Overview

overview

10

Static

static

10

FinalMom.exe

windows10-ltsc_2021-x64

10

FinalMom.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    57s
  • max time network
    55s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20250610-en
  • submitted
    18/06/2025, 14:17

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    FinalMom.exe
  • Size 936KB
  • Sample250618-rl356sen4x
  • SHA256 0a7398292f37cf93e9bff0314cf0c4ffa8253071fbbe525d4268e2d171be80da
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
celestialratguestdefense_evasiontrojan

Malware Config

Extracted

Family

  • celestialrat

Version

  • 1.0.2

Campaign

  • Guest

C2

  • 127.0.0.1:3333

Mutex

  • Celestial_9112213264593432444112

Attributes
  • auto_start_type

    Disabled

  • blacklisted_countries

    RU;US;BY

  • bootkit

    False

  • botkiller

    False

  • client_filename

    Celestial.exe

  • client_subfolder

    Celestial

  • command_line

    %CommandLine%

  • connection_type

    Static

  • country_blacklist

    False

  • detectdebugger

    False

  • detectsandboxie

    False

  • detectsmalldisk

    False

  • detectvm

    False

  • detectwindowsxp

    False

  • disable_install_prompt

    False

  • disablecmd

    False

  • disablefirewall

    False

  • disableregistry

    False

  • disablerun

    False

  • disabletaskmanager

    False

  • disableuac

    False

  • disablewinkeys

    False

  • hidden_attributes

    False

  • hidden_key

    False

  • highest_priority

    False

  • hollowed_process

    %HollowedProcess%

  • hosts_blacklist

    False

  • install_client

    True

  • libraries_subfolder

    CelestialLibs

  • lotl_application

    %LOTLApplication%

  • melt_file

    False

  • pastebin

    https://pastebin.com/raw/XXXXXX

  • registry_key

    Celestial

  • root_client_folder

    %appdata%

  • root_libraries_folder

    Program Folder

  • root_watchdog_folder

    %temp%

  • rootkit

    False

  • rtlsetprocesscritical

    False

  • system_attributes

    False

  • task_name

    Celestial

  • try_other_method

    False

  • usb_spread

    False

  • usb_spread_filename

    Celestial.exe

xor.hex

Signatures

  • CelestialRAT

    CelestialRAT is a trojan written in C#.

    trojancelestialrat
  • Celestialrat family
    celestialrat
  • Detects CelestialRAT. 2 IoCs
  • Executes dropped EXE 1 IoCs
  • ConfuserEx .NET packer 1 IoCs

    Detects ConfuserEx .NET packer.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 45 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of FindShellTrayWindow 41 IoCs
  • Suspicious use of SendNotifyMessage 41 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\FinalMom.exe
    "C:\Users\Admin\AppData\Local\Temp\FinalMom.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5932
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp8D2C.tmp.bat""
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4812
      • C:\Windows\system32\chcp.com
        chcp 65001
        3⤵
          PID:240
        • C:\Windows\system32\timeout.exe
          timeout 3
          3⤵
          • Delays execution with timeout.exe
          PID:220
        • C:\Users\Admin\AppData\Roaming\Celestial\Celestial.exe
          "C:\Users\Admin\AppData\Roaming\Celestial\Celestial.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2856
          • C:\Windows\SYSTEM32\attrib.exe
            "attrib" +h +s "C:\Users\Admin\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1"
            4⤵
            • Views/modifies file attributes
            PID:1204
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /4
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2168
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:3312

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            tmp8D2C.tmp.bat
            • Path C:\Users\Admin\AppData\Local\Temp\tmp8D2C.tmp.bat
            • Size 223B
            • SHA256 f19b20f106c8dec6e40615bc0d09040a9e3cdd1fc0101a579fc22bce50c77784
            • MD5 SHA1 SHA512
            Submit Download

            Celestial.exe
            • Path C:\Users\Admin\AppData\Roaming\Celestial\Celestial.exe
            • Size 936KB
            • SHA256 0a7398292f37cf93e9bff0314cf0c4ffa8253071fbbe525d4268e2d171be80da
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Microsoft.PowerShell_profile.ps1
            • Path C:\Users\Admin\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1
            • Size 2KB
            • SHA256 8b6f8fbf37693af36331f721b5d2426f85c4e529365853af1e15b58357d6b6fe
            • MD5 SHA1 SHA512
            Submit Download

            memory/2168-31-0x00000217D07E0000-0x00000217D07E1000-memory.dmp
            Download

            memory/2168-30-0x00000217D07E0000-0x00000217D07E1000-memory.dmp
            Download

            memory/2168-25-0x00000217D07E0000-0x00000217D07E1000-memory.dmp
            Download

            memory/2168-26-0x00000217D07E0000-0x00000217D07E1000-memory.dmp
            Download

            memory/2168-27-0x00000217D07E0000-0x00000217D07E1000-memory.dmp
            Download

            memory/2168-28-0x00000217D07E0000-0x00000217D07E1000-memory.dmp
            Download

            memory/2168-29-0x00000217D07E0000-0x00000217D07E1000-memory.dmp
            Download

            memory/2168-19-0x00000217D07E0000-0x00000217D07E1000-memory.dmp
            Download

            memory/2168-20-0x00000217D07E0000-0x00000217D07E1000-memory.dmp
            Download

            memory/2168-21-0x00000217D07E0000-0x00000217D07E1000-memory.dmp
            Download

            memory/2856-18-0x00007FFA69900000-0x00007FFA6A3C2000-memory.dmp
            Download

            memory/2856-15-0x000002CB3EA20000-0x000002CB3EA28000-memory.dmp
            Download

            memory/2856-14-0x00007FFA69900000-0x00007FFA6A3C2000-memory.dmp
            Download

            memory/2856-13-0x00007FFA69900000-0x00007FFA6A3C2000-memory.dmp
            Download

            memory/5932-1-0x000001C8C2C40000-0x000001C8C2D30000-memory.dmp
            Download

            memory/5932-0-0x00007FFA69903000-0x00007FFA69905000-memory.dmp
            Download

            memory/5932-3-0x00007FFA69900000-0x00007FFA6A3C2000-memory.dmp
            Download

            memory/5932-2-0x000001C8C30C0000-0x000001C8C310E000-memory.dmp
            Download

            memory/5932-9-0x00007FFA69900000-0x00007FFA6A3C2000-memory.dmp
            Download