sectoprat | 906623a415b6de1164c7798d3743a5fc06ca0ccc58ca76c8b35ef0a674991608

Analysis

max time kernel
297s
max time network
302s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
02-02-2024 04:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

906623a415b6de1164c7798d3743a5fc06ca0ccc58ca76c8b35ef0a674991608.exe
Size

3.7MB
MD5

eca96e3eb1fe44265acc31373a1dadb9
SHA1

3221c9a9d13cc4b0ae24b7d2cc807f18feb3ea4f
SHA256

906623a415b6de1164c7798d3743a5fc06ca0ccc58ca76c8b35ef0a674991608
SHA512

ce2829831d5e5bc8783dc1d871957184f48504bd2aa741456dab29dbdac72b1ad1c110964232655cae67992283dadfc96f46417bacb700b1bd55ba4b6494a6a1
SSDEEP

98304:lbPH543INzdx/9yiXGBwmcFBcBL+PRao/Szic:lb/5cUxllGBgFamYF

Score

10^/10

sectoprat rat trojan

Malware Config

Signatures

Detects Arechclient2 RAT 5 IoCs

Arechclient2.

resource	yara_rule
behavioral1/memory/2728-31-0x0000000000400000-0x00000000004D4000-memory.dmp	MALWARE_Win_Arechclient
behavioral1/memory/2728-33-0x0000000000400000-0x00000000004D4000-memory.dmp	MALWARE_Win_Arechclient
behavioral1/memory/2728-29-0x0000000000400000-0x00000000004D4000-memory.dmp	MALWARE_Win_Arechclient
behavioral1/memory/2728-26-0x0000000000400000-0x00000000004D4000-memory.dmp	MALWARE_Win_Arechclient
behavioral1/memory/2728-25-0x0000000000400000-0x00000000004D4000-memory.dmp	MALWARE_Win_Arechclient

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 5 IoCs

resource	yara_rule
behavioral1/memory/2728-31-0x0000000000400000-0x00000000004D4000-memory.dmp	family_sectoprat
behavioral1/memory/2728-33-0x0000000000400000-0x00000000004D4000-memory.dmp	family_sectoprat
behavioral1/memory/2728-29-0x0000000000400000-0x00000000004D4000-memory.dmp	family_sectoprat
behavioral1/memory/2728-26-0x0000000000400000-0x00000000004D4000-memory.dmp	family_sectoprat
behavioral1/memory/2728-25-0x0000000000400000-0x00000000004D4000-memory.dmp	family_sectoprat

Loads dropped DLL 1 IoCs

pid	Process
2032	906623a415b6de1164c7798d3743a5fc06ca0ccc58ca76c8b35ef0a674991608.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2032 set thread context of 2728	2032	906623a415b6de1164c7798d3743a5fc06ca0ccc58ca76c8b35ef0a674991608.exe	28

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2032	906623a415b6de1164c7798d3743a5fc06ca0ccc58ca76c8b35ef0a674991608.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2728	InstallUtil.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 2728	2032	906623a415b6de1164c7798d3743a5fc06ca0ccc58ca76c8b35ef0a674991608.exe	28
PID 2032 wrote to memory of 2728	2032	906623a415b6de1164c7798d3743a5fc06ca0ccc58ca76c8b35ef0a674991608.exe	28
PID 2032 wrote to memory of 2728	2032	906623a415b6de1164c7798d3743a5fc06ca0ccc58ca76c8b35ef0a674991608.exe	28
PID 2032 wrote to memory of 2728	2032	906623a415b6de1164c7798d3743a5fc06ca0ccc58ca76c8b35ef0a674991608.exe	28
PID 2032 wrote to memory of 2728	2032	906623a415b6de1164c7798d3743a5fc06ca0ccc58ca76c8b35ef0a674991608.exe	28
PID 2032 wrote to memory of 2728	2032	906623a415b6de1164c7798d3743a5fc06ca0ccc58ca76c8b35ef0a674991608.exe	28
PID 2032 wrote to memory of 2728	2032	906623a415b6de1164c7798d3743a5fc06ca0ccc58ca76c8b35ef0a674991608.exe	28
PID 2032 wrote to memory of 2728	2032	906623a415b6de1164c7798d3743a5fc06ca0ccc58ca76c8b35ef0a674991608.exe	28
PID 2032 wrote to memory of 2728	2032	906623a415b6de1164c7798d3743a5fc06ca0ccc58ca76c8b35ef0a674991608.exe	28
PID 2032 wrote to memory of 2728	2032	906623a415b6de1164c7798d3743a5fc06ca0ccc58ca76c8b35ef0a674991608.exe	28
PID 2032 wrote to memory of 2728	2032	906623a415b6de1164c7798d3743a5fc06ca0ccc58ca76c8b35ef0a674991608.exe	28
PID 2032 wrote to memory of 2728	2032	906623a415b6de1164c7798d3743a5fc06ca0ccc58ca76c8b35ef0a674991608.exe	28

C:\Users\Admin\AppData\Local\Temp\906623a415b6de1164c7798d3743a5fc06ca0ccc58ca76c8b35ef0a674991608.exe
"C:\Users\Admin\AppData\Local\Temp\906623a415b6de1164c7798d3743a5fc06ca0ccc58ca76c8b35ef0a674991608.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2728

