Analysis
- max time kernel
256s - max time network
299s - platform
windows10-1703_x64 - resource
win10-20231215-en - resource tags
- submitted
01/02/2024, 04:48
General
- Target 235d78cfb4c8c030df218d8417f37f9b540db6993f9c6bb103f49d98f00e4650.exe
- Size 6.2MB
- Sample240201-fe6f6sbeg4
- SHA256 235d78cfb4c8c030df218d8417f37f9b540db6993f9c6bb103f49d98f00e4650
Malware Config
Signatures
- Detects Arechclient2 RAT 1 IoCs
Arechclient2.
- SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- SectopRAT payload 1 IoCs
- Loads dropped DLL 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\235d78cfb4c8c030df218d8417f37f9b540db6993f9c6bb103f49d98f00e4650.exe"C:\Users\Admin\AppData\Local\Temp\235d78cfb4c8c030df218d8417f37f9b540db6993f9c6bb103f49d98f00e4650.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove -ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Courses_for_professional_development';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Courses_for_professional_development' -Value '"C:\Users\Admin\AppData\Local\Courses_for_professional_development\Courses_for_professional_development.exe"' -PropertyType 'String'2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_gwwrju3b.l0h.ps1
Protect544cd51a.dll
memory/3572-22-0x0000000000400000-0x00000000004D4000-memory.dmp
memory/3572-298-0x00000000732A0000-0x000000007398E000-memory.dmp
memory/3572-299-0x00000000051A0000-0x00000000051B0000-memory.dmp
memory/3572-36-0x00000000050F0000-0x0000000005140000-memory.dmp
memory/3572-33-0x0000000005380000-0x0000000005542000-memory.dmp
memory/3572-26-0x0000000005050000-0x00000000050E2000-memory.dmp
memory/3572-28-0x00000000051A0000-0x00000000051B0000-memory.dmp
memory/3572-24-0x00000000732A0000-0x000000007398E000-memory.dmp
memory/3908-62-0x0000000008F40000-0x0000000008F73000-memory.dmp
memory/3908-63-0x00000000709D0000-0x0000000070A1B000-memory.dmp
memory/3908-297-0x00000000732A0000-0x000000007398E000-memory.dmp
memory/3908-287-0x0000000009340000-0x0000000009362000-memory.dmp
memory/3908-286-0x00000000092F0000-0x000000000930A000-memory.dmp
memory/3908-269-0x00000000091F0000-0x00000000091F8000-memory.dmp
memory/3908-264-0x0000000009200000-0x000000000921A000-memory.dmp
memory/3908-71-0x0000000009250000-0x00000000092E4000-memory.dmp
memory/3908-70-0x0000000004450000-0x0000000004460000-memory.dmp
memory/3908-69-0x0000000009080000-0x0000000009125000-memory.dmp
memory/3908-64-0x0000000008F20000-0x0000000008F3E000-memory.dmp
memory/3908-45-0x0000000007E60000-0x0000000007ED6000-memory.dmp
memory/3908-44-0x0000000007BC0000-0x0000000007C0B000-memory.dmp
memory/3908-43-0x0000000007620000-0x000000000763C000-memory.dmp
memory/3908-34-0x00000000732A0000-0x000000007398E000-memory.dmp
memory/3908-35-0x0000000004450000-0x0000000004460000-memory.dmp
memory/3908-42-0x00000000077B0000-0x0000000007B00000-memory.dmp
memory/3908-38-0x0000000006E00000-0x0000000007428000-memory.dmp
memory/3908-37-0x0000000004450000-0x0000000004460000-memory.dmp
memory/3908-39-0x0000000006DD0000-0x0000000006DF2000-memory.dmp
memory/3908-32-0x0000000004380000-0x00000000043B6000-memory.dmp
memory/3908-40-0x0000000007680000-0x00000000076E6000-memory.dmp
memory/3908-41-0x00000000076F0000-0x0000000007756000-memory.dmp
memory/4776-16-0x00000000052A0000-0x00000000052B0000-memory.dmp
memory/4776-19-0x0000000006F10000-0x0000000007010000-memory.dmp
memory/4776-6-0x00000000058D0000-0x0000000005A62000-memory.dmp
memory/4776-23-0x0000000007510000-0x0000000007A0E000-memory.dmp
memory/4776-14-0x00000000051B0000-0x00000000051C0000-memory.dmp
memory/4776-3-0x00000000732A0000-0x000000007398E000-memory.dmp
memory/4776-0-0x00000000732A0000-0x000000007398E000-memory.dmp
memory/4776-13-0x00000000051B0000-0x00000000051C0000-memory.dmp
memory/4776-5-0x00000000054C0000-0x00000000057C8000-memory.dmp
memory/4776-4-0x00000000051B0000-0x00000000051C0000-memory.dmp
memory/4776-30-0x00000000732A0000-0x000000007398E000-memory.dmp
memory/4776-21-0x0000000006F10000-0x0000000007010000-memory.dmp
memory/4776-12-0x00000000051B0000-0x00000000051C0000-memory.dmp
memory/4776-20-0x0000000006F10000-0x0000000007010000-memory.dmp
memory/4776-17-0x00000000051B0000-0x00000000051C0000-memory.dmp
memory/4776-18-0x00000000051B0000-0x00000000051C0000-memory.dmp
memory/4776-15-0x00000000051B0000-0x00000000051C0000-memory.dmp
memory/4776-2-0x00000000051C0000-0x000000000525C000-memory.dmp
memory/4776-1-0x0000000000310000-0x000000000094C000-memory.dmp