sectoprat | 077a1cd138704282434ff2f6dd2084592f23da9ee1f0408a98f30c3cec87b910

Analysis

max time kernel
143s
max time network
147s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 22:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1590729c0c494bec67b052487014a86c.exe
Size

3.1MB
MD5

1590729c0c494bec67b052487014a86c
SHA1

2d5136099868b71fbe2f5d09a869d3925ec6a72d
SHA256

077a1cd138704282434ff2f6dd2084592f23da9ee1f0408a98f30c3cec87b910
SHA512

78e0fc06afc512b76b74b59d893725a3eca65462585a19d063c831f22002bedade824ab59655bc3c31d6c8cd3e7d7b8d8a1cc6cde05a2962caadf5b44a1fc9bc
SSDEEP

98304:j8UqoYQv9A6mjUCn9Phrc1SGnh5mcSaxzL1:j/DYcDmjUC9DOcyv1

Score

10^/10

sectoprat evasion rat themida trojan

Malware Config

Signatures

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 2 IoCs

resource	yara_rule
behavioral1/memory/2988-40-0x0000000001000000-0x000000000190A000-memory.dmp	family_sectoprat
behavioral1/memory/2988-41-0x0000000001000000-0x000000000190A000-memory.dmp	family_sectoprat

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	1590729c0c494bec67b052487014a86c.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	1590729c0c494bec67b052487014a86c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	1590729c0c494bec67b052487014a86c.exe

Themida packer 2 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/2988-40-0x0000000001000000-0x000000000190A000-memory.dmp	themida
behavioral1/memory/2988-41-0x0000000001000000-0x000000000190A000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	1590729c0c494bec67b052487014a86c.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2988	1590729c0c494bec67b052487014a86c.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2988	1590729c0c494bec67b052487014a86c.exe

C:\Users\Admin\AppData\Local\Temp\1590729c0c494bec67b052487014a86c.exe
"C:\Users\Admin\AppData\Local\Temp\1590729c0c494bec67b052487014a86c.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:2988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2988-0-0x0000000001000000-0x000000000190A000-memory.dmp

Filesize
9.0MB

Download
memory/2988-1-0x0000000074E90000-0x0000000074FA0000-memory.dmp

Filesize
1.1MB

Download
memory/2988-2-0x0000000074E90000-0x0000000074FA0000-memory.dmp

Filesize
1.1MB

Download
memory/2988-3-0x0000000074E90000-0x0000000074FA0000-memory.dmp

Filesize
1.1MB

Download
memory/2988-4-0x00000000758E0000-0x0000000075927000-memory.dmp

Filesize
284KB

Download
memory/2988-6-0x0000000074E90000-0x0000000074FA0000-memory.dmp

Filesize
1.1MB

Download
memory/2988-5-0x0000000074E90000-0x0000000074FA0000-memory.dmp

Filesize
1.1MB

Download
memory/2988-8-0x0000000074E90000-0x0000000074FA0000-memory.dmp

Filesize
1.1MB

Download
memory/2988-9-0x0000000074E90000-0x0000000074FA0000-memory.dmp

Filesize
1.1MB

Download
memory/2988-7-0x0000000074E90000-0x0000000074FA0000-memory.dmp

Filesize
1.1MB

Download
memory/2988-10-0x0000000074E90000-0x0000000074FA0000-memory.dmp

Filesize
1.1MB

Download
memory/2988-11-0x0000000074E90000-0x0000000074FA0000-memory.dmp

Filesize
1.1MB

Download
memory/2988-12-0x0000000074E90000-0x0000000074FA0000-memory.dmp

Filesize
1.1MB

Download
memory/2988-13-0x0000000074E90000-0x0000000074FA0000-memory.dmp

Filesize
1.1MB

Download
memory/2988-14-0x00000000758E0000-0x0000000075927000-memory.dmp

Filesize
284KB

Download
memory/2988-16-0x0000000001000000-0x000000000190A000-memory.dmp

Filesize
9.0MB

Download
memory/2988-17-0x0000000074E90000-0x0000000074FA0000-memory.dmp

Filesize
1.1MB

Download
memory/2988-19-0x0000000074E90000-0x0000000074FA0000-memory.dmp

Filesize
1.1MB

Download
memory/2988-20-0x0000000074E90000-0x0000000074FA0000-memory.dmp

Filesize
1.1MB

Download
memory/2988-21-0x00000000758E0000-0x0000000075927000-memory.dmp

Filesize
284KB

Download
memory/2988-24-0x0000000074E90000-0x0000000074FA0000-memory.dmp

Filesize
1.1MB

Download
memory/2988-25-0x0000000074E90000-0x0000000074FA0000-memory.dmp

Filesize
1.1MB

Download
memory/2988-26-0x0000000074E90000-0x0000000074FA0000-memory.dmp

Filesize
1.1MB

Download
memory/2988-28-0x0000000074E90000-0x0000000074FA0000-memory.dmp

Filesize
1.1MB

Download
memory/2988-29-0x0000000074E90000-0x0000000074FA0000-memory.dmp

Filesize
1.1MB

Download
memory/2988-30-0x0000000074E90000-0x0000000074FA0000-memory.dmp

Filesize
1.1MB

Download
memory/2988-31-0x0000000074E90000-0x0000000074FA0000-memory.dmp

Filesize
1.1MB

Download
memory/2988-33-0x0000000074E90000-0x0000000074FA0000-memory.dmp

Filesize
1.1MB

Download
memory/2988-32-0x0000000074E90000-0x0000000074FA0000-memory.dmp

Filesize
1.1MB

Download
memory/2988-27-0x0000000074E90000-0x0000000074FA0000-memory.dmp

Filesize
1.1MB

Download
memory/2988-23-0x0000000074E90000-0x0000000074FA0000-memory.dmp

Filesize
1.1MB

Download
memory/2988-22-0x00000000758E0000-0x0000000075927000-memory.dmp

Filesize
284KB

Download
memory/2988-18-0x00000000758E0000-0x0000000075927000-memory.dmp

Filesize
284KB

Download
memory/2988-15-0x00000000758E0000-0x0000000075927000-memory.dmp

Filesize
284KB

Download
memory/2988-34-0x0000000076F20000-0x0000000076F22000-memory.dmp

Filesize
8KB

Download
memory/2988-38-0x00000000758E0000-0x0000000075927000-memory.dmp

Filesize
284KB

Download
memory/2988-40-0x0000000001000000-0x000000000190A000-memory.dmp

Filesize
9.0MB

Download
memory/2988-41-0x0000000001000000-0x000000000190A000-memory.dmp

Filesize
9.0MB

Download
memory/2988-39-0x0000000073F30000-0x000000007461E000-memory.dmp

Filesize
6.9MB

Download
memory/2988-42-0x00000000758E0000-0x0000000075927000-memory.dmp

Filesize
284KB

Download
memory/2988-43-0x0000000000F70000-0x0000000000FB0000-memory.dmp

Filesize
256KB

Download
memory/2988-44-0x00000000758E0000-0x0000000075927000-memory.dmp

Filesize
284KB

Download
memory/2988-46-0x0000000074E90000-0x0000000074FA0000-memory.dmp

Filesize
1.1MB

Download
memory/2988-47-0x0000000074E90000-0x0000000074FA0000-memory.dmp

Filesize
1.1MB

Download
memory/2988-49-0x0000000074E90000-0x0000000074FA0000-memory.dmp

Filesize
1.1MB

Download
memory/2988-48-0x0000000074E90000-0x0000000074FA0000-memory.dmp

Filesize
1.1MB

Download
memory/2988-50-0x0000000074E90000-0x0000000074FA0000-memory.dmp

Filesize
1.1MB

Download
memory/2988-52-0x0000000074E90000-0x0000000074FA0000-memory.dmp

Filesize
1.1MB

Download
memory/2988-53-0x0000000073F30000-0x000000007461E000-memory.dmp

Filesize
6.9MB

Download
memory/2988-54-0x0000000000F70000-0x0000000000FB0000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads