arktunnel | ProctorU[.]1[.]32[.]win[.]06V2[.]exe[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
ProctorU.1.32.win.06V2.exe.bin
Size 13.4MB
Sample261111-d6v4eaew8w
SHA256 9ca08f9fe3fd94a0b66bce740dad4923fe7e3c39f7e1e3a8d7674c72f32c7f3a
MD5 8e63bf1232e3d401f2c42afeee96d2f6
SHA1 adbac7e3362ae46b7f569eac95753b280b4010a2
SHA512 e8a24f053dc64f9fd8dd44e9b855bf6c13b8328f5ec25d37bd4b12edb09012db8a6c2e897f5ebba745d5ac148a989c5ed771a02ddabd796a3c1f4641aff5c9e2
SSDEEP 393216:Su9bsBMh6x8VINgvaULDrAXYHyLDohkaF:6Mh2gvaUDAXYHyL0hk
TLSH
T19AE6C0A37299ACDAF6956073DD61E037C361FDA48B3B41EB3C582B5DCBA72118E06311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

1.32.win.06 proxy tunnel loader arktunnel

Malware Config

Extracted

Family

arktunnel

Version

1.32

Campaign

1.32.win.06

reg.pcflyer.ca:443/ws

Signatures

Family: ArkTunnel
ArkTunnel is a Windows proxy implant that tunnels connections over a WebSocket C2, written in C.
proxy tunnel loader arktunnel

Detects ArkTunnel steganographic loader 1 IoCs

resource	yara_rule
sample	family_arktunnel_loader

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ProctorU.1.32.win.06V2.exe.bin

File Explorer

ProctorU.1.32.win.06V2.exe.bin

.exe 13.4MB

ProctorU.1.32.win.06V2.exe.bin

IMPHASH 59c08103465885e1501f26f3890368f2
SHA256 9ca08f9fe3fd94a0b66bce740dad4923fe7e3c39f7e1e3a8d7674c72f32c7f3a
MD5 8e63bf1232e3d401f2c42afeee96d2f6
SHA1 adbac7e3362ae46b7f569eac95753b280b4010a2
SHA512 e8a24f053dc64f9fd8dd44e9b855bf6c13b8328f5ec25d37bd4b12edb09012db8a6c2e897f5ebba745d5ac148a989c5ed771a02ddabd796a3c1f4641aff5c9e2
SSDEEP 393216:Su9bsBMh6x8VINgvaULDrAXYHyLDohkaF:6Mh2gvaUDAXYHyL0hk
TLSH
T19AE6C0A37299ACDAF6956073DD61E037C361FDA48B3B41EB3C582B5DCBA72118E06311
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects ArkTunnel steganographic loader
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1702744

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

LCMapStringW FlsFree FlsSetValue FlsGetValue FlsAlloc GetStdHandle GetFileType SetStdHandle VirtualQuery VirtualAlloc GetSystemInfo HeapQueryInformation FreeLibraryAndExitThread ExitThread CreateThread GetCommandLineW GetCommandLineA ExitProcess GetTimeZoneInformation RtlUnwindEx QueryPerformanceFrequency RaiseException OutputDebugStringW GetConsoleOutputCP GetConsoleMode SetFilePointerEx FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetStringTypeW WriteConsoleW GetStartupInfoW IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext FindFirstFileExW SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive FindResourceExW GetTempFileNameW GetWindowsDirectoryW SearchPathW GetProfileIntW Sleep VirtualProtect SetErrorMode SystemTimeToTzSpecificLocalTime GetFileTime GetFileSizeEx GetFileAttributesExW FileTimeToLocalFileTime FileTimeToSystemTime GlobalGetAtomNameW GetFileAttributesW GlobalFlags GetUserDefaultUILanguage GetSystemDefaultUILanguage GetLocaleInfoW GetCurrentDirectoryW LocalReAlloc LocalAlloc GlobalHandle GlobalReAlloc TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSection InitializeCriticalSectionAndSpinCount CompareStringW GlobalFindAtomW GetSystemDirectoryW EncodePointer GetThreadLocale lstrcmpiW GetCurrentProcess DuplicateHandle WriteFile UnlockFile SetFilePointer SetEndOfFile ReadFile LockFile GetVolumeInformationW GetFullPathNameW GetFileSize FlushFileBuffers FindFirstFileW FindClose CreateFileW GlobalAddAtomW ResumeThread SetThreadPriority WaitForSingleObject CloseHandle GetCurrentProcessId VerifyVersionInfoW VerSetConditionMask WritePrivateProfileStringW GetPrivateProfileStringW GetPrivateProfileIntW GetModuleHandleW GetProcAddress lstrcpyW WideCharToMultiByte QueryActCtxW FindActCtxSectionStringW DeactivateActCtx ActivateActCtx CreateActCtxW lstrcmpW lstrcmpA GlobalDeleteAtom LoadLibraryW LoadLibraryExW GetModuleHandleExW GetModuleFileNameW FreeLibrary GetVersionExW GetCurrentThreadId GetCurrentThread OutputDebugStringA SetLastError CopyFileW FormatMessageW MulDiv LocalFree GlobalFree GlobalLock GlobalUnlock GlobalSize GlobalAlloc MultiByteToWideChar GetTickCount64 HeapFree RemoveDirectoryW DeleteFileW CreateDirectoryW GetTempPathW FindResourceW LoadResource LockResource SizeofResource GetProcessHeap DeleteCriticalSection DecodePointer HeapAlloc HeapReAlloc GetLastError HeapSize InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection RtlPcToFileHeader

