sectoprat | 0aab2dd3ec0c4ee98be1c56356c21888078d33ab2b44410e0024034284a4fb86

General

Target

Pliytbob.bin.exe
Size

763KB
MD5

c6deefce6d5efb810c81e7a0c5bc6b1f
SHA1

88c68b80aa3733b6c3ced2c6b78345d823691b73
SHA256

0aab2dd3ec0c4ee98be1c56356c21888078d33ab2b44410e0024034284a4fb86
SHA512

8b5962b3183ba564d30dacc8ddd358306263608232d7f6d414e346cc09d2978ab250f87a2ef252f9fcfe53291e92b7e524f0b6f99ad73e7d80f9b671e4d86076

Score

10^/10

sectoprat persistence rat trojan

Malware Config

Signatures

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT Payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1384-8-0x00000000004156EE-mapping.dmp	family_sectoprat
behavioral1/memory/1384-7-0x0000000000400000-0x000000000041A000-memory.dmp	family_sectoprat
behavioral1/memory/1384-9-0x0000000000400000-0x000000000041A000-memory.dmp	family_sectoprat
behavioral1/memory/1384-10-0x0000000000400000-0x000000000041A000-memory.dmp	family_sectoprat

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Pliytbob.bin.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\gimp = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Gimp\\gimp.exe\""	Pliytbob.bin.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Pliytbob.bin.exe

description pid process target process

PID 932 set thread context of 1384 932 Pliytbob.bin.exe Pliytbob.bin.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Pliytbob.bin.exe

description pid process

Token: SeDebugPrivilege 932 Pliytbob.bin.exe

description	pid	process	target process
PID 932 set thread context of 1384	932	Pliytbob.bin.exe	Pliytbob.bin.exe

description	pid	process
Token: SeDebugPrivilege	932	Pliytbob.bin.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

Pliytbob.bin.exe

description	pid	process	target process
PID 932 wrote to memory of 1384	932	Pliytbob.bin.exe	Pliytbob.bin.exe
PID 932 wrote to memory of 1384	932	Pliytbob.bin.exe	Pliytbob.bin.exe
PID 932 wrote to memory of 1384	932	Pliytbob.bin.exe	Pliytbob.bin.exe
PID 932 wrote to memory of 1384	932	Pliytbob.bin.exe	Pliytbob.bin.exe
PID 932 wrote to memory of 1384	932	Pliytbob.bin.exe	Pliytbob.bin.exe
PID 932 wrote to memory of 1384	932	Pliytbob.bin.exe	Pliytbob.bin.exe
PID 932 wrote to memory of 1384	932	Pliytbob.bin.exe	Pliytbob.bin.exe
PID 932 wrote to memory of 1384	932	Pliytbob.bin.exe	Pliytbob.bin.exe
PID 932 wrote to memory of 1384	932	Pliytbob.bin.exe	Pliytbob.bin.exe

C:\Users\Admin\AppData\Local\Temp\Pliytbob.bin.exe
"C:\Users\Admin\AppData\Local\Temp\Pliytbob.bin.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:932

C:\Users\Admin\AppData\Local\Temp\Pliytbob.bin.exe
"C:\Users\Admin\AppData\Local\Temp\Pliytbob.bin.exe"
2⤵
PID:1384

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/932-2-0x0000000074120000-0x000000007480E000-memory.dmp

Filesize
6.9MB

Download
memory/932-3-0x0000000001170000-0x0000000001171000-memory.dmp

Filesize
4KB

Download
memory/932-5-0x0000000000730000-0x0000000000774000-memory.dmp

Filesize
272KB

Download
memory/932-6-0x00000000003E0000-0x00000000003F6000-memory.dmp

Filesize
88KB

Download
memory/1384-8-0x00000000004156EE-mapping.dmp

Download
memory/1384-7-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1384-9-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1384-10-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1384-11-0x00000000734A0000-0x0000000073B8E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads