sectoprat | f4f8097c5f69c88f2b5623e8b9d0cf4658627a632104a10d4fcdc15b32d963f3

General

Target

69c3d5a7edebb0ed71c7cdfa42ae8a78c4eb74655d159939c3e212fd89dd7791.exe
Size

3.9MB
MD5

4bd0a75b3ace98a7226f3a22fbe29745
SHA1

316aea2a19ecbee6414f04799352ce6bdc654484
SHA256

69c3d5a7edebb0ed71c7cdfa42ae8a78c4eb74655d159939c3e212fd89dd7791
SHA512

52c24ed3701286be24e3335ce6f78c504caa3bcb4315349da958f0a2279ab55ffdbb92166d58de0bd7fea902a83704fe88a78e3f6226a55131f7587d16ab36a3
SSDEEP

49152:ynn8p9K3Tb8TpGeF7fhzjwZeJz+Uf1CAEmB1SQjiejeCEu50TzNCop+OBu:yn8c8MKaAJaUFj1S9ejeCEC4okrBu

Score

10^/10

sectoprat rat trojan

Malware Config

Signatures

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 5 IoCs

resource	yara_rule
behavioral1/memory/1432-32-0x0000000000400000-0x00000000004D2000-memory.dmp	family_sectoprat
behavioral1/memory/1432-30-0x0000000000400000-0x00000000004D2000-memory.dmp	family_sectoprat
behavioral1/memory/1432-28-0x0000000000400000-0x00000000004D2000-memory.dmp	family_sectoprat
behavioral1/memory/1432-24-0x0000000000400000-0x00000000004D2000-memory.dmp	family_sectoprat
behavioral1/memory/1432-23-0x0000000000400000-0x00000000004D2000-memory.dmp	family_sectoprat

Loads dropped DLL 1 IoCs

pid	Process
2908	69c3d5a7edebb0ed71c7cdfa42ae8a78c4eb74655d159939c3e212fd89dd7791.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2908 set thread context of 1432	2908	69c3d5a7edebb0ed71c7cdfa42ae8a78c4eb74655d159939c3e212fd89dd7791.exe	28

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1432	RegAsm.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 1432	2908	69c3d5a7edebb0ed71c7cdfa42ae8a78c4eb74655d159939c3e212fd89dd7791.exe	28
PID 2908 wrote to memory of 1432	2908	69c3d5a7edebb0ed71c7cdfa42ae8a78c4eb74655d159939c3e212fd89dd7791.exe	28
PID 2908 wrote to memory of 1432	2908	69c3d5a7edebb0ed71c7cdfa42ae8a78c4eb74655d159939c3e212fd89dd7791.exe	28
PID 2908 wrote to memory of 1432	2908	69c3d5a7edebb0ed71c7cdfa42ae8a78c4eb74655d159939c3e212fd89dd7791.exe	28
PID 2908 wrote to memory of 1432	2908	69c3d5a7edebb0ed71c7cdfa42ae8a78c4eb74655d159939c3e212fd89dd7791.exe	28
PID 2908 wrote to memory of 1432	2908	69c3d5a7edebb0ed71c7cdfa42ae8a78c4eb74655d159939c3e212fd89dd7791.exe	28
PID 2908 wrote to memory of 1432	2908	69c3d5a7edebb0ed71c7cdfa42ae8a78c4eb74655d159939c3e212fd89dd7791.exe	28
PID 2908 wrote to memory of 1432	2908	69c3d5a7edebb0ed71c7cdfa42ae8a78c4eb74655d159939c3e212fd89dd7791.exe	28
PID 2908 wrote to memory of 1432	2908	69c3d5a7edebb0ed71c7cdfa42ae8a78c4eb74655d159939c3e212fd89dd7791.exe	28
PID 2908 wrote to memory of 1432	2908	69c3d5a7edebb0ed71c7cdfa42ae8a78c4eb74655d159939c3e212fd89dd7791.exe	28
PID 2908 wrote to memory of 1432	2908	69c3d5a7edebb0ed71c7cdfa42ae8a78c4eb74655d159939c3e212fd89dd7791.exe	28
PID 2908 wrote to memory of 1432	2908	69c3d5a7edebb0ed71c7cdfa42ae8a78c4eb74655d159939c3e212fd89dd7791.exe	28

C:\Users\Admin\AppData\Local\Temp\69c3d5a7edebb0ed71c7cdfa42ae8a78c4eb74655d159939c3e212fd89dd7791.exe
"C:\Users\Admin\AppData\Local\Temp\69c3d5a7edebb0ed71c7cdfa42ae8a78c4eb74655d159939c3e212fd89dd7791.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\Protect544cd51a.dll

