Analysis

  • max time kernel
    141s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    06-02-2024 09:56

General

  • Target

    946d57e17f85b6556069ab908af48b7e.exe

  • Size

    1.9MB

  • MD5

    946d57e17f85b6556069ab908af48b7e

  • SHA1

    30524c2b14a80070ddfaa937731c3814a3b6201e

  • SHA256

    7b265d7cc88fdf7c6d99ea21e3bc57c01e421f83a720da383fe7ae825fd958b0

  • SHA512

    3e720cb0536e3b3eda121fe1d63f5469888d90dfed999d760085d7c30e0a3d8dec50b9b9ee65506c922d63257480251a385c7910cfa19e90ea104195fb6079a2

  • SSDEEP

    24576:KOdEoHSpRdr3pOXi/eruVXKwGwICm6M7LfT+3sKpE1ICrjuzH+ByDYLN61s6DdBr:KOHy1UXlSglzXHf0sx1HkesDYiL09dm

Malware Config

Signatures

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 1 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer 1 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\946d57e17f85b6556069ab908af48b7e.exe
    "C:\Users\Admin\AppData\Local\Temp\946d57e17f85b6556069ab908af48b7e.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:284

Network

MITRE ATT&CK Matrix ATT&CK v13

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Discovery

Query Registry

2
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

2
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/284-0-0x0000000001040000-0x0000000001698000-memory.dmp
    Filesize

    6.3MB

  • memory/284-2-0x0000000075A20000-0x0000000075B30000-memory.dmp
    Filesize

    1.1MB

  • memory/284-5-0x0000000075A20000-0x0000000075B30000-memory.dmp
    Filesize

    1.1MB

  • memory/284-6-0x0000000075A20000-0x0000000075B30000-memory.dmp
    Filesize

    1.1MB

  • memory/284-8-0x0000000075A20000-0x0000000075B30000-memory.dmp
    Filesize

    1.1MB

  • memory/284-9-0x0000000075A20000-0x0000000075B30000-memory.dmp
    Filesize

    1.1MB

  • memory/284-13-0x0000000075A20000-0x0000000075B30000-memory.dmp
    Filesize

    1.1MB

  • memory/284-15-0x0000000075A20000-0x0000000075B30000-memory.dmp
    Filesize

    1.1MB

  • memory/284-16-0x0000000075A20000-0x0000000075B30000-memory.dmp
    Filesize

    1.1MB

  • memory/284-17-0x0000000075A20000-0x0000000075B30000-memory.dmp
    Filesize

    1.1MB

  • memory/284-18-0x0000000075A20000-0x0000000075B30000-memory.dmp
    Filesize

    1.1MB

  • memory/284-19-0x0000000077AB0000-0x0000000077AB2000-memory.dmp
    Filesize

    8KB

  • memory/284-10-0x0000000075A20000-0x0000000075B30000-memory.dmp
    Filesize

    1.1MB

  • memory/284-7-0x0000000075C60000-0x0000000075CA7000-memory.dmp
    Filesize

    284KB

  • memory/284-4-0x0000000075A20000-0x0000000075B30000-memory.dmp
    Filesize

    1.1MB

  • memory/284-3-0x0000000075C60000-0x0000000075CA7000-memory.dmp
    Filesize

    284KB

  • memory/284-1-0x0000000075A20000-0x0000000075B30000-memory.dmp
    Filesize

    1.1MB

  • memory/284-20-0x0000000074AC0000-0x00000000751AE000-memory.dmp
    Filesize

    6.9MB

  • memory/284-21-0x0000000001040000-0x0000000001698000-memory.dmp
    Filesize

    6.3MB

  • memory/284-22-0x0000000000390000-0x00000000003D0000-memory.dmp
    Filesize

    256KB

  • memory/284-25-0x0000000075C60000-0x0000000075CA7000-memory.dmp
    Filesize

    284KB

  • memory/284-24-0x0000000001040000-0x0000000001698000-memory.dmp
    Filesize

    6.3MB

  • memory/284-27-0x0000000075A20000-0x0000000075B30000-memory.dmp
    Filesize

    1.1MB

  • memory/284-28-0x0000000075A20000-0x0000000075B30000-memory.dmp
    Filesize

    1.1MB

  • memory/284-26-0x0000000075A20000-0x0000000075B30000-memory.dmp
    Filesize

    1.1MB

  • memory/284-30-0x0000000074AC0000-0x00000000751AE000-memory.dmp
    Filesize

    6.9MB

  • memory/284-31-0x0000000000390000-0x00000000003D0000-memory.dmp
    Filesize

    256KB