Analysis

  • max time kernel
    151s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/12/2023, 23:17

General

  • Target

    18c8f4022544bf2251e8b95555fa4a3e.exe

  • Size

    6.1MB

  • MD5

    18c8f4022544bf2251e8b95555fa4a3e

  • SHA1

    8348c4b785c767887b2ce18dc9b1c62141cb6396

  • SHA256

    72bda43e879bb6258c83bf71b99a1c6b088b7fa6b147c473ebc5005383e5a3d6

  • SHA512

    adc22cdab7ea8e35ab54ba494d669aea105aa1ad49d47fad3fb07ce8daee567d44da6745c40c28ad631e669e485bd78cbc63db90fd7c397d52120b1d376b9378

  • SSDEEP

    98304:3D2M2pgaPhhWSgYiAZFvMO5evocJ6SQFiv6ci/f69Cr4MnbI6LyHgZVKck0zAjDC:z2Fph/Wj5w5eVGFiDgZLEgnKcRAvdcd

Malware Config

Signatures

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 2 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer 2 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\18c8f4022544bf2251e8b95555fa4a3e.exe
    "C:\Users\Admin\AppData\Local\Temp\18c8f4022544bf2251e8b95555fa4a3e.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of AdjustPrivilegeToken
    PID:2796

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2796-0-0x0000000000010000-0x0000000000FFC000-memory.dmp

          Filesize

          15.9MB

        • memory/2796-1-0x0000000075F70000-0x0000000076060000-memory.dmp

          Filesize

          960KB

        • memory/2796-2-0x0000000075F70000-0x0000000076060000-memory.dmp

          Filesize

          960KB

        • memory/2796-3-0x0000000075F70000-0x0000000076060000-memory.dmp

          Filesize

          960KB

        • memory/2796-4-0x0000000075F70000-0x0000000076060000-memory.dmp

          Filesize

          960KB

        • memory/2796-6-0x0000000075F70000-0x0000000076060000-memory.dmp

          Filesize

          960KB

        • memory/2796-5-0x0000000075F70000-0x0000000076060000-memory.dmp

          Filesize

          960KB

        • memory/2796-8-0x0000000075F70000-0x0000000076060000-memory.dmp

          Filesize

          960KB

        • memory/2796-7-0x0000000075F70000-0x0000000076060000-memory.dmp

          Filesize

          960KB

        • memory/2796-9-0x0000000077E34000-0x0000000077E36000-memory.dmp

          Filesize

          8KB

        • memory/2796-12-0x0000000000010000-0x0000000000FFC000-memory.dmp

          Filesize

          15.9MB

        • memory/2796-13-0x0000000000010000-0x0000000000FFC000-memory.dmp

          Filesize

          15.9MB

        • memory/2796-14-0x0000000006160000-0x0000000006778000-memory.dmp

          Filesize

          6.1MB

        • memory/2796-15-0x0000000005BF0000-0x0000000005C02000-memory.dmp

          Filesize

          72KB

        • memory/2796-16-0x0000000005C50000-0x0000000005C8C000-memory.dmp

          Filesize

          240KB

        • memory/2796-17-0x0000000005C90000-0x0000000005CDC000-memory.dmp

          Filesize

          304KB

        • memory/2796-18-0x0000000005F20000-0x000000000602A000-memory.dmp

          Filesize

          1.0MB

        • memory/2796-20-0x0000000000010000-0x0000000000FFC000-memory.dmp

          Filesize

          15.9MB

        • memory/2796-21-0x0000000075F70000-0x0000000076060000-memory.dmp

          Filesize

          960KB

        • memory/2796-22-0x0000000075F70000-0x0000000076060000-memory.dmp

          Filesize

          960KB

        • memory/2796-23-0x0000000075F70000-0x0000000076060000-memory.dmp

          Filesize

          960KB

        • memory/2796-24-0x0000000075F70000-0x0000000076060000-memory.dmp

          Filesize

          960KB

        • memory/2796-26-0x0000000075F70000-0x0000000076060000-memory.dmp

          Filesize

          960KB

        • memory/2796-27-0x0000000075F70000-0x0000000076060000-memory.dmp

          Filesize

          960KB

        • memory/2796-28-0x0000000075F70000-0x0000000076060000-memory.dmp

          Filesize

          960KB