sectoprat | 420dfb75c981fe4ab474de914e92c8171f52544d1f3a4d66bf9249e8578d729d

Analysis

max time kernel
137s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/02/2023, 18:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

62ee5b95c34acf1b01e338ad370c4dda687bdd67.exe
Size

248KB
MD5

4ca04b351bb18652fcda67b45eed03a9
SHA1

62ee5b95c34acf1b01e338ad370c4dda687bdd67
SHA256

420dfb75c981fe4ab474de914e92c8171f52544d1f3a4d66bf9249e8578d729d
SHA512

d462553e89b0adda35854157bdbb668dc6ac7e415f5dcf37cf65aecd19ff1d93f0aa18e8831f59be5982c21d71715dfa227958696b81d71a9cde8ec9bc79c7b6
SSDEEP

6144:m8OyFY+X5tuRG9YodJ8mQccZowlFfo7qa4D64+94QIKgFLKyEs2UfaoksNzB1jpU:TFY+X5tuRG9YodJ8mQccZowlFfo7qa4U

Score

10^/10

sectoprat persistence rat trojan

Malware Config

Signatures

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/3028-167-0x00000000005A0000-0x0000000000646000-memory.dmp	family_sectoprat

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 1912 created 2704	1912	Milf.exe.pif	38

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	62ee5b95c34acf1b01e338ad370c4dda687bdd67.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YHgsKCxQSK.url	cmd.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YHgsKCxQSK.url	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
312	tmp2990.tmp.exe
1912	Milf.exe.pif

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	tmp2990.tmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	tmp2990.tmp.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1912 set thread context of 3028	1912	Milf.exe.pif	104

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3792	PING.EXE

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
2212	powershell.exe
2212	powershell.exe
2212	powershell.exe
3912	powershell.exe
3912	powershell.exe
3912	powershell.exe
1912	Milf.exe.pif
1912	Milf.exe.pif
1912	Milf.exe.pif
1912	Milf.exe.pif
1912	Milf.exe.pif
1912	Milf.exe.pif
1912	Milf.exe.pif
1912	Milf.exe.pif
1912	Milf.exe.pif
1912	Milf.exe.pif
1912	Milf.exe.pif
1912	Milf.exe.pif
1912	Milf.exe.pif
1912	Milf.exe.pif
1912	Milf.exe.pif
1912	Milf.exe.pif

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4400	62ee5b95c34acf1b01e338ad370c4dda687bdd67.exe
Token: SeDebugPrivilege	2212	powershell.exe
Token: SeDebugPrivilege	3912	powershell.exe
Token: SeDebugPrivilege	3028	jsc.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1912	Milf.exe.pif
1912	Milf.exe.pif
1912	Milf.exe.pif

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1912	Milf.exe.pif
1912	Milf.exe.pif
1912	Milf.exe.pif

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 4400 wrote to memory of 312	4400	62ee5b95c34acf1b01e338ad370c4dda687bdd67.exe	82
PID 4400 wrote to memory of 312	4400	62ee5b95c34acf1b01e338ad370c4dda687bdd67.exe	82
PID 4400 wrote to memory of 312	4400	62ee5b95c34acf1b01e338ad370c4dda687bdd67.exe	82
PID 312 wrote to memory of 548	312	tmp2990.tmp.exe	83
PID 312 wrote to memory of 548	312	tmp2990.tmp.exe	83
PID 312 wrote to memory of 548	312	tmp2990.tmp.exe	83
PID 312 wrote to memory of 2456	312	tmp2990.tmp.exe	85
PID 312 wrote to memory of 2456	312	tmp2990.tmp.exe	85
PID 312 wrote to memory of 2456	312	tmp2990.tmp.exe	85
PID 2456 wrote to memory of 2156	2456	cmd.exe	87
PID 2456 wrote to memory of 2156	2456	cmd.exe	87
PID 2456 wrote to memory of 2156	2456	cmd.exe	87
PID 2156 wrote to memory of 2212	2156	cmd.exe	90
PID 2156 wrote to memory of 2212	2156	cmd.exe	90
PID 2156 wrote to memory of 2212	2156	cmd.exe	90
PID 2156 wrote to memory of 3912	2156	cmd.exe	96
PID 2156 wrote to memory of 3912	2156	cmd.exe	96
PID 2156 wrote to memory of 3912	2156	cmd.exe	96
PID 2156 wrote to memory of 4328	2156	cmd.exe	98
PID 2156 wrote to memory of 4328	2156	cmd.exe	98
PID 2156 wrote to memory of 4328	2156	cmd.exe	98
PID 2156 wrote to memory of 3544	2156	cmd.exe	99
PID 2156 wrote to memory of 3544	2156	cmd.exe	99
PID 2156 wrote to memory of 3544	2156	cmd.exe	99
PID 2156 wrote to memory of 1912	2156	cmd.exe	100
PID 2156 wrote to memory of 1912	2156	cmd.exe	100
PID 2156 wrote to memory of 1912	2156	cmd.exe	100
PID 2156 wrote to memory of 3792	2156	cmd.exe	101
PID 2156 wrote to memory of 3792	2156	cmd.exe	101
PID 2156 wrote to memory of 3792	2156	cmd.exe	101
PID 1912 wrote to memory of 1792	1912	Milf.exe.pif	102
PID 1912 wrote to memory of 1792	1912	Milf.exe.pif	102
PID 1912 wrote to memory of 1792	1912	Milf.exe.pif	102
PID 1912 wrote to memory of 3028	1912	Milf.exe.pif	104
PID 1912 wrote to memory of 3028	1912	Milf.exe.pif	104
PID 1912 wrote to memory of 3028	1912	Milf.exe.pif	104
PID 1912 wrote to memory of 3028	1912	Milf.exe.pif	104
PID 1912 wrote to memory of 3028	1912	Milf.exe.pif	104

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2704
- C:\Users\Admin\AppData\Local\Temp\62ee5b95c34acf1b01e338ad370c4dda687bdd67.exe
  "C:\Users\Admin\AppData\Local\Temp\62ee5b95c34acf1b01e338ad370c4dda687bdd67.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4400
- - C:\Users\Admin\AppData\Local\Temp\tmp2990.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp2990.tmp.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:312
  - - C:\Windows\SysWOW64\nslookup.exe
      nslookup ashfdjkhgwiueghfruihwjkefwe
      4⤵
      PID:548
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c cmd < 2
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2456
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2156
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell get-process avastui
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2212
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell get-process avgui
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3912
      - C:\Windows\SysWOW64\certutil.exe
        
        certutil -decode 86 86YEO
        6⤵
        
        PID:4328
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /R "^QyLLuVpnCdInRQPNWfBIsgQkprGKGWkWrUJtiyFXmiJDkGqaSrgKXZxBgABegmSFyMxWuKGRJDopFhZDrhRDHAYtAoQHDCIZfrnmkrkibbwxQlV$" 86YEO
        6⤵
        
        PID:3544
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\23575\Milf.exe.pif
        
        23575\\Milf.exe.pif 23575\\d
        6⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1912
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3028
      - C:\Windows\SysWOW64\PING.EXE
        
        ping localhost -n 8
        6⤵
        Runs ping.exe
        
        PID:3792
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YHgsKCxQSK.url" & echo URL="C:\Users\Admin\AppData\Local\MYSMWZEvHY\VPbsOvHZF.vbs" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YHgsKCxQSK.url"
  2⤵
  - Drops startup file
  PID:1792

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
1KB

MD5
def65711d78669d7f8e69313be4acf2e

SHA1
6522ebf1de09eeb981e270bd95114bc69a49cda6

SHA256
aa1c97cdbce9a848f1db2ad483f19caa535b55a3a1ef2ad1260e0437002bc82c

SHA512
05b2f9cd9bc3b46f52fded320b68e05f79b2b3ceaeb13e5d87ae9f8cd8e6c90bbb4ffa4da8192c2bfe0f58826cabff2e99e7c5cc8dd47037d4eb7bfc6f2710a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
c6226f38489ffaa97eedb252bae30776

SHA1
f062a6288e878c9f01ba7a761f08efd6fa00635c

SHA256
b0881942173c953174780b61ab98616ade90b2a607e4a7553122cd5704b1850c

SHA512
941d4090d8cb904b80421289ccad1b892048680f9d58268bea62d4a72cdd2e99f320aad68c17da568e07dbbc056ff2ef0a627445d706c335f8b1ebc0fac06e80

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2

Filesize
11KB

MD5
cf13b620804b451200c2fc35d0955c1e

SHA1
0b9034ce408d6bdfc2d12a5f957361df1494b564

SHA256
968a4e2af5aa8c0ab95e65c08eb5a5ea03d921c9220def24675a676ff3f9fe76

SHA512
a4c73efd6ff723b9067c95258f02ee0570cf076a1d992456bfdccdd064e1771dde530d0dd046d2dad6185cb08eb4d641484f75b94b04f0dfd384bdd60fd22f26

