Resubmissions

23-02-2023 14:03

230223-rcnzwsga69 10

20-01-2023 12:25

230120-plqhzaff6y 10

16-01-2023 12:00

230116-n6kyjsad9v 10

15-01-2023 04:12

230115-esqr7sdg4v 10

15-01-2023 04:01

230115-elc8jahg27 8

15-01-2023 03:56

230115-ehjk5shf75 8

15-01-2023 01:02

230115-bebjksbg8w 10

15-01-2023 00:38

230115-azcfyafg72 8

Analysis

  • max time kernel
    121s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-02-2023 14:03

General

  • Target

    88b426437c97301982bf096306af1bde70caa0a9a99a60514b31d0fa0ea64afd.exe

  • Size

    1.6MB

  • MD5

    9f7aaf3a9a3f325dd533ecc38d85a351

  • SHA1

    1ebdc55b96e11d9b924fbba8c5fa1799ff247970

  • SHA256

    88b426437c97301982bf096306af1bde70caa0a9a99a60514b31d0fa0ea64afd

  • SHA512

    0afdcb5362be67938d00baaeb3974af3ad2b7342c8024ec2390ce87bad4c6252e4c8277a0bb36979cdcb4036aa9f7dc93ac23f78acdd04033c3086fa3fd7286f

  • SSDEEP

    24576:yWmAFubS9dt9Mcp5CPu4YV5GaCxYiluVuTY4PRVGEw6GPDp5MwNrsJjF2GKGI8L:q29dRpYW4YV5QxYiET8ahPDMwNrs2y

Score
10/10

Malware Config

Signatures

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 1 IoCs
  • Executes dropped EXE 2 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops desktop.ini file(s) 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Suspicious use of SetThreadContext 1 IoCs
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 2 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\88b426437c97301982bf096306af1bde70caa0a9a99a60514b31d0fa0ea64afd.exe
    "C:\Users\Admin\AppData\Local\Temp\88b426437c97301982bf096306af1bde70caa0a9a99a60514b31d0fa0ea64afd.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1896
    • C:\Users\Admin\AppData\Local\Temp\SETUP_28773\Engine.exe
      C:\Users\Admin\AppData\Local\Temp\SETUP_28773\Engine.exe /TH_ID=_3028 /OriginExe="C:\Users\Admin\AppData\Local\Temp\88b426437c97301982bf096306af1bde70caa0a9a99a60514b31d0fa0ea64afd.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4776
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c cmd < 4
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3128
        • C:\Windows\SysWOW64\cmd.exe
          cmd
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4596
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell get-process avastui
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2404
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell get-process avgui
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2456
          • C:\Windows\SysWOW64\findstr.exe
            findstr /V /R "^ibXEdmiVmigethPmiCeveAlmmdbbRGVlGZgkrkVHBRdIphNCcvDTejGGhntqwKrSktcyZDvWGxUklCdjCVwceeizaHYEiVGRNbvySICSZHhIac$" 45
            5⤵
              PID:1928
            • C:\Users\Admin\AppData\Local\Temp\5col3ccv.tda\25850\Champion.exe.pif
              25850\\Champion.exe.pif 25850\\S
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of WriteProcessMemory
              PID:1260
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
                C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
                6⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:4684
            • C:\Windows\SysWOW64\PING.EXE
              ping localhost -n 18
              5⤵
              • Runs ping.exe
              PID:1224
    • C:\Windows\system32\OpenWith.exe
      C:\Windows\system32\OpenWith.exe -Embedding
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:1072
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
      1⤵
      • Drops desktop.ini file(s)
      • Checks processor information in registry
      • Modifies registry class
      PID:4028
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
      1⤵
      • Checks processor information in registry
      • Modifies registry class
      PID:1912

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    1
    T1082

    Remote System Discovery

    1
    T1018

    Command and Control

    Web Service

    1
    T1102

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
      Filesize

      1KB

      MD5

      def65711d78669d7f8e69313be4acf2e

      SHA1

      6522ebf1de09eeb981e270bd95114bc69a49cda6

      SHA256

      aa1c97cdbce9a848f1db2ad483f19caa535b55a3a1ef2ad1260e0437002bc82c

      SHA512

      05b2f9cd9bc3b46f52fded320b68e05f79b2b3ceaeb13e5d87ae9f8cd8e6c90bbb4ffa4da8192c2bfe0f58826cabff2e99e7c5cc8dd47037d4eb7bfc6f2710a7

