Analysis
- max time kernel
144s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
05/02/2024, 05:14
General
- Target 9120ce3b64b1eea0eccc343744f4e8ff3bdc88b8a79743e07a975c6c313789ee.exe
- Size 1.4MB
- Sample240205-fw642abdh3
- SHA256 9120ce3b64b1eea0eccc343744f4e8ff3bdc88b8a79743e07a975c6c313789ee
Malware Config
Signatures
- SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- SectopRAT payload 1 IoCs
- Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 2 IoCs
- Executes dropped EXE 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Enumerates processes with tasklist 1 TTPs 2 IoCs
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 36 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SendNotifyMessage 3 IoCs
- Suspicious use of WriteProcessMemory 47 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\9120ce3b64b1eea0eccc343744f4e8ff3bdc88b8a79743e07a975c6c313789ee.exe"C:\Users\Admin\AppData\Local\Temp\9120ce3b64b1eea0eccc343744f4e8ff3bdc88b8a79743e07a975c6c313789ee.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k cmd < Trunk & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\findstr.exefindstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"5⤵
-
-
C:\Windows\SysWOW64\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\findstr.exefindstr /I "wrsa.exe"5⤵
-
-
C:\Windows\SysWOW64\cmd.execmd /c mkdir 144545⤵
-
-
C:\Windows\SysWOW64\cmd.execmd /c copy /b Probe + Catalog + Beach + Representations + Reads 14454\Driver.pif5⤵
-
-
C:\Windows\SysWOW64\cmd.execmd /c copy /b Emerging + Printable + Review + Greek 14454\Z5⤵
-
-
C:\Windows\SysWOW64\PING.EXEping -n 5 localhost5⤵
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\14454\Driver.pif14454\Driver.pif 14454\Z5⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c schtasks.exe /create /tn "Tions" /tr "wscript 'C:\Users\Admin\AppData\Local\HydroSync Innovations Ltd\HydroFlow.js'" /sc minute /mo 3 /F2⤵
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\SysWOW64\cmd.execmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HydroFlow.url" & echo URL="C:\Users\Admin\AppData\Local\HydroSync Innovations Ltd\HydroFlow.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HydroFlow.url" & exit2⤵
- Drops startup file
-
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\14454\jsc.exeC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\14454\jsc.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /create /tn "Tions" /tr "wscript 'C:\Users\Admin\AppData\Local\HydroSync Innovations Ltd\HydroFlow.js'" /sc minute /mo 3 /F1⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Driver.pif
Z
jsc.exe
Beach
Catalog
Emerging
Greek
Printable
Probe
Reads
Representations
Review
Trunk
tmpA829.tmp
tmpA84B.tmp
memory/2180-43-0x0000000000F70000-0x0000000000F71000-memory.dmp
memory/2988-48-0x00000000732A0000-0x0000000073A50000-memory.dmp
memory/2988-55-0x0000000006FD0000-0x00000000074FC000-memory.dmp
memory/2988-50-0x0000000005B90000-0x0000000005BA0000-memory.dmp
memory/2988-51-0x0000000005D70000-0x0000000005F32000-memory.dmp
memory/2988-52-0x00000000064F0000-0x0000000006A94000-memory.dmp
memory/2988-53-0x0000000005A90000-0x0000000005AE0000-memory.dmp
memory/2988-54-0x0000000005C20000-0x0000000005C96000-memory.dmp
memory/2988-49-0x00000000059A0000-0x0000000005A32000-memory.dmp
memory/2988-56-0x0000000006160000-0x000000000617E000-memory.dmp
memory/2988-57-0x0000000006370000-0x00000000063D6000-memory.dmp
memory/2988-79-0x0000000006080000-0x00000000060BC000-memory.dmp
memory/2988-45-0x0000000001300000-0x00000000013D4000-memory.dmp
memory/2988-76-0x00000000732A0000-0x0000000073A50000-memory.dmp
memory/2988-77-0x0000000005B90000-0x0000000005BA0000-memory.dmp
memory/2988-78-0x0000000005BC0000-0x0000000005BD2000-memory.dmp
memory/3916-0-0x0000000077CF1000-0x0000000077E11000-memory.dmp