sectoprat | 420dfb75c981fe4ab474de914e92c8171f52544d1f3a4d66bf9249e8578d729d

Analysis

max time kernel
137s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/02/2023, 19:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

62ee5b95c34acf1b01e338ad370c4dda687bdd67.exe
Size

248KB
MD5

4ca04b351bb18652fcda67b45eed03a9
SHA1

62ee5b95c34acf1b01e338ad370c4dda687bdd67
SHA256

420dfb75c981fe4ab474de914e92c8171f52544d1f3a4d66bf9249e8578d729d
SHA512

d462553e89b0adda35854157bdbb668dc6ac7e415f5dcf37cf65aecd19ff1d93f0aa18e8831f59be5982c21d71715dfa227958696b81d71a9cde8ec9bc79c7b6
SSDEEP

6144:m8OyFY+X5tuRG9YodJ8mQccZowlFfo7qa4D64+94QIKgFLKyEs2UfaoksNzB1jpU:TFY+X5tuRG9YodJ8mQccZowlFfo7qa4U

Score

10^/10

sectoprat persistence rat trojan

Malware Config

Signatures

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/3012-167-0x0000000000940000-0x00000000009E6000-memory.dmp	family_sectoprat

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3792 created 2704	3792	Milf.exe.pif	50

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	62ee5b95c34acf1b01e338ad370c4dda687bdd67.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YHgsKCxQSK.url	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YHgsKCxQSK.url	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
1556	tmp2A2D.tmp.exe
3792	Milf.exe.pif

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	tmp2A2D.tmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	tmp2A2D.tmp.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3792 set thread context of 3012	3792	Milf.exe.pif	103

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3832	PING.EXE

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
4888	powershell.exe
4888	powershell.exe
4888	powershell.exe
2752	powershell.exe
2752	powershell.exe
2752	powershell.exe
3792	Milf.exe.pif
3792	Milf.exe.pif
3792	Milf.exe.pif
3792	Milf.exe.pif
3792	Milf.exe.pif
3792	Milf.exe.pif
3792	Milf.exe.pif
3792	Milf.exe.pif
3792	Milf.exe.pif
3792	Milf.exe.pif
3792	Milf.exe.pif
3792	Milf.exe.pif
3792	Milf.exe.pif
3792	Milf.exe.pif
3792	Milf.exe.pif
3792	Milf.exe.pif

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2284	62ee5b95c34acf1b01e338ad370c4dda687bdd67.exe
Token: SeDebugPrivilege	4888	powershell.exe
Token: SeDebugPrivilege	2752	powershell.exe
Token: SeDebugPrivilege	3012	jsc.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3792	Milf.exe.pif
3792	Milf.exe.pif
3792	Milf.exe.pif

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3792	Milf.exe.pif
3792	Milf.exe.pif
3792	Milf.exe.pif

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 2284 wrote to memory of 1556	2284	62ee5b95c34acf1b01e338ad370c4dda687bdd67.exe	81
PID 2284 wrote to memory of 1556	2284	62ee5b95c34acf1b01e338ad370c4dda687bdd67.exe	81
PID 2284 wrote to memory of 1556	2284	62ee5b95c34acf1b01e338ad370c4dda687bdd67.exe	81
PID 1556 wrote to memory of 640	1556	tmp2A2D.tmp.exe	82
PID 1556 wrote to memory of 640	1556	tmp2A2D.tmp.exe	82
PID 1556 wrote to memory of 640	1556	tmp2A2D.tmp.exe	82
PID 1556 wrote to memory of 1992	1556	tmp2A2D.tmp.exe	84
PID 1556 wrote to memory of 1992	1556	tmp2A2D.tmp.exe	84
PID 1556 wrote to memory of 1992	1556	tmp2A2D.tmp.exe	84
PID 1992 wrote to memory of 2236	1992	cmd.exe	86
PID 1992 wrote to memory of 2236	1992	cmd.exe	86
PID 1992 wrote to memory of 2236	1992	cmd.exe	86
PID 2236 wrote to memory of 4888	2236	cmd.exe	91
PID 2236 wrote to memory of 4888	2236	cmd.exe	91
PID 2236 wrote to memory of 4888	2236	cmd.exe	91
PID 2236 wrote to memory of 2752	2236	cmd.exe	96
PID 2236 wrote to memory of 2752	2236	cmd.exe	96
PID 2236 wrote to memory of 2752	2236	cmd.exe	96
PID 2236 wrote to memory of 4144	2236	cmd.exe	97
PID 2236 wrote to memory of 4144	2236	cmd.exe	97
PID 2236 wrote to memory of 4144	2236	cmd.exe	97
PID 2236 wrote to memory of 2528	2236	cmd.exe	98
PID 2236 wrote to memory of 2528	2236	cmd.exe	98
PID 2236 wrote to memory of 2528	2236	cmd.exe	98
PID 2236 wrote to memory of 3792	2236	cmd.exe	99
PID 2236 wrote to memory of 3792	2236	cmd.exe	99
PID 2236 wrote to memory of 3792	2236	cmd.exe	99
PID 2236 wrote to memory of 3832	2236	cmd.exe	100
PID 2236 wrote to memory of 3832	2236	cmd.exe	100
PID 2236 wrote to memory of 3832	2236	cmd.exe	100
PID 3792 wrote to memory of 4012	3792	Milf.exe.pif	101
PID 3792 wrote to memory of 4012	3792	Milf.exe.pif	101
PID 3792 wrote to memory of 4012	3792	Milf.exe.pif	101
PID 3792 wrote to memory of 3012	3792	Milf.exe.pif	103
PID 3792 wrote to memory of 3012	3792	Milf.exe.pif	103
PID 3792 wrote to memory of 3012	3792	Milf.exe.pif	103
PID 3792 wrote to memory of 3012	3792	Milf.exe.pif	103
PID 3792 wrote to memory of 3012	3792	Milf.exe.pif	103

