Overview

overview

10

Static

static

10

2954a2cdf8...f4.exe

windows7-x64

10

2954a2cdf8...f4.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    137s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    14/02/2023, 17:24

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2954a2cdf8601fd0d756fcd3309f611c5da075d4f0467e244bf31afa28ea96c5_03550000.bin_extracted_0x148f4.exe

  • Size

    592KB

  • MD5

    f68a8a259ffff1b6a81f42f69bdd55a4

  • SHA1

    d4c86f289789ea3b146d4fcce721a1958d7b5bad

  • SHA256

    e1e6a70cdb4e243eeca0f5f8954d275ab10b2b69c25e9e4bd2a98bc8b048ff29

  • SHA512

    fa852ccb321ae2e50e55b780e48c77d9d0e945cc72fe3deda4402ce48499f3ca56953795c4c84a17a114a6117d97bd5aaa6a9881aab7d51d294091a576e0c944

  • SSDEEP

    12288:JDG1WV0P9s/zp9WDQzdPe1QJmMLJYv5Wp5Hmr65KMB:JOWm2l9WDQzBe1cmoJYv5Wph0K

Score
10/10
sectopratrattrojan

Malware Config

Signatures

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat
  • SectopRAT payload 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2954a2cdf8601fd0d756fcd3309f611c5da075d4f0467e244bf31afa28ea96c5_03550000.bin_extracted_0x148f4.exe
    "C:\Users\Admin\AppData\Local\Temp\2954a2cdf8601fd0d756fcd3309f611c5da075d4f0467e244bf31afa28ea96c5_03550000.bin_extracted_0x148f4.exe"
    1⤵
      PID:1284

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1284-54-0x00000000003F0000-0x000000000048A000-memory.dmp

      Filesize

      616KB

      Download

    • memory/1284-55-0x00000000753F1000-0x00000000753F3000-memory.dmp

      Filesize

      8KB

      Download