user32

SetRect InvalidateRgn CopyAcceleratorTableW CharNextW KillTimer SetTimer RealChildWindowFromPoint DeleteMenu CopyImage WindowFromPoint ReleaseCapture SetCapture WaitMessage IsDialogMessageW SetWindowTextW CheckDlgButton MoveWindow ShowWindow MonitorFromWindow WinHelpW GetScrollInfo SetScrollInfo GetTopWindow GetClassLongPtrW SetWindowLongPtrW GetWindowLongPtrW SetWindowLongW EqualRect AdjustWindowRectEx GetWindowTextLengthW GetWindowTextW RemovePropW GetPropW SetPropW ShowScrollBar GetScrollRange SetScrollRange GetScrollPos SetScrollPos ScrollWindow SetForegroundWindow GetForegroundWindow TrackPopupMenu SetMenu GetMenu GetCapture SetFocus GetDlgCtrlID EndDeferWindowPos IntersectRect BeginDeferWindowPos SetWindowPlacement GetWindowPlacement IsChild IsMenu CreateWindowExW GetClassInfoExW RegisterClassW CallWindowProcW GetMessageTime GetMessagePos CharUpperW GetClassNameW InvalidateRect UpdateWindow GetDoubleClickTime GetIconInfo CopyIcon UnregisterClassW LoadIconW SendMessageW LoadBitmapW IsIconic SetCursor GetMenuItemInfoW ValidateRect GetKeyState PeekMessageW DispatchMessageW MonitorFromPoint GetMessageW SetMenuItemInfoW GetMenuCheckMarkDimensions SetMenuItemBitmaps EnableMenuItem CheckMenuItem CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW PtInRect GetCursorPos ScreenToClient ClientToScreen TrackMouseEvent IsZoomed GetAsyncKeyState LoadMenuW GetSystemMenu NotifyWinEvent SetCursorPos EnableScrollBar UnionRect BringWindowToTop CreatePopupMenu LockWindowUpdate DestroyMenu GetNextDlgGroupItem EndPaint BeginPaint MessageBeep OpenClipboard CloseClipboard SetClipboardData EmptyClipboard DestroyIcon LoadImageW DeferWindowPos SetParent GetSystemMetrics GetClientRect DrawIcon EnableWindow GetMenuStringW GetMenuState GetSubMenu GetMenuItemID GetMenuItemCount InsertMenuW AppendMenuW RemoveMenu PostMessageW PostQuitMessage SetWindowPos SetWindowContextHelpId GetParent GetWindow MapDialogRect RegisterWindowMessageW DestroyCursor DrawEdge DrawFrameControl IsWindowVisible GetFocus DrawStateW SetWindowRgn RedrawWindow GetWindowRect MapWindowPoints GetSysColor GetSysColorBrush DrawFocusRect FillRect InflateRect OffsetRect IsRectEmpty DrawIconEx IsWindow DestroyWindow CreateDialogIndirectParamW EndDialog GetDlgItem GetNextDlgTabItem GetActiveWindow IsWindowEnabled SetActiveWindow GetWindowLongW GetDesktopWindow DefWindowProcW GetClassInfoW SetLayeredWindowAttributes SetRectEmpty CopyRect LoadCursorW SystemParametersInfoW GetMonitorInfoW EnumDisplayMonitors MessageBoxW GetWindowThreadProcessId GetLastActivePopup DrawTextW DrawTextExW GrayStringW TabbedTextOutW GetDC GetMenuDefaultItem SetMenuDefaultItem ModifyMenuW DestroyAcceleratorTable GetWindowDC ReleaseDC TranslateMessage SetClassLongPtrW GetUpdateRect SendDlgItemMessageA ToUnicodeEx GetKeyboardLayout GetKeyboardState MapVirtualKeyW LoadAcceleratorsW CreateAcceleratorTableW UpdateLayeredWindow TranslateAcceleratorW InsertMenuItemW UnpackDDElParam ReuseDDElParam RegisterClipboardFormatW GetKeyNameTextW SubtractRect CharUpperBuffW FrameRect IsClipboardFormatAvailable PostThreadMessageW IsCharLowerW MapVirtualKeyExW DrawMenuBar DefFrameProcW DefMDIChildProcW TranslateMDISysAccel GetComboBoxInfo CreateMenu InvertRect HideCaret GetWindowRgn ShowOwnedPopups

