Overview

overview

10

Static

static

a57e1bcf95...bc.exe

windows7_x64

10

a57e1bcf95...bc.exe

windows10_x64

10

Analysis

  • max time kernel
    149s
  • max time network
    115s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    10-01-2021 14:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a57e1bcf9538738707f5f6387b72d7bc.exe

  • Size

    292KB

  • MD5

    a57e1bcf9538738707f5f6387b72d7bc

  • SHA1

    839e2f2929292b128f5c71765d15e0b67e19f922

  • SHA256

    bf802ba3e523c502a27e0c9044bc699f0db17ebb00e5b3b9c152038a13c856ed

  • SHA512

    a9a1e3c04f25280f5de47d7a8eebc684481d1b4e05e394127385d2534440f000630e34dd0a22b4ba0870f13abce578b2118fcaf9c41b9f617d920207395e21c8

Score
10/10
sectopratrattrojan

Malware Config

Signatures

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat
  • SectopRAT Payload 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of SetThreadContext 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a57e1bcf9538738707f5f6387b72d7bc.exe
    "C:\Users\Admin\AppData\Local\Temp\a57e1bcf9538738707f5f6387b72d7bc.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3984
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GEyVFfPqSbGetJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4404.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:3396
    • C:\Users\Admin\AppData\Local\Temp\a57e1bcf9538738707f5f6387b72d7bc.exe
      "{path}"
      2⤵
        PID:3416

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmp4404.tmp
      MD5

      ad26b46b60b19965999ee32dfe908f14

      SHA1

      fde36196cfda0595261a86669ef2b28b411a7771

      SHA256

      f66f1a115cec05b8c852e5c15667f53c1484f3f119a8e7af19678caa70866b4a

      SHA512

      0435740f2892e103e80993d584025d05f61aa1ee36ff8500a4f349e372b94879c871b4f255d353313b445397c9b632b31893ded2cb73547cea3c3a38e4d5dbfe

      Download Submit

    • memory/3396-7-0x0000000000000000-mapping.dmp

      Download

    • memory/3416-9-0x0000000000400000-0x000000000041E000-memory.dmp

      Filesize

      120KB

      Download

    • memory/3416-10-0x000000000041866A-mapping.dmp

      Download

    • memory/3416-11-0x0000000073920000-0x000000007400E000-memory.dmp

      Filesize

      6.9MB

      Download

    • memory/3416-14-0x0000000005840000-0x0000000005841000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3416-15-0x0000000005270000-0x0000000005271000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3416-16-0x0000000005340000-0x0000000005341000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3984-2-0x0000000073920000-0x000000007400E000-memory.dmp

      Filesize

      6.9MB

      Download

    • memory/3984-3-0x0000000000B90000-0x0000000000B91000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3984-5-0x0000000007940000-0x0000000007978000-memory.dmp

      Filesize

      224KB

      Download

    • memory/3984-6-0x0000000005860000-0x0000000005861000-memory.dmp

      Filesize

      4KB

      Download