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2704
- C:\Users\Admin\AppData\Local\Temp\62ee5b95c34acf1b01e338ad370c4dda687bdd67.exe
  "C:\Users\Admin\AppData\Local\Temp\62ee5b95c34acf1b01e338ad370c4dda687bdd67.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2284
- - C:\Users\Admin\AppData\Local\Temp\tmp2A2D.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp2A2D.tmp.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1556
  - - C:\Windows\SysWOW64\nslookup.exe
      nslookup ashfdjkhgwiueghfruihwjkefwe
      4⤵
      PID:640
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c cmd < 2
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1992
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2236
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell get-process avastui
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4888
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell get-process avgui
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2752
      - C:\Windows\SysWOW64\certutil.exe
        
        certutil -decode 86 86YEO
        6⤵
        
        PID:4144
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /R "^QyLLuVpnCdInRQPNWfBIsgQkprGKGWkWrUJtiyFXmiJDkGqaSrgKXZxBgABegmSFyMxWuKGRJDopFhZDrhRDHAYtAoQHDCIZfrnmkrkibbwxQlV$" 86YEO
        6⤵
        
        PID:2528
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\25031\Milf.exe.pif
        
        25031\\Milf.exe.pif 25031\\d
        6⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:3792
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3012
      - C:\Windows\SysWOW64\PING.EXE
        
        ping localhost -n 8
        6⤵
        Runs ping.exe
        
        PID:3832
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YHgsKCxQSK.url" & echo URL="C:\Users\Admin\AppData\Local\MYSMWZEvHY\VPbsOvHZF.vbs" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YHgsKCxQSK.url"
  2⤵
  - Drops startup file
  PID:4012

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
1KB

MD5
5315900105942deb090a358a315b06fe

SHA1
22fe5d2e1617c31afbafb91c117508d41ef0ce44

SHA256
e8bd7d8d1d0437c71aceb032f9fb08dd1147f41c048540254971cc60e95d6cd7

SHA512
77e8d15b8c34a1cb01dbee7147987e2cc25c747e0f80d254714a93937a6d2fe08cb5a772cf85ceb8fec56415bfa853234a003173718c4229ba8cfcf2ce6335a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
ee37fb8d038c2393df7f679fd7551a34

SHA1
e7276628edd2b288197c71d0dcb939dadeed1220

SHA256
054b5969c4eec2e27bd299c6ee03eb8eb4934162dbf545b5fc6302745abfa409

SHA512
357532ec988787bb1d7cfef3dc5f4187555aee3f46d27b069117a5c00b967778f440e6e68ef1550a3e649e0fab100b9c04b5dd74db7e1a0ddb2c0807431d2b8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2

Filesize
11KB

MD5
cf13b620804b451200c2fc35d0955c1e

SHA1
0b9034ce408d6bdfc2d12a5f957361df1494b564

SHA256
968a4e2af5aa8c0ab95e65c08eb5a5ea03d921c9220def24675a676ff3f9fe76

SHA512
a4c73efd6ff723b9067c95258f02ee0570cf076a1d992456bfdccdd064e1771dde530d0dd046d2dad6185cb08eb4d641484f75b94b04f0dfd384bdd60fd22f26