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpE66B.tmp

Filesize
20KB

MD5
c9ff7748d8fcef4cf84a5501e996a641

SHA1
02867e5010f62f97ebb0cfb32cb3ede9449fe0c9

SHA256
4d3f3194cb1133437aa69bb880c8cbb55ddf06ff61a88ca6c3f1bbfbfd35d988

SHA512
d36054499869a8f56ac8547ccd5455f1252c24e17d2b185955390b32da7e2a732ace4e0f30f9493fcc61425a2e31ed623465f998f41af69423ee0e3ed1483a73

Download Submit
\Users\Admin\AppData\Local\Temp\Protect544cd51a.dll

Filesize
122KB

MD5
9df8603048bf2e560ffe3405ccd472a5

SHA1
b025aa9707587b3ee98df2f6ca55979ba7afa180

SHA256
3ec94f7e35a135152f966f249e565456e2e72042d82f476a3cba081f101fc9b6

SHA512
689dc7ab72695e8b303d7ffc9935bc9eb50ea6fa0a9ee37402fe22ec660bacc985ffecc05a124023aa43579399b90663426667e4b1e60a23cd5f79c00b354a88

Download Submit
memory/2032-48-0x0000000002300000-0x0000000002340000-memory.dmp

Filesize
256KB

Download
memory/2032-51-0x0000000002300000-0x0000000002340000-memory.dmp

Filesize
256KB

Download
memory/2032-4-0x00000000057F0000-0x0000000005A5A000-memory.dmp

Filesize
2.4MB

Download
memory/2032-5-0x0000000006A60000-0x0000000006BF2000-memory.dmp

Filesize
1.6MB

Download
memory/2032-2-0x0000000074D70000-0x000000007545E000-memory.dmp

Filesize
6.9MB

Download
memory/2032-12-0x0000000002300000-0x0000000002340000-memory.dmp

Filesize
256KB

Download
memory/2032-57-0x0000000000A10000-0x0000000000A11000-memory.dmp

Filesize
4KB

Download
memory/2032-17-0x0000000002300000-0x0000000002340000-memory.dmp

Filesize
256KB

Download
memory/2032-16-0x0000000002300000-0x0000000002340000-memory.dmp

Filesize
256KB

Download
memory/2032-15-0x0000000002300000-0x0000000002340000-memory.dmp

Filesize
256KB

Download
memory/2032-13-0x0000000002300000-0x0000000002340000-memory.dmp

Filesize
256KB

Download
memory/2032-11-0x0000000002300000-0x0000000002340000-memory.dmp

Filesize
256KB

Download
memory/2032-20-0x0000000002300000-0x0000000002340000-memory.dmp

Filesize
256KB

Download
memory/2032-19-0x0000000002300000-0x0000000002340000-memory.dmp

Filesize
256KB

Download
memory/2032-18-0x0000000006ED0000-0x0000000006FD0000-memory.dmp

Filesize
1024KB

Download
memory/2032-56-0x0000000002300000-0x0000000002340000-memory.dmp

Filesize
256KB

Download
memory/2032-54-0x0000000002300000-0x0000000002340000-memory.dmp

Filesize
256KB

Download
memory/2032-50-0x0000000002300000-0x0000000002340000-memory.dmp

Filesize
256KB

Download
memory/2032-14-0x0000000000510000-0x0000000000520000-memory.dmp

Filesize
64KB

Download
memory/2032-3-0x0000000002300000-0x0000000002340000-memory.dmp

Filesize
256KB

Download
memory/2032-53-0x0000000006ED0000-0x0000000006FD0000-memory.dmp

Filesize
1024KB

Download
memory/2032-52-0x0000000002300000-0x0000000002340000-memory.dmp

Filesize
256KB

Download
memory/2032-35-0x0000000000A10000-0x0000000000A11000-memory.dmp

Filesize
4KB

Download
memory/2032-49-0x0000000002300000-0x0000000002340000-memory.dmp

Filesize
256KB

Download
memory/2032-46-0x0000000002300000-0x0000000002340000-memory.dmp

Filesize
256KB

Download
memory/2032-10-0x0000000002300000-0x0000000002340000-memory.dmp

Filesize
256KB

Download
memory/2032-0-0x0000000000A20000-0x0000000000DE4000-memory.dmp

Filesize
3.8MB

Download
memory/2032-45-0x0000000002300000-0x0000000002340000-memory.dmp

Filesize
256KB

Download
memory/2032-1-0x0000000074D70000-0x000000007545E000-memory.dmp

Filesize
6.9MB

Download
memory/2032-47-0x0000000002300000-0x0000000002340000-memory.dmp

Filesize
256KB

Download
memory/2728-21-0x0000000000400000-0x00000000004D4000-memory.dmp

Filesize
848KB

Download
memory/2728-25-0x0000000000400000-0x00000000004D4000-memory.dmp

Filesize
848KB

Download
memory/2728-34-0x0000000074D70000-0x000000007545E000-memory.dmp

Filesize
6.9MB

Download
memory/2728-33-0x0000000000400000-0x00000000004D4000-memory.dmp

Filesize
848KB

Download
memory/2728-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2728-26-0x0000000000400000-0x00000000004D4000-memory.dmp

Filesize
848KB

Download
memory/2728-31-0x0000000000400000-0x00000000004D4000-memory.dmp

Filesize
848KB

Download
memory/2728-55-0x0000000074D70000-0x000000007545E000-memory.dmp

Filesize
6.9MB

Download
memory/2728-23-0x0000000000400000-0x00000000004D4000-memory.dmp

Filesize
848KB

Download
memory/2728-29-0x0000000000400000-0x00000000004D4000-memory.dmp

Filesize
848KB

Download