Analysis

  • max time kernel
    297s
  • max time network
    302s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    02-02-2024 04:54

General

  • Target

    906623a415b6de1164c7798d3743a5fc06ca0ccc58ca76c8b35ef0a674991608.exe

  • Size

    3.7MB

  • MD5

    eca96e3eb1fe44265acc31373a1dadb9

  • SHA1

    3221c9a9d13cc4b0ae24b7d2cc807f18feb3ea4f

  • SHA256

    906623a415b6de1164c7798d3743a5fc06ca0ccc58ca76c8b35ef0a674991608

  • SHA512

    ce2829831d5e5bc8783dc1d871957184f48504bd2aa741456dab29dbdac72b1ad1c110964232655cae67992283dadfc96f46417bacb700b1bd55ba4b6494a6a1

  • SSDEEP

    98304:lbPH543INzdx/9yiXGBwmcFBcBL+PRao/Szic:lb/5cUxllGBgFamYF

Score
10/10

Malware Config

Signatures

  • Detects Arechclient2 RAT 5 IoCs

    Arechclient2.

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 5 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\906623a415b6de1164c7798d3743a5fc06ca0ccc58ca76c8b35ef0a674991608.exe
    "C:\Users\Admin\AppData\Local\Temp\906623a415b6de1164c7798d3743a5fc06ca0ccc58ca76c8b35ef0a674991608.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:2032
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2728

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmpE66B.tmp

    Filesize

    20KB

    MD5

    c9ff7748d8fcef4cf84a5501e996a641

    SHA1

    02867e5010f62f97ebb0cfb32cb3ede9449fe0c9

    SHA256

    4d3f3194cb1133437aa69bb880c8cbb55ddf06ff61a88ca6c3f1bbfbfd35d988

    SHA512

    d36054499869a8f56ac8547ccd5455f1252c24e17d2b185955390b32da7e2a732ace4e0f30f9493fcc61425a2e31ed623465f998f41af69423ee0e3ed1483a73

  • \Users\Admin\AppData\Local\Temp\Protect544cd51a.dll

    Filesize

    122KB

    MD5

    9df8603048bf2e560ffe3405ccd472a5

    SHA1

    b025aa9707587b3ee98df2f6ca55979ba7afa180

    SHA256

    3ec94f7e35a135152f966f249e565456e2e72042d82f476a3cba081f101fc9b6

    SHA512

    689dc7ab72695e8b303d7ffc9935bc9eb50ea6fa0a9ee37402fe22ec660bacc985ffecc05a124023aa43579399b90663426667e4b1e60a23cd5f79c00b354a88

  • memory/2032-48-0x0000000002300000-0x0000000002340000-memory.dmp

    Filesize

    256KB

  • memory/2032-51-0x0000000002300000-0x0000000002340000-memory.dmp

    Filesize

    256KB

  • memory/2032-4-0x00000000057F0000-0x0000000005A5A000-memory.dmp

    Filesize

    2.4MB

  • memory/2032-5-0x0000000006A60000-0x0000000006BF2000-memory.dmp

    Filesize

    1.6MB

  • memory/2032-2-0x0000000074D70000-0x000000007545E000-memory.dmp

    Filesize

    6.9MB

  • memory/2032-12-0x0000000002300000-0x0000000002340000-memory.dmp

    Filesize

    256KB

  • memory/2032-57-0x0000000000A10000-0x0000000000A11000-memory.dmp

    Filesize

    4KB

  • memory/2032-17-0x0000000002300000-0x0000000002340000-memory.dmp

    Filesize

    256KB

  • memory/2032-16-0x0000000002300000-0x0000000002340000-memory.dmp

    Filesize

    256KB

  • memory/2032-15-0x0000000002300000-0x0000000002340000-memory.dmp

    Filesize

    256KB

  • memory/2032-13-0x0000000002300000-0x0000000002340000-memory.dmp

    Filesize

    256KB

  • memory/2032-11-0x0000000002300000-0x0000000002340000-memory.dmp

    Filesize

    256KB

  • memory/2032-20-0x0000000002300000-0x0000000002340000-memory.dmp

    Filesize

    256KB

  • memory/2032-19-0x0000000002300000-0x0000000002340000-memory.dmp

    Filesize

    256KB

  • memory/2032-18-0x0000000006ED0000-0x0000000006FD0000-memory.dmp

    Filesize

    1024KB

  • memory/2032-56-0x0000000002300000-0x0000000002340000-memory.dmp

    Filesize

    256KB

  • memory/2032-54-0x0000000002300000-0x0000000002340000-memory.dmp

    Filesize

    256KB

  • memory/2032-50-0x0000000002300000-0x0000000002340000-memory.dmp

    Filesize

    256KB

  • memory/2032-14-0x0000000000510000-0x0000000000520000-memory.dmp

    Filesize

    64KB

  • memory/2032-3-0x0000000002300000-0x0000000002340000-memory.dmp

    Filesize

    256KB

  • memory/2032-53-0x0000000006ED0000-0x0000000006FD0000-memory.dmp

    Filesize

    1024KB

  • memory/2032-52-0x0000000002300000-0x0000000002340000-memory.dmp

    Filesize

    256KB

  • memory/2032-35-0x0000000000A10000-0x0000000000A11000-memory.dmp

    Filesize

    4KB

  • memory/2032-49-0x0000000002300000-0x0000000002340000-memory.dmp

    Filesize

    256KB

  • memory/2032-46-0x0000000002300000-0x0000000002340000-memory.dmp

    Filesize

    256KB

  • memory/2032-10-0x0000000002300000-0x0000000002340000-memory.dmp

    Filesize

    256KB

  • memory/2032-0-0x0000000000A20000-0x0000000000DE4000-memory.dmp

    Filesize

    3.8MB

  • memory/2032-45-0x0000000002300000-0x0000000002340000-memory.dmp

    Filesize

    256KB

  • memory/2032-1-0x0000000074D70000-0x000000007545E000-memory.dmp

    Filesize

    6.9MB

  • memory/2032-47-0x0000000002300000-0x0000000002340000-memory.dmp

    Filesize

    256KB

  • memory/2728-21-0x0000000000400000-0x00000000004D4000-memory.dmp

    Filesize

    848KB

  • memory/2728-25-0x0000000000400000-0x00000000004D4000-memory.dmp

    Filesize

    848KB

  • memory/2728-34-0x0000000074D70000-0x000000007545E000-memory.dmp

    Filesize

    6.9MB

  • memory/2728-33-0x0000000000400000-0x00000000004D4000-memory.dmp

    Filesize

    848KB

  • memory/2728-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2728-26-0x0000000000400000-0x00000000004D4000-memory.dmp

    Filesize

    848KB

  • memory/2728-31-0x0000000000400000-0x00000000004D4000-memory.dmp

    Filesize

    848KB

  • memory/2728-55-0x0000000074D70000-0x000000007545E000-memory.dmp

    Filesize

    6.9MB

  • memory/2728-23-0x0000000000400000-0x00000000004D4000-memory.dmp

    Filesize

    848KB

  • memory/2728-29-0x0000000000400000-0x00000000004D4000-memory.dmp

    Filesize

    848KB