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      18KB

      MD5

      8fffa9f05ef338deefff0625687db232

      SHA1

      d217b1668f0b21492e462f1fdeea05c1cad5fc65

      SHA256

      075d0fdc2fe8d8f118c3b7fa44da197a7cbe7dc125cf91a8f65b89a20fea0702

      SHA512

      c001840264e9693a6cd799d40f49d11c5833043bfc4b7bde25a5c4ead520afc22f13829ff65c006be75a6db8c9af88f6770e75f5e5f488fc87e831fd36e1f56e

    • C:\Users\Admin\AppData\Local\Temp\5col3ccv.tda\25850\Champion.exe.pif
      Filesize

      872KB

      MD5

      c56b5f0201a3b3de53e561fe76912bfd

      SHA1

      2a4062e10a5de813f5688221dbeb3f3ff33eb417

      SHA256

      237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

      SHA512

      195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

    • C:\Users\Admin\AppData\Local\Temp\SETUP_28773\00000#4
      Filesize

      12KB

      MD5

      4839bb17c0c82a044dbd0072c6c98cb6

      SHA1

      3c06dcc178dd8a8e2290b746cfc7e704a537c91f

      SHA256

      a7e6636cd2ba510513484cfea9201884f64f7b664951402b909caf9728704ec2

      SHA512

      13d607b989efca3105363a10f481ef02fdcfcd5da4a267da0b87f3f2417456e672337c8e6332e0be286f6401bea203149a1cd23a24a8006f689b32e9d6199b55

    • C:\Users\Admin\AppData\Local\Temp\SETUP_28773\00001#45
      Filesize

      872KB

      MD5

      a3b85111ecdfc29672319893192bb7fd

      SHA1

      4ec865fd387eade4cd0b0ad8cabd68cae89ac8d5

      SHA256

      ec8149d7c157e53108c089f07b8d2bf1156b8c1f8632c938a2130279927e2367

      SHA512

      0c9e75843ebe962246a0fd2d15e2b90ae71257aac15ee7b1cf12a3fc383a144fef5959c0a81c7d9f55ef6893937b1a9868a7c2546d70045c40810a7b3a0be804

    • C:\Users\Admin\AppData\Local\Temp\SETUP_28773\00002#7
      Filesize

      1.5MB

      MD5

      536073c3748e4eb7bbee303547b7227d

      SHA1

      4397b1d855e799f4d38467a848cda2273c1c6c73

      SHA256

      8e289b8dfc7e4994d808ef79a88adb513365177604fe587f6efa812f284e21a3

      SHA512

      3b1e1c853c362770a4ddcc4c7b3b932f9adf9db006bf649266a1b0c9c6c7b0afb7f0cd5687f672ed58908c9af8b56a830888b6f30defb97297cbde8de18f7651

    • C:\Users\Admin\AppData\Local\Temp\SETUP_28773\Engine.exe
      Filesize

      392KB

      MD5

      a7a99a201774531d761f6aac2651a9df

      SHA1

      b122ae368c4bf103e959a6ebb54ddb310117ab96

      SHA256

      e6e73497e85e9ece4c92ac7d49e07b9d55e932ba2d9e5789b94b95a9841ee524

      SHA512

      056504da2afeed547a4123ac8c38b35291b7dc0126fb638ae304eee802ac572715f9d608e9f1655788a030f488354741ee27c805434111c8e915cf841c0892f1

    • C:\Users\Admin\AppData\Local\Temp\SETUP_28773\Engine.exe
      Filesize

      392KB

      MD5

      a7a99a201774531d761f6aac2651a9df

      SHA1

      b122ae368c4bf103e959a6ebb54ddb310117ab96

      SHA256

      e6e73497e85e9ece4c92ac7d49e07b9d55e932ba2d9e5789b94b95a9841ee524

      SHA512

      056504da2afeed547a4123ac8c38b35291b7dc0126fb638ae304eee802ac572715f9d608e9f1655788a030f488354741ee27c805434111c8e915cf841c0892f1

    • C:\Users\Admin\AppData\Local\Temp\SETUP_28773\Modern_Icon.bmp
      Filesize

      7KB

      MD5

      1dd88f67f029710d5c5858a6293a93f1

      SHA1

      3e5ef66613415fe9467b2a24ccc27d8f997e7df6

      SHA256

      b5dad33ceb6eb1ac2a05fbda76e29a73038403939218a88367925c3a20c05532

      SHA512

      7071fd64038e0058c8c586c63c62677c0ca403768100f90323cf9c0bc7b7fcb538391e6f3606bd7970b8769445606ada47adcdcfc1e991e25caf272a13e10c94

    • C:\Users\Admin\AppData\Local\Temp\SETUP_28773\Setup.txt
      Filesize

      2KB

      MD5

      ae90fca8c12f2c43c468fbd0954381f7

      SHA1

      d475bb8f5891ab5f4c7cd2c90847cbfa68758842

      SHA256

      d9f67a975a877aa95e76821542311adb21704988d8452916d5b51feeeff3e720

      SHA512

      6880c7b658b7852bfcd597a57fd6e85f8a218e18d7acc248edc8efb2bea5a61063c4eeb5ae48008cc07408501c1af0eefc6a9010820ba823ab3fe66dae1f9041

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kijmp54y.fog.ps1
      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\Videos\Captures\desktop.ini
      Filesize

      190B

      MD5

      b0d27eaec71f1cd73b015f5ceeb15f9d

      SHA1

      62264f8b5c2f5034a1e4143df6e8c787165fbc2f

      SHA256

      86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2

      SHA512

      7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c

    • C:\Users\Admin\Videos\Captures\desktop.ini
      Filesize

      190B

      MD5

      b0d27eaec71f1cd73b015f5ceeb15f9d

      SHA1

      62264f8b5c2f5034a1e4143df6e8c787165fbc2f

      SHA256

      86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2

      SHA512

      7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c

    • memory/1260-217-0x0000000001110000-0x0000000001111000-memory.dmp
      Filesize

      4KB

    • memory/1896-181-0x0000000000400000-0x0000000000432000-memory.dmp
      Filesize

      200KB

    • memory/1896-216-0x0000000000400000-0x0000000000432000-memory.dmp
      Filesize

      200KB

    • memory/2404-184-0x0000000006D80000-0x0000000006D9A000-memory.dmp
      Filesize

      104KB

    • memory/2404-165-0x00000000052C0000-0x00000000052F6000-memory.dmp
      Filesize

      216KB

    • memory/2404-169-0x00000000058F0000-0x0000000005912000-memory.dmp
      Filesize

      136KB

    • memory/2404-182-0x0000000006890000-0x00000000068AE000-memory.dmp
      Filesize

      120KB

    • memory/2404-183-0x0000000007850000-0x00000000078E6000-memory.dmp
      Filesize

      600KB

    • memory/2404-170-0x00000000061D0000-0x0000000006236000-memory.dmp
      Filesize

      408KB

    • memory/2404-185-0x0000000006E00000-0x0000000006E22000-memory.dmp
      Filesize

      136KB

    • memory/2404-186-0x0000000007EA0000-0x0000000008444000-memory.dmp
      Filesize

      5.6MB

    • memory/2404-167-0x00000000053F0000-0x0000000005400000-memory.dmp
      Filesize

      64KB

    • memory/2404-168-0x00000000053F0000-0x0000000005400000-memory.dmp
      Filesize

      64KB

    • memory/2404-176-0x0000000006240000-0x00000000062A6000-memory.dmp
      Filesize

      408KB

    • memory/2404-166-0x0000000005A30000-0x0000000006058000-memory.dmp
      Filesize

      6.2MB

    • memory/2456-202-0x0000000004C30000-0x0000000004C40000-memory.dmp
      Filesize

      64KB

    • memory/4684-222-0x0000000004C30000-0x0000000004C40000-memory.dmp
      Filesize

      64KB

    • memory/4684-218-0x0000000000500000-0x00000000005A6000-memory.dmp
      Filesize

      664KB

    • memory/4684-220-0x0000000004B60000-0x0000000004BF2000-memory.dmp
      Filesize

      584KB

    • memory/4684-221-0x0000000004C30000-0x0000000004C40000-memory.dmp
      Filesize

      64KB

    • memory/4776-146-0x0000000000CE0000-0x0000000000CE1000-memory.dmp
      Filesize

      4KB

    • memory/4776-212-0x0000000000400000-0x0000000000558000-memory.dmp
      Filesize

      1.3MB

    • memory/4776-213-0x0000000000400000-0x0000000000558000-memory.dmp
      Filesize

      1.3MB

    • memory/4776-200-0x0000000000400000-0x0000000000558000-memory.dmp
      Filesize

      1.3MB

    • memory/4776-145-0x0000000000400000-0x0000000000558000-memory.dmp
      Filesize

      1.3MB

    • memory/4776-201-0x0000000000CE0000-0x0000000000CE1000-memory.dmp
      Filesize

      4KB