Analysis

  • max time kernel
    141s
  • max time network
    141s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    24/12/2023, 23:17

General

  • Target

    18c8f4022544bf2251e8b95555fa4a3e.exe

  • Size

    6.1MB

  • MD5

    18c8f4022544bf2251e8b95555fa4a3e

  • SHA1

    8348c4b785c767887b2ce18dc9b1c62141cb6396

  • SHA256

    72bda43e879bb6258c83bf71b99a1c6b088b7fa6b147c473ebc5005383e5a3d6

  • SHA512

    adc22cdab7ea8e35ab54ba494d669aea105aa1ad49d47fad3fb07ce8daee567d44da6745c40c28ad631e669e485bd78cbc63db90fd7c397d52120b1d376b9378

  • SSDEEP

    98304:3D2M2pgaPhhWSgYiAZFvMO5evocJ6SQFiv6ci/f69Cr4MnbI6LyHgZVKck0zAjDC:z2Fph/Wj5w5eVGFiDgZLEgnKcRAvdcd

Malware Config

Signatures

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 2 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer 2 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\18c8f4022544bf2251e8b95555fa4a3e.exe
    "C:\Users\Admin\AppData\Local\Temp\18c8f4022544bf2251e8b95555fa4a3e.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of AdjustPrivilegeToken
    PID:3016

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/3016-0-0x0000000001170000-0x000000000215C000-memory.dmp

          Filesize

          15.9MB

        • memory/3016-1-0x0000000075100000-0x0000000075210000-memory.dmp

          Filesize

          1.1MB

        • memory/3016-2-0x0000000075100000-0x0000000075210000-memory.dmp

          Filesize

          1.1MB

        • memory/3016-3-0x0000000075100000-0x0000000075210000-memory.dmp

          Filesize

          1.1MB

        • memory/3016-5-0x0000000075100000-0x0000000075210000-memory.dmp

          Filesize

          1.1MB

        • memory/3016-7-0x0000000075080000-0x00000000750C7000-memory.dmp

          Filesize

          284KB

        • memory/3016-9-0x0000000075100000-0x0000000075210000-memory.dmp

          Filesize

          1.1MB

        • memory/3016-14-0x0000000075100000-0x0000000075210000-memory.dmp

          Filesize

          1.1MB

        • memory/3016-15-0x00000000775D0000-0x00000000775D2000-memory.dmp

          Filesize

          8KB

        • memory/3016-13-0x0000000075080000-0x00000000750C7000-memory.dmp

          Filesize

          284KB

        • memory/3016-17-0x0000000001170000-0x000000000215C000-memory.dmp

          Filesize

          15.9MB

        • memory/3016-18-0x0000000001170000-0x000000000215C000-memory.dmp

          Filesize

          15.9MB

        • memory/3016-16-0x00000000745E0000-0x0000000074CCE000-memory.dmp

          Filesize

          6.9MB

        • memory/3016-12-0x0000000075100000-0x0000000075210000-memory.dmp

          Filesize

          1.1MB

        • memory/3016-11-0x0000000075080000-0x00000000750C7000-memory.dmp

          Filesize

          284KB

        • memory/3016-10-0x0000000075100000-0x0000000075210000-memory.dmp

          Filesize

          1.1MB

        • memory/3016-19-0x00000000008E0000-0x0000000000920000-memory.dmp

          Filesize

          256KB

        • memory/3016-21-0x0000000001170000-0x000000000215C000-memory.dmp

          Filesize

          15.9MB

        • memory/3016-26-0x0000000075100000-0x0000000075210000-memory.dmp

          Filesize

          1.1MB

        • memory/3016-25-0x0000000075100000-0x0000000075210000-memory.dmp

          Filesize

          1.1MB

        • memory/3016-24-0x0000000075100000-0x0000000075210000-memory.dmp

          Filesize

          1.1MB

        • memory/3016-23-0x0000000075080000-0x00000000750C7000-memory.dmp

          Filesize

          284KB

        • memory/3016-22-0x0000000075100000-0x0000000075210000-memory.dmp

          Filesize

          1.1MB

        • memory/3016-28-0x00000000745E0000-0x0000000074CCE000-memory.dmp

          Filesize

          6.9MB

        • memory/3016-29-0x00000000008E0000-0x0000000000920000-memory.dmp

          Filesize

          256KB