Analysis
- max time kernel
139s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
- submitted
30/01/2024, 10:51
General
- Target 81a6bfaaad389aa059b0b1f59a7018f6.exe
- Size 3.9MB
- Sample240130-mxt97aede6
- SHA256 fdc232f395a64331881a5ef09b607da91c0a2cce0b0ebced9aaf94e3a57ceff2
Malware Config
Signatures
- SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- SectopRAT payload 1 IoCs
- Loads dropped DLL 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\81a6bfaaad389aa059b0b1f59a7018f6.exe"C:\Users\Admin\AppData\Local\Temp\81a6bfaaad389aa059b0b1f59a7018f6.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove -ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Muscular_corset_exercises_with_reminders';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Muscular_corset_exercises_with_reminders' -Value '"C:\Users\Admin\AppData\Local\Muscular_corset_exercises_with_reminders\Muscular_corset_exercises_with_reminders.exe"' -PropertyType 'String'2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1840 -s 5842⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1840 -ip 18401⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Protect544cd51a.dll
__PSScriptPolicyTest_htwurv5g.rry.ps1
tmpC4AA.tmp
tmpC4CC.tmp
memory/400-48-0x00000000065B0000-0x0000000006ADC000-memory.dmp
memory/400-50-0x0000000005810000-0x000000000582E000-memory.dmp
memory/400-22-0x0000000000400000-0x00000000004D4000-memory.dmp
memory/400-100-0x0000000074AA0000-0x0000000075250000-memory.dmp
memory/400-101-0x0000000005170000-0x0000000005180000-memory.dmp
memory/400-35-0x0000000005290000-0x0000000005306000-memory.dmp
memory/400-30-0x0000000005180000-0x00000000051D0000-memory.dmp
memory/400-28-0x0000000005350000-0x0000000005512000-memory.dmp
memory/400-26-0x0000000074AA0000-0x0000000075250000-memory.dmp
memory/400-23-0x0000000005040000-0x00000000050D2000-memory.dmp
memory/1840-15-0x0000000002B60000-0x0000000002B70000-memory.dmp
memory/1840-5-0x00000000056D0000-0x000000000593A000-memory.dmp
memory/1840-1-0x0000000000450000-0x000000000083A000-memory.dmp
memory/1840-17-0x00000000052F0000-0x0000000005300000-memory.dmp
memory/1840-24-0x0000000008790000-0x0000000008D34000-memory.dmp
memory/1840-20-0x0000000006E80000-0x0000000006F80000-memory.dmp
memory/1840-19-0x0000000006E80000-0x0000000006F80000-memory.dmp
memory/1840-18-0x00000000052F0000-0x0000000005300000-memory.dmp
memory/1840-0-0x0000000074AA0000-0x0000000075250000-memory.dmp
memory/1840-16-0x00000000052F0000-0x0000000005300000-memory.dmp
memory/1840-2-0x0000000005210000-0x00000000052AC000-memory.dmp
memory/1840-3-0x0000000074AA0000-0x0000000075250000-memory.dmp
memory/1840-12-0x00000000052F0000-0x0000000005300000-memory.dmp
memory/1840-4-0x00000000052F0000-0x0000000005300000-memory.dmp
memory/1840-36-0x00000000052F0000-0x0000000005300000-memory.dmp
memory/1840-13-0x00000000052F0000-0x0000000005300000-memory.dmp
memory/1840-53-0x0000000074AA0000-0x0000000075250000-memory.dmp
memory/1840-14-0x00000000052F0000-0x0000000005300000-memory.dmp
memory/1840-21-0x0000000006E80000-0x0000000006F80000-memory.dmp
memory/1840-6-0x0000000006A70000-0x0000000006C02000-memory.dmp
memory/3880-51-0x0000000006260000-0x000000000627E000-memory.dmp
memory/3880-74-0x000000006FE00000-0x000000006FE4C000-memory.dmp
memory/3880-37-0x0000000005AE0000-0x0000000005B46000-memory.dmp
memory/3880-43-0x0000000005BC0000-0x0000000005C26000-memory.dmp
memory/3880-52-0x00000000062A0000-0x00000000062EC000-memory.dmp
memory/3880-34-0x0000000004CD0000-0x0000000004CE0000-memory.dmp
memory/3880-33-0x0000000005A40000-0x0000000005A62000-memory.dmp
memory/3880-32-0x0000000074AA0000-0x0000000075250000-memory.dmp
memory/3880-72-0x000000007F9A0000-0x000000007F9B0000-memory.dmp
memory/3880-73-0x0000000006850000-0x0000000006882000-memory.dmp
memory/3880-85-0x0000000004CD0000-0x0000000004CE0000-memory.dmp
memory/3880-86-0x0000000007270000-0x0000000007313000-memory.dmp
memory/3880-84-0x0000000006810000-0x000000000682E000-memory.dmp
memory/3880-49-0x0000000005D30000-0x0000000006084000-memory.dmp
memory/3880-88-0x0000000007590000-0x00000000075AA000-memory.dmp
memory/3880-87-0x0000000007BD0000-0x000000000824A000-memory.dmp
memory/3880-89-0x0000000007600000-0x000000000760A000-memory.dmp
memory/3880-90-0x0000000007810000-0x00000000078A6000-memory.dmp
memory/3880-91-0x0000000007790000-0x00000000077A1000-memory.dmp
memory/3880-92-0x00000000077C0000-0x00000000077CE000-memory.dmp
memory/3880-95-0x00000000078B0000-0x00000000078B8000-memory.dmp
memory/3880-94-0x00000000078D0000-0x00000000078EA000-memory.dmp
memory/3880-93-0x00000000077D0000-0x00000000077E4000-memory.dmp
memory/3880-96-0x00000000078F0000-0x0000000007912000-memory.dmp
memory/3880-99-0x0000000074AA0000-0x0000000075250000-memory.dmp
memory/3880-31-0x0000000005310000-0x0000000005938000-memory.dmp
memory/3880-29-0x0000000004C70000-0x0000000004CA6000-memory.dmp