Overview

overview

10

Static

static

10

FinalMom.exe

windows10-ltsc_2021-x64

10

FinalMom.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    76s
  • max time network
    63s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250610-en
  • submitted
    18/06/2025, 14:17

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    FinalMom.exe
  • Size 936KB
  • Sample250618-rl356sen4x
  • SHA256 0a7398292f37cf93e9bff0314cf0c4ffa8253071fbbe525d4268e2d171be80da
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
celestialratguestdefense_evasiontrojan

Malware Config

Extracted

Family

  • celestialrat

Version

  • 1.0.2

Campaign

  • Guest

C2

  • 127.0.0.1:3333

Mutex

  • Celestial_9112213264593432444112

Attributes
  • auto_start_type

    Disabled

  • blacklisted_countries

    RU;US;BY

  • bootkit

    False

  • botkiller

    False

  • client_filename

    Celestial.exe

  • client_subfolder

    Celestial

  • command_line

    %CommandLine%

  • connection_type

    Static

  • country_blacklist

    False

  • detectdebugger

    False

  • detectsandboxie

    False

  • detectsmalldisk

    False

  • detectvm

    False

  • detectwindowsxp

    False

  • disable_install_prompt

    False

  • disablecmd

    False

  • disablefirewall

    False

  • disableregistry

    False

  • disablerun

    False

  • disabletaskmanager

    False

  • disableuac

    False

  • disablewinkeys

    False

  • hidden_attributes

    False

  • hidden_key

    False

  • highest_priority

    False

  • hollowed_process

    %HollowedProcess%

  • hosts_blacklist

    False

  • install_client

    True

  • libraries_subfolder

    CelestialLibs

  • lotl_application

    %LOTLApplication%

  • melt_file

    False

  • pastebin

    https://pastebin.com/raw/XXXXXX

  • registry_key

    Celestial

  • root_client_folder

    %appdata%

  • root_libraries_folder

    Program Folder

  • root_watchdog_folder

    %temp%

  • rootkit

    False

  • rtlsetprocesscritical

    False

  • system_attributes

    False

  • task_name

    Celestial

  • try_other_method

    False

  • usb_spread

    False

  • usb_spread_filename

    Celestial.exe

xor.hex

Signatures

  • CelestialRAT

    CelestialRAT is a trojan written in C#.

    trojancelestialrat
  • Celestialrat family
    celestialrat
  • Detects CelestialRAT. 2 IoCs
  • Executes dropped EXE 1 IoCs
  • ConfuserEx .NET packer 1 IoCs

    Detects ConfuserEx .NET packer.

  • Delays execution with timeout.exe 1 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\FinalMom.exe
    "C:\Users\Admin\AppData\Local\Temp\FinalMom.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2388
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpB95D.tmp.bat""
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3708
      • C:\Windows\system32\chcp.com
        chcp 65001
        3⤵
          PID:1904
        • C:\Windows\system32\timeout.exe
          timeout 3
          3⤵
          • Delays execution with timeout.exe
          PID:4036
        • C:\Users\Admin\AppData\Roaming\Celestial\Celestial.exe
          "C:\Users\Admin\AppData\Roaming\Celestial\Celestial.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4572
          • C:\Windows\SYSTEM32\attrib.exe
            "attrib" +h +s "C:\Users\Admin\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1"
            4⤵
            • Views/modifies file attributes
            PID:3584
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
      1⤵
        PID:2432
      • C:\Windows\System32\rundll32.exe
        C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
        1⤵
          PID:456

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              tmpB95D.tmp.bat
              • Path C:\Users\Admin\AppData\Local\Temp\tmpB95D.tmp.bat
              • Size 223B
              • SHA256 1187bbf0c074715ccacaa028b51ef603ad9c4813adc90823d50e397e0803214b
              • MD5 SHA1 SHA512
              Submit Download

              Celestial.exe
              • Path C:\Users\Admin\AppData\Roaming\Celestial\Celestial.exe
              • Size 936KB
              • SHA256 0a7398292f37cf93e9bff0314cf0c4ffa8253071fbbe525d4268e2d171be80da
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              Microsoft.PowerShell_profile.ps1
              • Path C:\Users\Admin\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1
              • Size 2KB
              • SHA256 8b6f8fbf37693af36331f721b5d2426f85c4e529365853af1e15b58357d6b6fe
              • MD5 SHA1 SHA512
              Submit Download

              memory/2388-0-0x00007FFB338D3000-0x00007FFB338D5000-memory.dmp
              Download

              memory/2388-1-0x000002893EF40000-0x000002893F030000-memory.dmp
              Download

              memory/2388-2-0x0000028940D50000-0x0000028940D9E000-memory.dmp
              Download

              memory/2388-3-0x00007FFB338D0000-0x00007FFB34392000-memory.dmp
              Download

              memory/2388-9-0x00007FFB338D0000-0x00007FFB34392000-memory.dmp
              Download

              memory/4572-13-0x00007FFB338D0000-0x00007FFB34392000-memory.dmp
              Download

              memory/4572-14-0x00007FFB338D0000-0x00007FFB34392000-memory.dmp
              Download

              memory/4572-15-0x0000023EA0A00000-0x0000023EA0A08000-memory.dmp
              Download

              memory/4572-18-0x00007FFB338D0000-0x00007FFB34392000-memory.dmp
              Download