Analysis
- max time kernel
30s - max time network
125s - platform
windows7_x64 - resource
win7-20231129-en - resource tags
- submitted
31/12/2023, 10:22
General
- Target SecuriteInfo.com.FileRepMalware.31572.26968.exe
- Size 5.4MB
- Sample231231-md8cpseab9
- SHA256 ccf9b6883d9d9e834a8ab8a466ab2f8ff954ef4f5c6c3987b40cda8762462fe3
Malware Config
Signatures
- SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- SectopRAT payload 5 IoCs
- Loads dropped DLL 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.FileRepMalware.31572.26968.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.FileRepMalware.31572.26968.exe"1⤵
- Loads dropped DLL
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2548-16-0x0000000005250000-0x0000000005290000-memory.dmp
memory/2548-15-0x0000000005250000-0x0000000005290000-memory.dmp
memory/2548-2-0x00000000747B0000-0x0000000074E9E000-memory.dmp
memory/2548-3-0x0000000005250000-0x0000000005290000-memory.dmp
memory/2548-4-0x0000000006850000-0x0000000006B5A000-memory.dmp
memory/2548-5-0x0000000005850000-0x00000000059E2000-memory.dmp
memory/2548-13-0x00000000003D0000-0x00000000003E0000-memory.dmp
memory/2548-17-0x0000000005250000-0x0000000005290000-memory.dmp
memory/2548-46-0x0000000005250000-0x0000000005290000-memory.dmp
memory/2548-45-0x0000000005250000-0x0000000005290000-memory.dmp
memory/2548-10-0x0000000005250000-0x0000000005290000-memory.dmp
memory/2548-11-0x0000000005250000-0x0000000005290000-memory.dmp
memory/2548-12-0x0000000005250000-0x0000000005290000-memory.dmp
memory/2548-14-0x0000000005250000-0x0000000005290000-memory.dmp
memory/2548-0-0x00000000011D0000-0x000000000172E000-memory.dmp
memory/2548-19-0x0000000005250000-0x0000000005290000-memory.dmp
memory/2548-1-0x00000000747B0000-0x0000000074E9E000-memory.dmp
memory/2548-18-0x0000000005EC0000-0x0000000005FC0000-memory.dmp
memory/2548-20-0x0000000005250000-0x0000000005290000-memory.dmp
memory/2884-25-0x0000000000400000-0x00000000004D2000-memory.dmp
memory/2884-21-0x0000000000400000-0x00000000004D2000-memory.dmp
memory/2884-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/2884-22-0x0000000000400000-0x00000000004D2000-memory.dmp
memory/2884-29-0x0000000000400000-0x00000000004D2000-memory.dmp
memory/2884-31-0x0000000000400000-0x00000000004D2000-memory.dmp
memory/2884-35-0x0000000004FF0000-0x0000000005030000-memory.dmp
memory/2884-34-0x00000000747B0000-0x0000000074E9E000-memory.dmp
memory/2884-33-0x0000000000400000-0x00000000004D2000-memory.dmp
memory/2884-23-0x0000000000400000-0x00000000004D2000-memory.dmp