Analysis
-
max time kernel
297s -
max time network
302s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
02-02-2024 04:54
Static task
static1
Behavioral task
behavioral1
Sample
906623a415b6de1164c7798d3743a5fc06ca0ccc58ca76c8b35ef0a674991608.exe
Resource
win7-20231215-en
General
-
Target
906623a415b6de1164c7798d3743a5fc06ca0ccc58ca76c8b35ef0a674991608.exe
-
Size
3.7MB
-
MD5
eca96e3eb1fe44265acc31373a1dadb9
-
SHA1
3221c9a9d13cc4b0ae24b7d2cc807f18feb3ea4f
-
SHA256
906623a415b6de1164c7798d3743a5fc06ca0ccc58ca76c8b35ef0a674991608
-
SHA512
ce2829831d5e5bc8783dc1d871957184f48504bd2aa741456dab29dbdac72b1ad1c110964232655cae67992283dadfc96f46417bacb700b1bd55ba4b6494a6a1
-
SSDEEP
98304:lbPH543INzdx/9yiXGBwmcFBcBL+PRao/Szic:lb/5cUxllGBgFamYF
Malware Config
Signatures
-
Detects Arechclient2 RAT 5 IoCs
Arechclient2.
resource yara_rule behavioral1/memory/2728-31-0x0000000000400000-0x00000000004D4000-memory.dmp MALWARE_Win_Arechclient behavioral1/memory/2728-33-0x0000000000400000-0x00000000004D4000-memory.dmp MALWARE_Win_Arechclient behavioral1/memory/2728-29-0x0000000000400000-0x00000000004D4000-memory.dmp MALWARE_Win_Arechclient behavioral1/memory/2728-26-0x0000000000400000-0x00000000004D4000-memory.dmp MALWARE_Win_Arechclient behavioral1/memory/2728-25-0x0000000000400000-0x00000000004D4000-memory.dmp MALWARE_Win_Arechclient -
SectopRAT payload 5 IoCs
resource yara_rule behavioral1/memory/2728-31-0x0000000000400000-0x00000000004D4000-memory.dmp family_sectoprat behavioral1/memory/2728-33-0x0000000000400000-0x00000000004D4000-memory.dmp family_sectoprat behavioral1/memory/2728-29-0x0000000000400000-0x00000000004D4000-memory.dmp family_sectoprat behavioral1/memory/2728-26-0x0000000000400000-0x00000000004D4000-memory.dmp family_sectoprat behavioral1/memory/2728-25-0x0000000000400000-0x00000000004D4000-memory.dmp family_sectoprat -
Loads dropped DLL 1 IoCs
pid Process 2032 906623a415b6de1164c7798d3743a5fc06ca0ccc58ca76c8b35ef0a674991608.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2032 set thread context of 2728 2032 906623a415b6de1164c7798d3743a5fc06ca0ccc58ca76c8b35ef0a674991608.exe 28 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2032 906623a415b6de1164c7798d3743a5fc06ca0ccc58ca76c8b35ef0a674991608.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2728 InstallUtil.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2032 wrote to memory of 2728 2032 906623a415b6de1164c7798d3743a5fc06ca0ccc58ca76c8b35ef0a674991608.exe 28 PID 2032 wrote to memory of 2728 2032 906623a415b6de1164c7798d3743a5fc06ca0ccc58ca76c8b35ef0a674991608.exe 28 PID 2032 wrote to memory of 2728 2032 906623a415b6de1164c7798d3743a5fc06ca0ccc58ca76c8b35ef0a674991608.exe 28 PID 2032 wrote to memory of 2728 2032 906623a415b6de1164c7798d3743a5fc06ca0ccc58ca76c8b35ef0a674991608.exe 28 PID 2032 wrote to memory of 2728 2032 906623a415b6de1164c7798d3743a5fc06ca0ccc58ca76c8b35ef0a674991608.exe 28 PID 2032 wrote to memory of 2728 2032 906623a415b6de1164c7798d3743a5fc06ca0ccc58ca76c8b35ef0a674991608.exe 28 PID 2032 wrote to memory of 2728 2032 906623a415b6de1164c7798d3743a5fc06ca0ccc58ca76c8b35ef0a674991608.exe 28 PID 2032 wrote to memory of 2728 2032 906623a415b6de1164c7798d3743a5fc06ca0ccc58ca76c8b35ef0a674991608.exe 28 PID 2032 wrote to memory of 2728 2032 906623a415b6de1164c7798d3743a5fc06ca0ccc58ca76c8b35ef0a674991608.exe 28 PID 2032 wrote to memory of 2728 2032 906623a415b6de1164c7798d3743a5fc06ca0ccc58ca76c8b35ef0a674991608.exe 28 PID 2032 wrote to memory of 2728 2032 906623a415b6de1164c7798d3743a5fc06ca0ccc58ca76c8b35ef0a674991608.exe 28 PID 2032 wrote to memory of 2728 2032 906623a415b6de1164c7798d3743a5fc06ca0ccc58ca76c8b35ef0a674991608.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\906623a415b6de1164c7798d3743a5fc06ca0ccc58ca76c8b35ef0a674991608.exe"C:\Users\Admin\AppData\Local\Temp\906623a415b6de1164c7798d3743a5fc06ca0ccc58ca76c8b35ef0a674991608.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2728
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20KB
MD5c9ff7748d8fcef4cf84a5501e996a641
SHA102867e5010f62f97ebb0cfb32cb3ede9449fe0c9
SHA2564d3f3194cb1133437aa69bb880c8cbb55ddf06ff61a88ca6c3f1bbfbfd35d988
SHA512d36054499869a8f56ac8547ccd5455f1252c24e17d2b185955390b32da7e2a732ace4e0f30f9493fcc61425a2e31ed623465f998f41af69423ee0e3ed1483a73
-
Filesize
122KB
MD59df8603048bf2e560ffe3405ccd472a5
SHA1b025aa9707587b3ee98df2f6ca55979ba7afa180
SHA2563ec94f7e35a135152f966f249e565456e2e72042d82f476a3cba081f101fc9b6
SHA512689dc7ab72695e8b303d7ffc9935bc9eb50ea6fa0a9ee37402fe22ec660bacc985ffecc05a124023aa43579399b90663426667e4b1e60a23cd5f79c00b354a88