35 PID 2676 wrote to memory of 2128 2676 Client.exe 35 PID 2676 wrote to memory of 2128 2676 Client.exe 35 PID 2676 wrote to memory of 2692 2676 Client.exe 36 PID 2676 wrote to memory of 2692 2676 Client.exe 36 PID 2676 wrote to memory of 2692 2676 Client.exe 36 PID 2676 wrote to memory of 2692 2676 Client.exe 36 PID 2676 wrote to memory of 2876 2676 Client.exe 37 PID 2676 wrote to memory of 2876 2676 Client.exe 37 PID 2676 wrote to memory of 2876 2676 Client.exe 37 PID 2676 wrote to memory of 2876 2676 Client.exe 37 PID 2676 wrote to memory of 2576 2676 Client.exe 38 PID 2676 wrote to memory of 2576 2676 Client.exe 38 PID 2676 wrote to memory of 2576 2676 Client.exe 38 PID 2676 wrote to memory of 2576 2676 Client.exe 38 PID 2676 wrote to memory of 2804 2676 Client.exe 39 PID 2676 wrote to memory of 2804 2676 Client.exe 39 PID 2676 wrote to memory of 2804 2676 Client.exe 39 PID 2676 wrote to memory of 2804 2676 Client.exe 39 PID 2676 wrote to memory of 2392 2676 Client.exe 40 PID 2676 wrote to memory of 2392 2676 Client.exe 40 PID 2676 wrote to memory of 2392 2676 Client.exe 40 PID 2676 wrote to memory of 2392 2676 Client.exe 40 PID 2676 wrote to memory of 2072 2676 Client.exe 41 PID 2676 wrote to memory of 2072 2676 Client.exe 41 PID 2676 wrote to memory of 2072 2676 Client.exe 41 PID 2676 wrote to memory of 2072 2676 Client.exe 41 PID 2784 wrote to memory of 2596 2784 explorer.exe 42 PID 2784 wrote to memory of 2596 2784 explorer.exe 42 PID 2784 wrote to memory of 2596 2784 explorer.exe 42 PID 2676 wrote to memory of 2592 2676 Client.exe 43 PID 2676 wrote to memory of 2592 2676 Client.exe 43 PID 2676 wrote to memory of 2592 2676 Client.exe 43 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Windows\system32\ctfmon.exectfmon.exe3⤵PID:2596
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client 79.110.49.241 6969 QZuBsJcIj2⤵PID:2864
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client 79.110.49.241 6969 QZuBsJcIj2⤵PID:2812
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client 79.110.49.241 6969 QZuBsJcIj2⤵PID:2768
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client 79.110.49.241 6969 QZuBsJcIj2⤵PID:2128
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client 79.110.49.241 6969 QZuBsJcIj2⤵PID:2692
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client 79.110.49.241 6969 QZuBsJcIj2⤵PID:2876
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client 79.110.49.241 6969 QZuBsJcIj2⤵PID:2576
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client 79.110.49.241 6969 QZuBsJcIj2⤵PID:2804
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client 79.110.49.241 6969 QZuBsJcIj2⤵PID:2392
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client 79.110.49.241 6969 QZuBsJcIj2⤵PID:2072
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2676 -s 6642⤵PID:2592
-