Filesize
377KB

MD5
2f03cd182df98389114cf349476c2048

SHA1
c77557634b96895d0e73fee196e9c4f8a61de827

SHA256
f4d4d92cbf0d8a3a19693772d4911d942dd53d73619d4e67c70c2f9bca8e6351

SHA512
d3c07a0ed241565287668942407ff2a739211090d48f353da22f7bc25e0b4a4e49cdca859795f8e318f1eac212f499ac31c16549477ed088dc6c086b25eeb625

Download Submit
memory/1432-22-0x0000000000400000-0x00000000004D2000-memory.dmp

Filesize
840KB

Download
memory/1432-21-0x0000000000400000-0x00000000004D2000-memory.dmp

Filesize
840KB

Download
memory/1432-23-0x0000000000400000-0x00000000004D2000-memory.dmp

Filesize
840KB

Download
memory/1432-24-0x0000000000400000-0x00000000004D2000-memory.dmp

Filesize
840KB

Download
memory/1432-26-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1432-28-0x0000000000400000-0x00000000004D2000-memory.dmp

Filesize
840KB

Download
memory/1432-30-0x0000000000400000-0x00000000004D2000-memory.dmp

Filesize
840KB

Download
memory/1432-32-0x0000000000400000-0x00000000004D2000-memory.dmp

Filesize
840KB

Download
memory/2908-14-0x0000000004EF0000-0x0000000004F30000-memory.dmp

Filesize
256KB

Download
memory/2908-2-0x0000000004EF0000-0x0000000004F30000-memory.dmp

Filesize
256KB

Download
memory/2908-12-0x0000000004EF0000-0x0000000004F30000-memory.dmp

Filesize
256KB

Download
memory/2908-15-0x0000000004EF0000-0x0000000004F30000-memory.dmp

Filesize
256KB

Download
memory/2908-16-0x0000000004EF0000-0x0000000004F30000-memory.dmp

Filesize
256KB

Download
memory/2908-17-0x0000000004EF0000-0x0000000004F30000-memory.dmp

Filesize
256KB

Download
memory/2908-19-0x0000000004EF0000-0x0000000004F30000-memory.dmp

Filesize
256KB

Download
memory/2908-1-0x0000000073F90000-0x000000007467E000-memory.dmp

Filesize
6.9MB

Download
memory/2908-10-0x0000000004EF0000-0x0000000004F30000-memory.dmp

Filesize
256KB

Download
memory/2908-11-0x0000000004EF0000-0x0000000004F30000-memory.dmp

Filesize
256KB

Download
memory/2908-9-0x0000000000840000-0x0000000000850000-memory.dmp

Filesize
64KB

Download
memory/2908-4-0x00000000069F0000-0x0000000006B82000-memory.dmp

Filesize
1.6MB

Download
memory/2908-3-0x0000000005790000-0x00000000059EE000-memory.dmp

Filesize
2.4MB

Download
memory/2908-13-0x0000000004EF0000-0x0000000004F30000-memory.dmp

Filesize
256KB

Download
memory/2908-0-0x00000000008A0000-0x0000000000C90000-memory.dmp

Filesize
3.9MB

Download
memory/2908-20-0x0000000004EF0000-0x0000000004F30000-memory.dmp

Filesize
256KB

Download
memory/2908-18-0x00000000071A0000-0x00000000072A0000-memory.dmp

Filesize
1024KB

Download
memory/2908-33-0x0000000073F90000-0x000000007467E000-memory.dmp

Filesize
6.9MB

Download
memory/2908-34-0x0000000004EF0000-0x0000000004F30000-memory.dmp

Filesize
256KB

Download
memory/2908-35-0x0000000004EF0000-0x0000000004F30000-memory.dmp

Filesize
256KB

Download
memory/2908-36-0x0000000004EF0000-0x0000000004F30000-memory.dmp

Filesize
256KB

Download
memory/2908-37-0x0000000004EF0000-0x0000000004F30000-memory.dmp

Filesize
256KB

Download
memory/2908-38-0x0000000004EF0000-0x0000000004F30000-memory.dmp

Filesize
256KB

Download
memory/2908-39-0x0000000004EF0000-0x0000000004F30000-memory.dmp

Filesize
256KB

Download
memory/2908-40-0x0000000004EF0000-0x0000000004F30000-memory.dmp

Filesize
256KB

Download
memory/2908-41-0x0000000004EF0000-0x0000000004F30000-memory.dmp

Filesize
256KB

Download
memory/2908-42-0x00000000071A0000-0x00000000072A0000-memory.dmp

Filesize
1024KB

Download
memory/2908-43-0x0000000004EF0000-0x0000000004F30000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing