Overview

overview

10

Static

static

3

SecuriteIn...51.exe

windows10-2004-x64

10

SecuriteIn...51.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    102s
  • max time network
    103s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250502-en
  • submitted
    26/05/2025, 00:43

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    SecuriteInfo.com.Variant.Zusy.548548.28004.751.exe
  • Size 1.2MB
  • Sample250526-a225datvh1
  • SHA256 4d3c3ffd581a9f1e9e6e7b67e18da73ea2c042455466a7e80e9457a431ec25ac
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
celestialratleb1.8trojan

Malware Config

Extracted

Family

  • celestialrat

Version

  • 0.0.1

Campaign

  • Leb1.8

C2

  • 193.233.113.61:3333

Mutex

  • Celestial_4381621064065942400788

Attributes
  • auto_start_type

    TaskScheduler

  • blacklisted_countries

    RU;US;BY

  • bootkit

    True

  • botkiller

    True

  • client_filename

    NVDisplay.Container.exe

  • client_subfolder

    NVIDIA\NvidiaLibs

  • command_line

    %CommandLine%

  • connection_type

    Dynamic

  • country_blacklist

    False

  • detectdebugger

    True

  • detectsandboxie

    True

  • detectsmalldisk

    True

  • detectvm

    True

  • detectwindowsxp

    True

  • disable_install_prompt

    True

  • disablecmd

    False

  • disabledefender

    False

  • disablefirewall

    True

  • disableregistry

    False

  • disablerun

    False

  • disabletaskmanager

    False

  • disableuac

    True

  • disablewinkeys

    False

  • hidden_attributes

    True

  • hidden_key

    False

  • highest_priority

    True

  • hollowed_process

    %HollowedProcess%

  • hosts_blacklist

    False

  • install_client

    True

  • libraries_subfolder

    NVIDIA\ComputeCache\Libs

  • lotl_application

    %LOTLApplication%

  • melt_file

    True

  • pastebin

    https://pastebin.com/raw/8QkMdDVk

  • registry_key

    Celestial

  • root_client_folder

    %localappdata%

  • root_libraries_folder

    %appdata%

  • root_watchdog_folder

    %temp%

  • rootkit

    False

  • rtlsetprocesscritical

    True

  • system_attributes

    True

  • task_name

    NVIDIA App SelfUpdate_{VBUH8FGTH4H4GH4-4WDFH-2D98JG9RJ9}

  • try_other_method

    True

  • usb_spread

    False

  • usb_spread_filename

    SteamLoader.exe

  • watchdog

    %temp%

  • watchdog_filename

    watchdog

Signatures

  • CelestialRAT

    CelestialRAT is a trojan written in C#.

    trojancelestialrat
  • Celestialrat family
    celestialrat
  • Detects CelestialRAT. 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Zusy.548548.28004.751.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Zusy.548548.28004.751.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:6096

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/6096-0-0x00007FFA34853000-0x00007FFA34855000-memory.dmp
        Download

        memory/6096-1-0x00000193A51F0000-0x00000193A5324000-memory.dmp
        Download

        memory/6096-2-0x00000193A5730000-0x00000193A5776000-memory.dmp
        Download

        memory/6096-3-0x00007FFA34850000-0x00007FFA35312000-memory.dmp
        Download

        memory/6096-5-0x00007FFA34850000-0x00007FFA35312000-memory.dmp
        Download