Analysis
- max time kernel
133s - max time network
138s - platform
windows7_x64 - resource
win7-20231215-en - resource tags
- submitted
30/01/2024, 10:51
General
- Target 81a6bfaaad389aa059b0b1f59a7018f6.exe
- Size 3.9MB
- Sample240130-mxt97aede6
- SHA256 fdc232f395a64331881a5ef09b607da91c0a2cce0b0ebced9aaf94e3a57ceff2
Malware Config
Signatures
- SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- SectopRAT payload 5 IoCs
- Loads dropped DLL 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 16 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\81a6bfaaad389aa059b0b1f59a7018f6.exe"C:\Users\Admin\AppData\Local\Temp\81a6bfaaad389aa059b0b1f59a7018f6.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 7282⤵
- Program crash
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
tmp1F55.tmp
Protect544cd51a.dll
memory/1888-46-0x0000000004C70000-0x0000000004CB0000-memory.dmp
memory/1888-1-0x00000000743A0000-0x0000000074A8E000-memory.dmp
memory/1888-4-0x00000000056F0000-0x000000000595A000-memory.dmp
memory/1888-5-0x0000000006960000-0x0000000006AF2000-memory.dmp
memory/1888-2-0x00000000743A0000-0x0000000074A8E000-memory.dmp
memory/1888-10-0x0000000004C70000-0x0000000004CB0000-memory.dmp
memory/1888-11-0x0000000004C70000-0x0000000004CB0000-memory.dmp
memory/1888-12-0x0000000004C70000-0x0000000004CB0000-memory.dmp
memory/1888-13-0x0000000000520000-0x0000000000530000-memory.dmp
memory/1888-14-0x0000000004C70000-0x0000000004CB0000-memory.dmp
memory/1888-15-0x0000000004C70000-0x0000000004CB0000-memory.dmp
memory/1888-16-0x0000000004C70000-0x0000000004CB0000-memory.dmp
memory/1888-17-0x0000000006D70000-0x0000000006E70000-memory.dmp
memory/1888-18-0x0000000004C70000-0x0000000004CB0000-memory.dmp
memory/1888-19-0x0000000004C70000-0x0000000004CB0000-memory.dmp
memory/1888-54-0x0000000004C70000-0x0000000004CB0000-memory.dmp
memory/1888-53-0x0000000004C70000-0x0000000004CB0000-memory.dmp
memory/1888-52-0x0000000006D70000-0x0000000006E70000-memory.dmp
memory/1888-3-0x0000000004C70000-0x0000000004CB0000-memory.dmp
memory/1888-51-0x0000000004C70000-0x0000000004CB0000-memory.dmp
memory/1888-50-0x0000000004C70000-0x0000000004CB0000-memory.dmp
memory/1888-49-0x0000000004C70000-0x0000000004CB0000-memory.dmp
memory/1888-48-0x0000000004C70000-0x0000000004CB0000-memory.dmp
memory/1888-47-0x0000000004C70000-0x0000000004CB0000-memory.dmp
memory/1888-45-0x0000000004C70000-0x0000000004CB0000-memory.dmp
memory/1888-0-0x0000000001080000-0x000000000146A000-memory.dmp
memory/1888-44-0x0000000004C70000-0x0000000004CB0000-memory.dmp
memory/2156-34-0x0000000001EC0000-0x0000000001F00000-memory.dmp
memory/2156-25-0x0000000000400000-0x00000000004D4000-memory.dmp
memory/2156-28-0x0000000000400000-0x00000000004D4000-memory.dmp
memory/2156-32-0x0000000000400000-0x00000000004D4000-memory.dmp
memory/2156-30-0x0000000000400000-0x00000000004D4000-memory.dmp
memory/2156-33-0x00000000743A0000-0x0000000074A8E000-memory.dmp
memory/2156-22-0x0000000000400000-0x00000000004D4000-memory.dmp
memory/2156-24-0x0000000000400000-0x00000000004D4000-memory.dmp
memory/2156-26-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/2156-20-0x0000000000400000-0x00000000004D4000-memory.dmp
memory/2156-55-0x00000000743A0000-0x0000000074A8E000-memory.dmp
memory/2156-56-0x0000000001EC0000-0x0000000001F00000-memory.dmp