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\25031\Milf.exe.pif

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\25031\Milf.exe.pif

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6

Filesize
1.9MB

MD5
fa191eedf1fd23465aea012c60dd159f

SHA1
230d11121b16f1d38f31a2867c214bef83da6f22

SHA256
94e500c66add5eb1ee91b8de448668a7c7d26021104c9bec2c156c8dbbc9a440

SHA512
bee65d47a8ee4311d016dd85e3fc45d28d4133da18a15430388067b4457e542b3790344e7b9e38672c191832b56550ec0e676b5e047f8ff9ac1b9e0f339d342d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\86

Filesize
1.2MB

MD5
3c775f771bf21af3a95b519b87d3a055

SHA1
796a926397a7024348db5c8790acfb69cca68227

SHA256
66404d8f396ba4198e14b73cea09b36567d55d93c683965e13e2f9765f0f1b6c

SHA512
20a2ff99e8c676a3c3ec9fdfb26a000fda8aeb36373380f764e6fe8f428f7dce42cea9dd2b66fa9e0a84c01f13c224f53f147cc420d1de3d1fc0539a670ca253

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\86YEO

Filesize
872KB

MD5
0d398b7bfb54c5e22d8b42e8545837d7

SHA1
c065aed432508df9bacf121e7f0ed9bc0ebcce62

SHA256
a80a0a728e5451c54543c9527b12e0f8938e6fa72c3ef34ac6044fdec39d505e

SHA512
8a9038fb3f563abd69c628bcc32211550afde710be390131f5ac4fe8d59d58e9794d0562b60fe0e13fc1bc01d4c256867035d362f24bcd52b6834c874fefd4c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp2A2D.tmp.exe

Filesize
1.3MB

MD5
2d48214132e5c4d808740e71ec5f6a7f

SHA1
f3c7534d9f139782006b5656ec0d229d8d9d356e

SHA256
c1fadb8e09ba1257f7656be5a1c8d44e2a0da8697e8e0a32485714949a6c29ca

SHA512
71b38bc31ecd199d3408e831c0cda0b0fbce6b363d5da3500767ff2a9a02fc0b3990512085d8d44e25b50e87eceaf4527e58d9c3e0a0802efbc3164af94a77a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp2A2D.tmp.exe

Filesize
1.3MB

MD5
2d48214132e5c4d808740e71ec5f6a7f

SHA1
f3c7534d9f139782006b5656ec0d229d8d9d356e

SHA256
c1fadb8e09ba1257f7656be5a1c8d44e2a0da8697e8e0a32485714949a6c29ca

SHA512
71b38bc31ecd199d3408e831c0cda0b0fbce6b363d5da3500767ff2a9a02fc0b3990512085d8d44e25b50e87eceaf4527e58d9c3e0a0802efbc3164af94a77a2

Download Submit
memory/2284-135-0x0000000004C80000-0x0000000004C8A000-memory.dmp

Filesize
40KB

Download
memory/2284-134-0x0000000004CB0000-0x0000000004D42000-memory.dmp

Filesize
584KB

Download
memory/2284-133-0x0000000005360000-0x0000000005904000-memory.dmp

Filesize
5.6MB

Download
memory/2284-136-0x0000000008620000-0x0000000008686000-memory.dmp

Filesize
408KB

Download
memory/2284-132-0x00000000002B0000-0x00000000002EE000-memory.dmp

Filesize
248KB

Download
memory/3012-167-0x0000000000940000-0x00000000009E6000-memory.dmp

Filesize
664KB

Download
memory/4888-150-0x0000000007870000-0x0000000007906000-memory.dmp

Filesize
600KB

Download
memory/4888-151-0x0000000006C10000-0x0000000006C2A000-memory.dmp

Filesize
104KB

Download
memory/4888-145-0x0000000002E00000-0x0000000002E36000-memory.dmp

Filesize
216KB

Download
memory/4888-149-0x0000000006710000-0x000000000672E000-memory.dmp

Filesize
120KB

Download
memory/4888-147-0x0000000005F80000-0x0000000005FA2000-memory.dmp

Filesize
136KB

Download
memory/4888-146-0x00000000057E0000-0x0000000005E08000-memory.dmp

Filesize
6.2MB

Download
memory/4888-148-0x0000000006030000-0x0000000006096000-memory.dmp

Filesize
408KB

Download
memory/4888-152-0x0000000006C60000-0x0000000006C82000-memory.dmp

Filesize
136KB

Download