sectoprat | 0aab2dd3ec0c4ee98be1c56356c21888078d33ab2b44410e0024034284a4fb86

General

Target

Pliytbob.bin.exe
Size

763KB
MD5

c6deefce6d5efb810c81e7a0c5bc6b1f
SHA1

88c68b80aa3733b6c3ced2c6b78345d823691b73
SHA256

0aab2dd3ec0c4ee98be1c56356c21888078d33ab2b44410e0024034284a4fb86
SHA512

8b5962b3183ba564d30dacc8ddd358306263608232d7f6d414e346cc09d2978ab250f87a2ef252f9fcfe53291e92b7e524f0b6f99ad73e7d80f9b671e4d86076

Score

10^/10

sectoprat persistence rat trojan

Malware Config

Signatures

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2024-8-0x0000000000400000-0x000000000041A000-memory.dmp	family_sectoprat
behavioral2/memory/2024-9-0x00000000004156EE-mapping.dmp	family_sectoprat

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Pliytbob.bin.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\gimp = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Gimp\\gimp.exe\""	Pliytbob.bin.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Pliytbob.bin.exe

description pid process target process

PID 416 set thread context of 2024 416 Pliytbob.bin.exe Pliytbob.bin.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

Pliytbob.bin.exe

pid process

416 Pliytbob.bin.exe
416 Pliytbob.bin.exe
416 Pliytbob.bin.exe
416 Pliytbob.bin.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Pliytbob.bin.exe

description pid process

Token: SeDebugPrivilege 416 Pliytbob.bin.exe

description	pid	process	target process
PID 416 set thread context of 2024	416	Pliytbob.bin.exe	Pliytbob.bin.exe

pid	process
416	Pliytbob.bin.exe
416	Pliytbob.bin.exe
416	Pliytbob.bin.exe
416	Pliytbob.bin.exe

description	pid	process
Token: SeDebugPrivilege	416	Pliytbob.bin.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

Pliytbob.bin.exe

description	pid	process	target process
PID 416 wrote to memory of 2612	416	Pliytbob.bin.exe	Pliytbob.bin.exe
PID 416 wrote to memory of 2612	416	Pliytbob.bin.exe	Pliytbob.bin.exe
PID 416 wrote to memory of 2612	416	Pliytbob.bin.exe	Pliytbob.bin.exe
PID 416 wrote to memory of 2260	416	Pliytbob.bin.exe	Pliytbob.bin.exe
PID 416 wrote to memory of 2260	416	Pliytbob.bin.exe	Pliytbob.bin.exe
PID 416 wrote to memory of 2260	416	Pliytbob.bin.exe	Pliytbob.bin.exe
PID 416 wrote to memory of 2024	416	Pliytbob.bin.exe	Pliytbob.bin.exe
PID 416 wrote to memory of 2024	416	Pliytbob.bin.exe	Pliytbob.bin.exe
PID 416 wrote to memory of 2024	416	Pliytbob.bin.exe	Pliytbob.bin.exe
PID 416 wrote to memory of 2024	416	Pliytbob.bin.exe	Pliytbob.bin.exe
PID 416 wrote to memory of 2024	416	Pliytbob.bin.exe	Pliytbob.bin.exe
PID 416 wrote to memory of 2024	416	Pliytbob.bin.exe	Pliytbob.bin.exe
PID 416 wrote to memory of 2024	416	Pliytbob.bin.exe	Pliytbob.bin.exe
PID 416 wrote to memory of 2024	416	Pliytbob.bin.exe	Pliytbob.bin.exe

C:\Users\Admin\AppData\Local\Temp\Pliytbob.bin.exe
"C:\Users\Admin\AppData\Local\Temp\Pliytbob.bin.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:416
- C:\Users\Admin\AppData\Local\Temp\Pliytbob.bin.exe
  "C:\Users\Admin\AppData\Local\Temp\Pliytbob.bin.exe"
  2⤵
  PID:2612
- C:\Users\Admin\AppData\Local\Temp\Pliytbob.bin.exe
  "C:\Users\Admin\AppData\Local\Temp\Pliytbob.bin.exe"
  2⤵
  PID:2260
- C:\Users\Admin\AppData\Local\Temp\Pliytbob.bin.exe
  "C:\Users\Admin\AppData\Local\Temp\Pliytbob.bin.exe"
  2⤵
  PID:2024

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Pliytbob.bin.exe.log

MD5
d96cb6a55eb71b30f2e8a725ef5e6e5d

SHA1
f0bef03d7f37dfee965c6dfe4f6f447e3ab34be0

SHA256
253f84939770e1b5663cecd7df61bb04c1668c1a5f90a6dd2b95ea6830f8977b

SHA512
e65e8ee91233d4179beff6d381c07a600a0905710feaa063d9880c48646bd296137efdf628caecb8ccecec20162c2c952e9713d1d629788a37f1afba09bf4b77

Download Submit
memory/416-2-0x0000000073520000-0x0000000073C0E000-memory.dmp

Filesize
6.9MB

Download
memory/416-3-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/416-5-0x00000000055E0000-0x00000000055E1000-memory.dmp

Filesize
4KB

Download
memory/416-6-0x0000000005120000-0x0000000005164000-memory.dmp

Filesize
272KB

Download
memory/416-7-0x0000000005190000-0x00000000051A6000-memory.dmp

Filesize
88KB

Download
memory/2024-8-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2024-9-0x00000000004156EE-mapping.dmp

Download
memory/2024-11-0x0000000073520000-0x0000000073C0E000-memory.dmp

Filesize
6.9MB

Download
memory/2024-15-0x0000000005330000-0x0000000005331000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads