Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/12/2023, 22:25

General

  • Target

    1590729c0c494bec67b052487014a86c.exe

  • Size

    3.1MB

  • MD5

    1590729c0c494bec67b052487014a86c

  • SHA1

    2d5136099868b71fbe2f5d09a869d3925ec6a72d

  • SHA256

    077a1cd138704282434ff2f6dd2084592f23da9ee1f0408a98f30c3cec87b910

  • SHA512

    78e0fc06afc512b76b74b59d893725a3eca65462585a19d063c831f22002bedade824ab59655bc3c31d6c8cd3e7d7b8d8a1cc6cde05a2962caadf5b44a1fc9bc

  • SSDEEP

    98304:j8UqoYQv9A6mjUCn9Phrc1SGnh5mcSaxzL1:j/DYcDmjUC9DOcyv1

Malware Config

Signatures

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 2 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer 2 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1590729c0c494bec67b052487014a86c.exe
    "C:\Users\Admin\AppData\Local\Temp\1590729c0c494bec67b052487014a86c.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of AdjustPrivilegeToken
    PID:5612

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/5612-0-0x0000000000A40000-0x000000000134A000-memory.dmp

    Filesize

    9.0MB

  • memory/5612-1-0x0000000075E50000-0x0000000075F40000-memory.dmp

    Filesize

    960KB

  • memory/5612-2-0x0000000075E50000-0x0000000075F40000-memory.dmp

    Filesize

    960KB

  • memory/5612-3-0x0000000075E50000-0x0000000075F40000-memory.dmp

    Filesize

    960KB

  • memory/5612-4-0x0000000075E50000-0x0000000075F40000-memory.dmp

    Filesize

    960KB

  • memory/5612-5-0x0000000075E50000-0x0000000075F40000-memory.dmp

    Filesize

    960KB

  • memory/5612-6-0x0000000075E50000-0x0000000075F40000-memory.dmp

    Filesize

    960KB

  • memory/5612-7-0x0000000077C94000-0x0000000077C96000-memory.dmp

    Filesize

    8KB

  • memory/5612-11-0x0000000000A40000-0x000000000134A000-memory.dmp

    Filesize

    9.0MB

  • memory/5612-10-0x0000000000A40000-0x000000000134A000-memory.dmp

    Filesize

    9.0MB

  • memory/5612-12-0x0000000005B40000-0x0000000006158000-memory.dmp

    Filesize

    6.1MB

  • memory/5612-14-0x00000000055A0000-0x00000000055DC000-memory.dmp

    Filesize

    240KB

  • memory/5612-13-0x0000000005540000-0x0000000005552000-memory.dmp

    Filesize

    72KB

  • memory/5612-15-0x00000000055E0000-0x000000000562C000-memory.dmp

    Filesize

    304KB

  • memory/5612-16-0x0000000005840000-0x000000000594A000-memory.dmp

    Filesize

    1.0MB

  • memory/5612-18-0x0000000000A40000-0x000000000134A000-memory.dmp

    Filesize

    9.0MB

  • memory/5612-19-0x0000000075E50000-0x0000000075F40000-memory.dmp

    Filesize

    960KB

  • memory/5612-20-0x0000000075E50000-0x0000000075F40000-memory.dmp

    Filesize

    960KB

  • memory/5612-21-0x0000000075E50000-0x0000000075F40000-memory.dmp

    Filesize

    960KB

  • memory/5612-23-0x0000000075E50000-0x0000000075F40000-memory.dmp

    Filesize

    960KB

  • memory/5612-24-0x0000000075E50000-0x0000000075F40000-memory.dmp

    Filesize

    960KB

  • memory/5612-25-0x0000000075E50000-0x0000000075F40000-memory.dmp

    Filesize

    960KB