Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
-
submitted
04-08-2023 13:35
General
-
Target
malware.ps1
-
Size
632KB
-
MD5
b51ce03f581892df4518a19c36819d32
-
SHA1
b16fd35868ee3381d04c8c8ec7a5cec2be7f7fd5
-
SHA256
64fa05b0833add3f4c0a7b92c758cddc707ac15c029b86735b4135ee272d72bf
-
SHA512
ea3c087ab4b219251273106e665d4d7157959ff33d0c473aa4e41848ee3a5011a8d924d97abbb2a098fbdb0d801183c4b92e7b3472f17a0dbd21063a7526f644
-
SSDEEP
12288:FyC892ilTl8aEE+DV2M3GQCsU43yKDGX9xL/xxMjypoMrCm042ruD:FyC8924WaEFDIsTCKD2zxxMxM2m0hr0
Score
10/10
Malware Config
Signatures
-
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
-
SectopRAT payload 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\malware.ps11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
-
Filesize
32KB
-
Filesize
9.6MB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
9.6MB
-
Filesize
512KB
-
Filesize
496KB
-
Filesize
9.6MB
-
Filesize
512KB