Analysis
-
max time kernel
95s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
27-06-2022 08:53
General
-
Target
78ea47b51ee8f1ae3dc5b98e56c43d3f.exe
-
Size
1.0MB
-
MD5
78ea47b51ee8f1ae3dc5b98e56c43d3f
-
SHA1
99e64c6a730642430ef80215393adbfba11122b6
-
SHA256
24972cecda20154015c31f4a8820764cbfa958d2968ab2b4a7c9e3e43510b888
-
SHA512
7a773021c6c02e5905ff1e3e99b3fb6cbfd5b6617ff831aea5b4cdf416e3d044e55895a5bf1e6fe5da3e3d6272fa82f7b88aaf592d6d61d94477e927a65fb19b
Score
10/10
Malware Config
Signatures
-
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
-
SectopRAT Payload 6 IoCs
-
UAC bypass 3 TTPs 1 IoCs
-
suricata: ET MALWARE Arechclient2 Backdoor CnC Init
suricata: ET MALWARE Arechclient2 Backdoor CnC Init
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\78ea47b51ee8f1ae3dc5b98e56c43d3f.exe"C:\Users\Admin\AppData\Local\Temp\78ea47b51ee8f1ae3dc5b98e56c43d3f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"2⤵
- UAC bypass
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
648KB
-
Filesize
648KB
-
Filesize
648KB
-
Filesize
648KB
-
Filesize
648KB
-
-
Filesize
648KB
-
Filesize
648KB
-
Filesize
1.0MB
-
Filesize
208KB
-
Filesize
104KB
-
Filesize
24KB
-
Filesize
8KB