sectoprat | 0aab2dd3ec0c4ee98be1c56356c21888078d33ab2b44410e0024034284a4fb86

General

Target

Pliytbob.bin.exe
Size

763KB
MD5

c6deefce6d5efb810c81e7a0c5bc6b1f
SHA1

88c68b80aa3733b6c3ced2c6b78345d823691b73
SHA256

0aab2dd3ec0c4ee98be1c56356c21888078d33ab2b44410e0024034284a4fb86
SHA512

8b5962b3183ba564d30dacc8ddd358306263608232d7f6d414e346cc09d2978ab250f87a2ef252f9fcfe53291e92b7e524f0b6f99ad73e7d80f9b671e4d86076

Score

10^/10

sectoprat persistence rat trojan

Malware Config

Signatures

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT Payload 2 IoCs

resource	yara_rule
behavioral2/memory/2024-8-0x0000000000400000-0x000000000041A000-memory.dmp	family_sectoprat
behavioral2/memory/2024-9-0x00000000004156EE-mapping.dmp	family_sectoprat

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\gimp = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Gimp\\gimp.exe\""	Pliytbob.bin.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 416 set thread context of 2024	416	Pliytbob.bin.exe	80

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
416	Pliytbob.bin.exe
416	Pliytbob.bin.exe
416	Pliytbob.bin.exe
416	Pliytbob.bin.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	416	Pliytbob.bin.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 416 wrote to memory of 2612	416	Pliytbob.bin.exe	78
PID 416 wrote to memory of 2612	416	Pliytbob.bin.exe	78
PID 416 wrote to memory of 2612	416	Pliytbob.bin.exe	78
PID 416 wrote to memory of 2260	416	Pliytbob.bin.exe	79
PID 416 wrote to memory of 2260	416	Pliytbob.bin.exe	79
PID 416 wrote to memory of 2260	416	Pliytbob.bin.exe	79
PID 416 wrote to memory of 2024	416	Pliytbob.bin.exe	80
PID 416 wrote to memory of 2024	416	Pliytbob.bin.exe	80
PID 416 wrote to memory of 2024	416	Pliytbob.bin.exe	80
PID 416 wrote to memory of 2024	416	Pliytbob.bin.exe	80
PID 416 wrote to memory of 2024	416	Pliytbob.bin.exe	80
PID 416 wrote to memory of 2024	416	Pliytbob.bin.exe	80
PID 416 wrote to memory of 2024	416	Pliytbob.bin.exe	80
PID 416 wrote to memory of 2024	416	Pliytbob.bin.exe	80

C:\Users\Admin\AppData\Local\Temp\Pliytbob.bin.exe
"C:\Users\Admin\AppData\Local\Temp\Pliytbob.bin.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:416
- C:\Users\Admin\AppData\Local\Temp\Pliytbob.bin.exe
  "C:\Users\Admin\AppData\Local\Temp\Pliytbob.bin.exe"
  2⤵
  PID:2612
- C:\Users\Admin\AppData\Local\Temp\Pliytbob.bin.exe
  "C:\Users\Admin\AppData\Local\Temp\Pliytbob.bin.exe"
  2⤵
  PID:2260
- C:\Users\Admin\AppData\Local\Temp\Pliytbob.bin.exe
  "C:\Users\Admin\AppData\Local\Temp\Pliytbob.bin.exe"
  2⤵
  PID:2024

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/416-2-0x0000000073520000-0x0000000073C0E000-memory.dmp

Filesize
6.9MB

Download
memory/416-3-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/416-5-0x00000000055E0000-0x00000000055E1000-memory.dmp

Filesize
4KB

Download
memory/416-6-0x0000000005120000-0x0000000005164000-memory.dmp

Filesize
272KB

Download
memory/416-7-0x0000000005190000-0x00000000051A6000-memory.dmp

Filesize
88KB

Download
memory/2024-8-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2024-11-0x0000000073520000-0x0000000073C0E000-memory.dmp

Filesize
6.9MB

Download
memory/2024-15-0x0000000005330000-0x0000000005331000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing