Analysis

  • max time kernel
    143s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    24/12/2023, 22:25

General

  • Target

    1590729c0c494bec67b052487014a86c.exe

  • Size

    3.1MB

  • MD5

    1590729c0c494bec67b052487014a86c

  • SHA1

    2d5136099868b71fbe2f5d09a869d3925ec6a72d

  • SHA256

    077a1cd138704282434ff2f6dd2084592f23da9ee1f0408a98f30c3cec87b910

  • SHA512

    78e0fc06afc512b76b74b59d893725a3eca65462585a19d063c831f22002bedade824ab59655bc3c31d6c8cd3e7d7b8d8a1cc6cde05a2962caadf5b44a1fc9bc

  • SSDEEP

    98304:j8UqoYQv9A6mjUCn9Phrc1SGnh5mcSaxzL1:j/DYcDmjUC9DOcyv1

Malware Config

Signatures

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 2 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer 2 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1590729c0c494bec67b052487014a86c.exe
    "C:\Users\Admin\AppData\Local\Temp\1590729c0c494bec67b052487014a86c.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of AdjustPrivilegeToken
    PID:2988

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2988-0-0x0000000001000000-0x000000000190A000-memory.dmp

    Filesize

    9.0MB

  • memory/2988-1-0x0000000074E90000-0x0000000074FA0000-memory.dmp

    Filesize

    1.1MB

  • memory/2988-2-0x0000000074E90000-0x0000000074FA0000-memory.dmp

    Filesize

    1.1MB

  • memory/2988-3-0x0000000074E90000-0x0000000074FA0000-memory.dmp

    Filesize

    1.1MB

  • memory/2988-4-0x00000000758E0000-0x0000000075927000-memory.dmp

    Filesize

    284KB

  • memory/2988-6-0x0000000074E90000-0x0000000074FA0000-memory.dmp

    Filesize

    1.1MB

  • memory/2988-5-0x0000000074E90000-0x0000000074FA0000-memory.dmp

    Filesize

    1.1MB

  • memory/2988-8-0x0000000074E90000-0x0000000074FA0000-memory.dmp

    Filesize

    1.1MB

  • memory/2988-9-0x0000000074E90000-0x0000000074FA0000-memory.dmp

    Filesize

    1.1MB

  • memory/2988-7-0x0000000074E90000-0x0000000074FA0000-memory.dmp

    Filesize

    1.1MB

  • memory/2988-10-0x0000000074E90000-0x0000000074FA0000-memory.dmp

    Filesize

    1.1MB

  • memory/2988-11-0x0000000074E90000-0x0000000074FA0000-memory.dmp

    Filesize

    1.1MB

  • memory/2988-12-0x0000000074E90000-0x0000000074FA0000-memory.dmp

    Filesize

    1.1MB

  • memory/2988-13-0x0000000074E90000-0x0000000074FA0000-memory.dmp

    Filesize

    1.1MB

  • memory/2988-14-0x00000000758E0000-0x0000000075927000-memory.dmp

    Filesize

    284KB

  • memory/2988-16-0x0000000001000000-0x000000000190A000-memory.dmp

    Filesize

    9.0MB

  • memory/2988-17-0x0000000074E90000-0x0000000074FA0000-memory.dmp

    Filesize

    1.1MB

  • memory/2988-19-0x0000000074E90000-0x0000000074FA0000-memory.dmp

    Filesize

    1.1MB

  • memory/2988-20-0x0000000074E90000-0x0000000074FA0000-memory.dmp

    Filesize

    1.1MB

  • memory/2988-21-0x00000000758E0000-0x0000000075927000-memory.dmp

    Filesize

    284KB

  • memory/2988-24-0x0000000074E90000-0x0000000074FA0000-memory.dmp

    Filesize

    1.1MB

  • memory/2988-25-0x0000000074E90000-0x0000000074FA0000-memory.dmp

    Filesize

    1.1MB

  • memory/2988-26-0x0000000074E90000-0x0000000074FA0000-memory.dmp

    Filesize

    1.1MB

  • memory/2988-28-0x0000000074E90000-0x0000000074FA0000-memory.dmp

    Filesize

    1.1MB

  • memory/2988-29-0x0000000074E90000-0x0000000074FA0000-memory.dmp

    Filesize

    1.1MB

  • memory/2988-30-0x0000000074E90000-0x0000000074FA0000-memory.dmp

    Filesize

    1.1MB

  • memory/2988-31-0x0000000074E90000-0x0000000074FA0000-memory.dmp

    Filesize

    1.1MB

  • memory/2988-33-0x0000000074E90000-0x0000000074FA0000-memory.dmp

    Filesize

    1.1MB

  • memory/2988-32-0x0000000074E90000-0x0000000074FA0000-memory.dmp

    Filesize

    1.1MB

  • memory/2988-27-0x0000000074E90000-0x0000000074FA0000-memory.dmp

    Filesize

    1.1MB

  • memory/2988-23-0x0000000074E90000-0x0000000074FA0000-memory.dmp

    Filesize

    1.1MB

  • memory/2988-22-0x00000000758E0000-0x0000000075927000-memory.dmp

    Filesize

    284KB

  • memory/2988-18-0x00000000758E0000-0x0000000075927000-memory.dmp

    Filesize

    284KB

  • memory/2988-15-0x00000000758E0000-0x0000000075927000-memory.dmp

    Filesize

    284KB

  • memory/2988-34-0x0000000076F20000-0x0000000076F22000-memory.dmp

    Filesize

    8KB

  • memory/2988-38-0x00000000758E0000-0x0000000075927000-memory.dmp

    Filesize

    284KB

  • memory/2988-40-0x0000000001000000-0x000000000190A000-memory.dmp

    Filesize

    9.0MB

  • memory/2988-41-0x0000000001000000-0x000000000190A000-memory.dmp

    Filesize

    9.0MB

  • memory/2988-39-0x0000000073F30000-0x000000007461E000-memory.dmp

    Filesize

    6.9MB

  • memory/2988-42-0x00000000758E0000-0x0000000075927000-memory.dmp

    Filesize

    284KB

  • memory/2988-43-0x0000000000F70000-0x0000000000FB0000-memory.dmp

    Filesize

    256KB

  • memory/2988-44-0x00000000758E0000-0x0000000075927000-memory.dmp

    Filesize

    284KB

  • memory/2988-46-0x0000000074E90000-0x0000000074FA0000-memory.dmp

    Filesize

    1.1MB

  • memory/2988-47-0x0000000074E90000-0x0000000074FA0000-memory.dmp

    Filesize

    1.1MB

  • memory/2988-49-0x0000000074E90000-0x0000000074FA0000-memory.dmp

    Filesize

    1.1MB

  • memory/2988-48-0x0000000074E90000-0x0000000074FA0000-memory.dmp

    Filesize

    1.1MB

  • memory/2988-50-0x0000000074E90000-0x0000000074FA0000-memory.dmp

    Filesize

    1.1MB

  • memory/2988-52-0x0000000074E90000-0x0000000074FA0000-memory.dmp

    Filesize

    1.1MB

  • memory/2988-53-0x0000000073F30000-0x000000007461E000-memory.dmp

    Filesize

    6.9MB

  • memory/2988-54-0x0000000000F70000-0x0000000000FB0000-memory.dmp

    Filesize

    256KB