Analysis
-
max time kernel
141s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
06-02-2024 09:56
Behavioral task
behavioral1
Sample
946d57e17f85b6556069ab908af48b7e.exe
Resource
win7-20231215-en
General
-
Target
946d57e17f85b6556069ab908af48b7e.exe
-
Size
1.9MB
-
MD5
946d57e17f85b6556069ab908af48b7e
-
SHA1
30524c2b14a80070ddfaa937731c3814a3b6201e
-
SHA256
7b265d7cc88fdf7c6d99ea21e3bc57c01e421f83a720da383fe7ae825fd958b0
-
SHA512
3e720cb0536e3b3eda121fe1d63f5469888d90dfed999d760085d7c30e0a3d8dec50b9b9ee65506c922d63257480251a385c7910cfa19e90ea104195fb6079a2
-
SSDEEP
24576:KOdEoHSpRdr3pOXi/eruVXKwGwICm6M7LfT+3sKpE1ICrjuzH+ByDYLN61s6DdBr:KOHy1UXlSglzXHf0sx1HkesDYiL09dm
Malware Config
Signatures
-
SectopRAT payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/284-21-0x0000000001040000-0x0000000001698000-memory.dmp family_sectoprat -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
946d57e17f85b6556069ab908af48b7e.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 946d57e17f85b6556069ab908af48b7e.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
946d57e17f85b6556069ab908af48b7e.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 946d57e17f85b6556069ab908af48b7e.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 946d57e17f85b6556069ab908af48b7e.exe -
Processes:
resource yara_rule behavioral1/memory/284-21-0x0000000001040000-0x0000000001698000-memory.dmp themida -
Processes:
946d57e17f85b6556069ab908af48b7e.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 946d57e17f85b6556069ab908af48b7e.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
946d57e17f85b6556069ab908af48b7e.exepid process 284 946d57e17f85b6556069ab908af48b7e.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
946d57e17f85b6556069ab908af48b7e.exepid process 284 946d57e17f85b6556069ab908af48b7e.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
946d57e17f85b6556069ab908af48b7e.exedescription pid process Token: SeDebugPrivilege 284 946d57e17f85b6556069ab908af48b7e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\946d57e17f85b6556069ab908af48b7e.exe"C:\Users\Admin\AppData\Local\Temp\946d57e17f85b6556069ab908af48b7e.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/284-0-0x0000000001040000-0x0000000001698000-memory.dmpFilesize
6.3MB
-
memory/284-2-0x0000000075A20000-0x0000000075B30000-memory.dmpFilesize
1.1MB
-
memory/284-5-0x0000000075A20000-0x0000000075B30000-memory.dmpFilesize
1.1MB
-
memory/284-6-0x0000000075A20000-0x0000000075B30000-memory.dmpFilesize
1.1MB
-
memory/284-8-0x0000000075A20000-0x0000000075B30000-memory.dmpFilesize
1.1MB
-
memory/284-9-0x0000000075A20000-0x0000000075B30000-memory.dmpFilesize
1.1MB
-
memory/284-13-0x0000000075A20000-0x0000000075B30000-memory.dmpFilesize
1.1MB
-
memory/284-15-0x0000000075A20000-0x0000000075B30000-memory.dmpFilesize
1.1MB
-
memory/284-16-0x0000000075A20000-0x0000000075B30000-memory.dmpFilesize
1.1MB
-
memory/284-17-0x0000000075A20000-0x0000000075B30000-memory.dmpFilesize
1.1MB
-
memory/284-18-0x0000000075A20000-0x0000000075B30000-memory.dmpFilesize
1.1MB
-
memory/284-19-0x0000000077AB0000-0x0000000077AB2000-memory.dmpFilesize
8KB
-
memory/284-10-0x0000000075A20000-0x0000000075B30000-memory.dmpFilesize
1.1MB
-
memory/284-7-0x0000000075C60000-0x0000000075CA7000-memory.dmpFilesize
284KB
-
memory/284-4-0x0000000075A20000-0x0000000075B30000-memory.dmpFilesize
1.1MB
-
memory/284-3-0x0000000075C60000-0x0000000075CA7000-memory.dmpFilesize
284KB
-
memory/284-1-0x0000000075A20000-0x0000000075B30000-memory.dmpFilesize
1.1MB
-
memory/284-20-0x0000000074AC0000-0x00000000751AE000-memory.dmpFilesize
6.9MB
-
memory/284-21-0x0000000001040000-0x0000000001698000-memory.dmpFilesize
6.3MB
-
memory/284-22-0x0000000000390000-0x00000000003D0000-memory.dmpFilesize
256KB
-
memory/284-25-0x0000000075C60000-0x0000000075CA7000-memory.dmpFilesize
284KB
-
memory/284-24-0x0000000001040000-0x0000000001698000-memory.dmpFilesize
6.3MB
-
memory/284-27-0x0000000075A20000-0x0000000075B30000-memory.dmpFilesize
1.1MB
-
memory/284-28-0x0000000075A20000-0x0000000075B30000-memory.dmpFilesize
1.1MB
-
memory/284-26-0x0000000075A20000-0x0000000075B30000-memory.dmpFilesize
1.1MB
-
memory/284-30-0x0000000074AC0000-0x00000000751AE000-memory.dmpFilesize
6.9MB
-
memory/284-31-0x0000000000390000-0x00000000003D0000-memory.dmpFilesize
256KB