Analysis

  • max time kernel
    107s
  • max time network
    118s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    09-01-2021 08:28

General

  • Target

    Pliytbob.bin.exe

  • Size

    763KB

  • MD5

    c6deefce6d5efb810c81e7a0c5bc6b1f

  • SHA1

    88c68b80aa3733b6c3ced2c6b78345d823691b73

  • SHA256

    0aab2dd3ec0c4ee98be1c56356c21888078d33ab2b44410e0024034284a4fb86

  • SHA512

    8b5962b3183ba564d30dacc8ddd358306263608232d7f6d414e346cc09d2978ab250f87a2ef252f9fcfe53291e92b7e524f0b6f99ad73e7d80f9b671e4d86076

Malware Config

Signatures

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT Payload 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Pliytbob.bin.exe
    "C:\Users\Admin\AppData\Local\Temp\Pliytbob.bin.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:416
    • C:\Users\Admin\AppData\Local\Temp\Pliytbob.bin.exe
      "C:\Users\Admin\AppData\Local\Temp\Pliytbob.bin.exe"
      2⤵
        PID:2612
      • C:\Users\Admin\AppData\Local\Temp\Pliytbob.bin.exe
        "C:\Users\Admin\AppData\Local\Temp\Pliytbob.bin.exe"
        2⤵
          PID:2260
        • C:\Users\Admin\AppData\Local\Temp\Pliytbob.bin.exe
          "C:\Users\Admin\AppData\Local\Temp\Pliytbob.bin.exe"
          2⤵
            PID:2024

        Network

        MITRE ATT&CK Matrix ATT&CK v6

        Persistence

        Registry Run Keys / Startup Folder

        1
        T1060

        Defense Evasion

        Modify Registry

        1
        T1112

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Pliytbob.bin.exe.log
          MD5

          d96cb6a55eb71b30f2e8a725ef5e6e5d

          SHA1

          f0bef03d7f37dfee965c6dfe4f6f447e3ab34be0

          SHA256

          253f84939770e1b5663cecd7df61bb04c1668c1a5f90a6dd2b95ea6830f8977b

          SHA512

          e65e8ee91233d4179beff6d381c07a600a0905710feaa063d9880c48646bd296137efdf628caecb8ccecec20162c2c952e9713d1d629788a37f1afba09bf4b77

        • memory/416-2-0x0000000073520000-0x0000000073C0E000-memory.dmp
          Filesize

          6.9MB

        • memory/416-3-0x0000000000630000-0x0000000000631000-memory.dmp
          Filesize

          4KB

        • memory/416-5-0x00000000055E0000-0x00000000055E1000-memory.dmp
          Filesize

          4KB

        • memory/416-6-0x0000000005120000-0x0000000005164000-memory.dmp
          Filesize

          272KB

        • memory/416-7-0x0000000005190000-0x00000000051A6000-memory.dmp
          Filesize

          88KB

        • memory/2024-8-0x0000000000400000-0x000000000041A000-memory.dmp
          Filesize

          104KB

        • memory/2024-9-0x00000000004156EE-mapping.dmp
        • memory/2024-11-0x0000000073520000-0x0000000073C0E000-memory.dmp
          Filesize

          6.9MB

        • memory/2024-15-0x0000000005330000-0x0000000005331000-memory.dmp
          Filesize

          4KB