gdi32

BitBlt CreateCompatibleBitmap CreateDIBitmap CreateFontIndirectW CreatePen CreatePatternBrush DeleteObject EnumFontFamiliesW GetStockObject GetTextCharsetInfo CreateBitmap Escape ExcludeClipRect GetClipBox GetObjectType GetViewportExtEx GetWindowExtEx IntersectClipRect LineTo PtVisible RectVisible RestoreDC SaveDC SelectClipRgn ExtSelectClipRgn SelectObject SelectPalette SetBkColor SetBkMode SetMapMode SetLayout GetLayout SetPolyFillMode SetROP2 SetTextColor SetTextAlign MoveToEx GetTextMetricsW SetViewportExtEx SetViewportOrgEx SetWindowExtEx SetWindowOrgEx OffsetViewportOrgEx OffsetWindowOrgEx ScaleViewportExtEx ScaleWindowExtEx GetRgnBox GetMapMode SetRectRgn DPtoLP RealizePalette SetPixel StretchBlt CreateDIBSection SetDIBColorTable CreateRoundRectRgn Rectangle OffsetRgn RoundRect CreatePalette GetPaletteEntries GetNearestPaletteIndex GetSystemPaletteEntries EnumFontFamiliesExW ExtFloodFill SetPaletteEntries FillRgn FrameRgn GetBoundsRect PtInRegion GetViewportOrgEx LPtoDP GetWindowOrgEx SetPixelV GetTextFaceW Polyline CreatePolygonRgn ExtTextOutW PatBlt GetTextExtentPoint32W GetTextColor GetBkColor Ellipse CreateSolidBrush CreateRectRgnIndirect CreateRectRgn CreateHatchBrush CreateEllipticRgn CombineRgn GetDeviceCaps CreateDCW CopyMetaFileW GetPixel CreateCompatibleDC GetObjectW TextOutW Polygon DeleteDC

msimg32

AlphaBlend TransparentBlt

winspool.drv

ClosePrinter OpenPrinterW DocumentPropertiesW

advapi32

RegDeleteKeyW CreateServiceW RegEnumKeyExW RegEnumValueW RegQueryValueW RegEnumKeyW RegSetValueExW RegDeleteValueW OpenSCManagerW RegCreateKeyExW RegQueryValueExW RegOpenKeyExW RegCloseKey StartServiceW CloseServiceHandle

shell32

ShellExecuteW DragFinish DragQueryFileW SHGetFileInfoW SHGetDesktopFolder SHBrowseForFolderW SHGetSpecialFolderLocation SHGetPathFromIDListW SHGetMalloc SHAppBarMessage

comctl32

InitCommonControlsEx

shlwapi

StrFormatKBSizeW PathStripToRootW PathIsUNCW PathFindFileNameW PathFindExtensionW PathCombineW PathRemoveFileSpecW

uxtheme

GetThemeSysColor OpenThemeData CloseThemeData DrawThemeBackground GetThemeColor GetCurrentThemeName DrawThemeParentBackground IsAppThemed DrawThemeText GetWindowTheme GetThemePartSize IsThemeBackgroundPartiallyTransparent

ole32

CoRegisterMessageFilter CoRevokeClassObject CoInitializeEx IsAccelerator OleTranslateAccelerator OleCreateMenuDescriptor OleLockRunning RevokeDragDrop RegisterDragDrop CoLockObjectExternal OleGetClipboard DoDragDrop OleIsCurrentClipboard OleFlushClipboard OleUninitialize OleInitialize CoFreeUnusedLibraries CreateStreamOnHGlobal CreateILockBytesOnHGlobal StgOpenStorageOnILockBytes StgCreateDocfileOnILockBytes CoGetClassObject CoDisconnectObject CLSIDFromProgID CLSIDFromString ReleaseStgMedium OleDuplicateData CoTaskMemAlloc CoUninitialize CoCreateInstance CoInitialize CoTaskMemFree StringFromCLSID CoCreateGuid OleDestroyMenuDescriptor

oleaut32

SafeArrayDestroy VariantTimeToSystemTime SystemTimeToVariantTime OleCreateFontIndirect LoadTypeLi VariantChangeType SysStringLen SysAllocStringLen SysFreeString VariantInit VariantClear SysAllocString VariantCopy VarBstrFromDate

oledlg

OleUIBusyW

gdiplus

GdiplusShutdown GdipAlloc GdipFree GdiplusStartup GdipCloneImage GdipDisposeImage GdipGetImageGraphicsContext GdipGetImageWidth GdipGetImageHeight GdipGetImagePixelFormat GdipGetImagePalette GdipGetImagePaletteSize GdipCreateBitmapFromStream GdipCreateBitmapFromScan0 GdipBitmapLockBits GdipBitmapUnlockBits GdipDeleteGraphics GdipDrawImageI GdipCreateBitmapFromHBITMAP GdipCreateFromHDC GdipSetInterpolationMode GdipDrawImageRectI

oleacc

AccessibleObjectFromWindow LresultFromObject CreateStdAccessibleObject

imm32

ImmReleaseContext ImmGetOpenStatus ImmGetContext

winmm

PlaySoundW

Name

.text

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

554KB

Virtual Size

554KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

31KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

86KB

Virtual Size

85KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

10.9MB

Virtual Size

10.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

60KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

ProctorU.1.32.win.06V2.exe.bin

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

uxtheme

ole32

oleaut32

oledlg

gdiplus

oleacc

imm32

winmm

generic