Analysis
- max time kernel
156s - max time network
165s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
31/12/2023, 10:22
General
- Target SecuriteInfo.com.FileRepMalware.31572.26968.exe
- Size 5.4MB
- Sample231231-md8cpseab9
- SHA256 ccf9b6883d9d9e834a8ab8a466ab2f8ff954ef4f5c6c3987b40cda8762462fe3
Malware Config
Signatures
- SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- SectopRAT payload 1 IoCs
- .NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Loads dropped DLL 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.FileRepMalware.31572.26968.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.FileRepMalware.31572.26968.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
Protect544cd51a.dll
memory/3284-16-0x00000000017B0000-0x00000000017C0000-memory.dmp
memory/3284-24-0x0000000008BC0000-0x0000000008CC0000-memory.dmp
memory/3284-3-0x0000000075000000-0x00000000757B0000-memory.dmp
memory/3284-4-0x0000000005CC0000-0x0000000005CD0000-memory.dmp
memory/3284-5-0x0000000007050000-0x000000000735A000-memory.dmp
memory/3284-6-0x0000000005CC0000-0x0000000005CD0000-memory.dmp
memory/3284-7-0x00000000087B0000-0x0000000008942000-memory.dmp
memory/3284-1-0x0000000000E90000-0x00000000013EE000-memory.dmp
memory/3284-13-0x0000000005CC0000-0x0000000005CD0000-memory.dmp
memory/3284-14-0x0000000005CC0000-0x0000000005CD0000-memory.dmp
memory/3284-15-0x0000000005CC0000-0x0000000005CD0000-memory.dmp
memory/3284-0-0x0000000075000000-0x00000000757B0000-memory.dmp
memory/3284-2-0x0000000005DB0000-0x0000000005E4C000-memory.dmp
memory/3284-30-0x0000000005CC0000-0x0000000005CD0000-memory.dmp
memory/3284-23-0x0000000008BC0000-0x0000000008CC0000-memory.dmp
memory/3284-20-0x0000000005CC0000-0x0000000005CD0000-memory.dmp
memory/3284-21-0x0000000008BC0000-0x0000000008CC0000-memory.dmp
memory/3284-22-0x0000000005CC0000-0x0000000005CD0000-memory.dmp
memory/3284-19-0x0000000005CC0000-0x0000000005CD0000-memory.dmp
memory/3284-17-0x0000000005CC0000-0x0000000005CD0000-memory.dmp
memory/3284-29-0x0000000005CC0000-0x0000000005CD0000-memory.dmp
memory/3284-26-0x0000000005CC0000-0x0000000005CD0000-memory.dmp
memory/3284-18-0x0000000005CC0000-0x0000000005CD0000-memory.dmp
memory/4612-28-0x0000000005440000-0x00000000054D2000-memory.dmp
memory/4612-25-0x0000000000400000-0x00000000004D2000-memory.dmp
memory/4612-27-0x0000000075000000-0x00000000757B0000-memory.dmp