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\23575\Milf.exe.pif

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\23575\Milf.exe.pif

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6

Filesize
1.9MB

MD5
fa191eedf1fd23465aea012c60dd159f

SHA1
230d11121b16f1d38f31a2867c214bef83da6f22

SHA256
94e500c66add5eb1ee91b8de448668a7c7d26021104c9bec2c156c8dbbc9a440

SHA512
bee65d47a8ee4311d016dd85e3fc45d28d4133da18a15430388067b4457e542b3790344e7b9e38672c191832b56550ec0e676b5e047f8ff9ac1b9e0f339d342d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\86

Filesize
1.2MB

MD5
3c775f771bf21af3a95b519b87d3a055

SHA1
796a926397a7024348db5c8790acfb69cca68227

SHA256
66404d8f396ba4198e14b73cea09b36567d55d93c683965e13e2f9765f0f1b6c

SHA512
20a2ff99e8c676a3c3ec9fdfb26a000fda8aeb36373380f764e6fe8f428f7dce42cea9dd2b66fa9e0a84c01f13c224f53f147cc420d1de3d1fc0539a670ca253

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\86YEO

Filesize
872KB

MD5
0d398b7bfb54c5e22d8b42e8545837d7

SHA1
c065aed432508df9bacf121e7f0ed9bc0ebcce62

SHA256
a80a0a728e5451c54543c9527b12e0f8938e6fa72c3ef34ac6044fdec39d505e

SHA512
8a9038fb3f563abd69c628bcc32211550afde710be390131f5ac4fe8d59d58e9794d0562b60fe0e13fc1bc01d4c256867035d362f24bcd52b6834c874fefd4c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp2990.tmp.exe

Filesize
1.3MB

MD5
2d48214132e5c4d808740e71ec5f6a7f

SHA1
f3c7534d9f139782006b5656ec0d229d8d9d356e

SHA256
c1fadb8e09ba1257f7656be5a1c8d44e2a0da8697e8e0a32485714949a6c29ca

SHA512
71b38bc31ecd199d3408e831c0cda0b0fbce6b363d5da3500767ff2a9a02fc0b3990512085d8d44e25b50e87eceaf4527e58d9c3e0a0802efbc3164af94a77a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp2990.tmp.exe

Filesize
1.3MB

MD5
2d48214132e5c4d808740e71ec5f6a7f

SHA1
f3c7534d9f139782006b5656ec0d229d8d9d356e

SHA256
c1fadb8e09ba1257f7656be5a1c8d44e2a0da8697e8e0a32485714949a6c29ca

SHA512
71b38bc31ecd199d3408e831c0cda0b0fbce6b363d5da3500767ff2a9a02fc0b3990512085d8d44e25b50e87eceaf4527e58d9c3e0a0802efbc3164af94a77a2

Download Submit
memory/2212-150-0x00000000069F0000-0x0000000006A86000-memory.dmp

Filesize
600KB

Download
memory/2212-149-0x0000000006400000-0x000000000641E000-memory.dmp

Filesize
120KB

Download
memory/2212-151-0x00000000068F0000-0x000000000690A000-memory.dmp

Filesize
104KB

Download
memory/2212-152-0x0000000006940000-0x0000000006962000-memory.dmp

Filesize
136KB

Download
memory/2212-147-0x0000000005C70000-0x0000000005C92000-memory.dmp

Filesize
136KB

Download
memory/2212-146-0x00000000054A0000-0x0000000005AC8000-memory.dmp

Filesize
6.2MB

Download
memory/2212-148-0x0000000005D30000-0x0000000005D96000-memory.dmp

Filesize
408KB

Download
memory/2212-145-0x0000000004E30000-0x0000000004E66000-memory.dmp

Filesize
216KB

Download
memory/3028-167-0x00000000005A0000-0x0000000000646000-memory.dmp

Filesize
664KB

Download
memory/4400-136-0x0000000008410000-0x0000000008476000-memory.dmp

Filesize
408KB

Download
memory/4400-135-0x0000000004A80000-0x0000000004A8A000-memory.dmp

Filesize
40KB

Download
memory/4400-134-0x0000000004AB0000-0x0000000004B42000-memory.dmp

Filesize
584KB

Download
memory/4400-133-0x0000000005060000-0x0000000005604000-memory.dmp

Filesize
5.6MB

Download
memory/4400-132-0x00000000000A0000-0x00000000000DE000-memory.dmp

Filesize
248KB

Download