sectoprat | cb594bd784302897900baee81937316663a309e8f25c9eef277f4b4f1bf3e49b

General

Target

8c7f03aec42e0af336c8135879fb75b5.exe
Size

6.0MB
MD5

8c7f03aec42e0af336c8135879fb75b5
SHA1

7f9e58da7146fa15bd7ca94f5f2fbd012ea7f513
SHA256

cb594bd784302897900baee81937316663a309e8f25c9eef277f4b4f1bf3e49b
SHA512

6ddb7ce26c1996340e6ab4096f86f5bac1da8f91289960b2a5c60951c5eb9583ca6108ebdfbd2fe1c48b76caeefde32a71f7c8493bdc340c7c31a3005c7ca057
SSDEEP

98304:c5H/8LpHLaTamavMG2fDCXO/ErtIUKI011MzhCxjb1ljcZhqAOrIEVA6JEpnT:cORaVeX+ZI2MA1bTjmh/OrxV/JaT

Score

10^/10

sectoprat evasion rat themida trojan

Malware Config

Signatures

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 2 IoCs

resource	yara_rule
behavioral1/memory/2028-15-0x0000000001280000-0x000000000221E000-memory.dmp	family_sectoprat
behavioral1/memory/2028-16-0x0000000001280000-0x000000000221E000-memory.dmp	family_sectoprat

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	8c7f03aec42e0af336c8135879fb75b5.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	8c7f03aec42e0af336c8135879fb75b5.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	8c7f03aec42e0af336c8135879fb75b5.exe

Themida packer 2 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/2028-15-0x0000000001280000-0x000000000221E000-memory.dmp	themida
behavioral1/memory/2028-16-0x0000000001280000-0x000000000221E000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	8c7f03aec42e0af336c8135879fb75b5.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2028	8c7f03aec42e0af336c8135879fb75b5.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2028	8c7f03aec42e0af336c8135879fb75b5.exe

C:\Users\Admin\AppData\Local\Temp\8c7f03aec42e0af336c8135879fb75b5.exe
"C:\Users\Admin\AppData\Local\Temp\8c7f03aec42e0af336c8135879fb75b5.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:2028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2028-0-0x0000000001280000-0x000000000221E000-memory.dmp

Filesize
15.6MB

Download
memory/2028-1-0x0000000077300000-0x0000000077410000-memory.dmp

Filesize
1.1MB

Download
memory/2028-2-0x0000000077080000-0x00000000770C7000-memory.dmp

Filesize
284KB

Download
memory/2028-3-0x0000000077300000-0x0000000077410000-memory.dmp

Filesize
1.1MB

Download
memory/2028-5-0x0000000077300000-0x0000000077410000-memory.dmp

Filesize
1.1MB

Download
memory/2028-7-0x0000000077300000-0x0000000077410000-memory.dmp

Filesize
1.1MB

Download
memory/2028-10-0x0000000077080000-0x00000000770C7000-memory.dmp

Filesize
284KB

Download
memory/2028-9-0x0000000077300000-0x0000000077410000-memory.dmp

Filesize
1.1MB

Download
memory/2028-12-0x0000000077080000-0x00000000770C7000-memory.dmp

Filesize
284KB

Download
memory/2028-11-0x0000000077300000-0x0000000077410000-memory.dmp

Filesize
1.1MB

Download
memory/2028-13-0x0000000077820000-0x0000000077822000-memory.dmp

Filesize
8KB

Download
memory/2028-14-0x0000000074620000-0x0000000074D0E000-memory.dmp

Filesize
6.9MB

Download
memory/2028-15-0x0000000001280000-0x000000000221E000-memory.dmp

Filesize
15.6MB

Download
memory/2028-16-0x0000000001280000-0x000000000221E000-memory.dmp

Filesize
15.6MB

Download
memory/2028-17-0x0000000005C00000-0x0000000005C40000-memory.dmp

Filesize
256KB

Download
memory/2028-19-0x0000000001280000-0x000000000221E000-memory.dmp

Filesize
15.6MB

Download
memory/2028-20-0x0000000077080000-0x00000000770C7000-memory.dmp

Filesize
284KB

Download
memory/2028-21-0x0000000077300000-0x0000000077410000-memory.dmp

Filesize
1.1MB

Download
memory/2028-22-0x0000000077300000-0x0000000077410000-memory.dmp

Filesize
1.1MB

Download
memory/2028-23-0x0000000077300000-0x0000000077410000-memory.dmp

Filesize
1.1MB

Download
memory/2028-24-0x0000000077300000-0x0000000077410000-memory.dmp

Filesize
1.1MB

Download
memory/2028-25-0x0000000077300000-0x0000000077410000-memory.dmp

Filesize
1.1MB

Download
memory/2028-26-0x0000000077300000-0x0000000077410000-memory.dmp

Filesize
1.1MB

Download
memory/2028-28-0x0000000074620000-0x0000000074D0E000-memory.dmp

Filesize
6.9MB

Download
memory/2028-29-0x0000000005C00000-0x0000000005C40000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads