sectoprat | 3a45c34fcd2c22c52eaf7b11e1b76b6895043f1c714d0674e0666493d39e55e8

General

Target

3a45c34fcd2c22c52eaf7b11e1b76b6895043f1c714d0674e0666493d39e55e8.exe
Size

5.7MB
MD5

0a8cc5c964c43f0ed0170ead67c4602d
SHA1

1048b45bb59628ead5cffab099f217f422c25c9a
SHA256

3a45c34fcd2c22c52eaf7b11e1b76b6895043f1c714d0674e0666493d39e55e8
SHA512

100f1ab123172a09ebe232a4e22dbcda66294df9259c18da7fabee2c072ef8489a9ad473c47ca48ca7d712249f3b09ce44508fe16e4ff0e23b0a47dd34b92daa
SSDEEP

98304:WeQvusTfg5ngazFFo6gy4ve6ZkD81Jo12b5DwqFapmkv:WeKdTfglgazFFofy4v1MEipqIj

Score

10^/10

sectoprat zgrat rat trojan

Malware Config

Signatures

Detect ZGRat V1 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/804-0-0x0000000000340000-0x00000000008EE000-memory.dmp	family_zgrat_v1

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2736-24-0x0000000000400000-0x00000000004D4000-memory.dmp	family_sectoprat
behavioral1/memory/2736-34-0x0000000000400000-0x00000000004D4000-memory.dmp	family_sectoprat
behavioral1/memory/2736-32-0x0000000000400000-0x00000000004D4000-memory.dmp	family_sectoprat
behavioral1/memory/2736-30-0x0000000000400000-0x00000000004D4000-memory.dmp	family_sectoprat
behavioral1/memory/2736-26-0x0000000000400000-0x00000000004D4000-memory.dmp	family_sectoprat

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Loads dropped DLL 1 IoCs

Processes:

3a45c34fcd2c22c52eaf7b11e1b76b6895043f1c714d0674e0666493d39e55e8.exe

pid process

804 3a45c34fcd2c22c52eaf7b11e1b76b6895043f1c714d0674e0666493d39e55e8.exe

pid	process
804	3a45c34fcd2c22c52eaf7b11e1b76b6895043f1c714d0674e0666493d39e55e8.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

3a45c34fcd2c22c52eaf7b11e1b76b6895043f1c714d0674e0666493d39e55e8.exe

description	pid	process	target process
PID 804 set thread context of 2736	804	3a45c34fcd2c22c52eaf7b11e1b76b6895043f1c714d0674e0666493d39e55e8.exe	InstallUtil.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3028 804 WerFault.exe 3a45c34fcd2c22c52eaf7b11e1b76b6895043f1c714d0674e0666493d39e55e8.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

InstallUtil.exe

description pid process

Token: SeDebugPrivilege 2736 InstallUtil.exe

pid	pid_target	process	target process
3028	804	WerFault.exe	3a45c34fcd2c22c52eaf7b11e1b76b6895043f1c714d0674e0666493d39e55e8.exe

description	pid	process
Token: SeDebugPrivilege	2736	InstallUtil.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

3a45c34fcd2c22c52eaf7b11e1b76b6895043f1c714d0674e0666493d39e55e8.exe

description	pid	process	target process
PID 804 wrote to memory of 2736	804	3a45c34fcd2c22c52eaf7b11e1b76b6895043f1c714d0674e0666493d39e55e8.exe	InstallUtil.exe
PID 804 wrote to memory of 2736	804	3a45c34fcd2c22c52eaf7b11e1b76b6895043f1c714d0674e0666493d39e55e8.exe	InstallUtil.exe
PID 804 wrote to memory of 2736	804	3a45c34fcd2c22c52eaf7b11e1b76b6895043f1c714d0674e0666493d39e55e8.exe	InstallUtil.exe
PID 804 wrote to memory of 2736	804	3a45c34fcd2c22c52eaf7b11e1b76b6895043f1c714d0674e0666493d39e55e8.exe	InstallUtil.exe
PID 804 wrote to memory of 2736	804	3a45c34fcd2c22c52eaf7b11e1b76b6895043f1c714d0674e0666493d39e55e8.exe	InstallUtil.exe
PID 804 wrote to memory of 2736	804	3a45c34fcd2c22c52eaf7b11e1b76b6895043f1c714d0674e0666493d39e55e8.exe	InstallUtil.exe
PID 804 wrote to memory of 2736	804	3a45c34fcd2c22c52eaf7b11e1b76b6895043f1c714d0674e0666493d39e55e8.exe	InstallUtil.exe
PID 804 wrote to memory of 2736	804	3a45c34fcd2c22c52eaf7b11e1b76b6895043f1c714d0674e0666493d39e55e8.exe	InstallUtil.exe
PID 804 wrote to memory of 2736	804	3a45c34fcd2c22c52eaf7b11e1b76b6895043f1c714d0674e0666493d39e55e8.exe	InstallUtil.exe
PID 804 wrote to memory of 2736	804	3a45c34fcd2c22c52eaf7b11e1b76b6895043f1c714d0674e0666493d39e55e8.exe	InstallUtil.exe
PID 804 wrote to memory of 2736	804	3a45c34fcd2c22c52eaf7b11e1b76b6895043f1c714d0674e0666493d39e55e8.exe	InstallUtil.exe
PID 804 wrote to memory of 2736	804	3a45c34fcd2c22c52eaf7b11e1b76b6895043f1c714d0674e0666493d39e55e8.exe	InstallUtil.exe
PID 804 wrote to memory of 3028	804	3a45c34fcd2c22c52eaf7b11e1b76b6895043f1c714d0674e0666493d39e55e8.exe	WerFault.exe
PID 804 wrote to memory of 3028	804	3a45c34fcd2c22c52eaf7b11e1b76b6895043f1c714d0674e0666493d39e55e8.exe	WerFault.exe
PID 804 wrote to memory of 3028	804	3a45c34fcd2c22c52eaf7b11e1b76b6895043f1c714d0674e0666493d39e55e8.exe	WerFault.exe
PID 804 wrote to memory of 3028	804	3a45c34fcd2c22c52eaf7b11e1b76b6895043f1c714d0674e0666493d39e55e8.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\3a45c34fcd2c22c52eaf7b11e1b76b6895043f1c714d0674e0666493d39e55e8.exe
"C:\Users\Admin\AppData\Local\Temp\3a45c34fcd2c22c52eaf7b11e1b76b6895043f1c714d0674e0666493d39e55e8.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:804
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2736
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 804 -s 744
  2⤵
  - Program crash
  PID:3028

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp8384.tmp

Filesize
20KB

MD5
c9ff7748d8fcef4cf84a5501e996a641

SHA1
02867e5010f62f97ebb0cfb32cb3ede9449fe0c9

SHA256
4d3f3194cb1133437aa69bb880c8cbb55ddf06ff61a88ca6c3f1bbfbfd35d988

SHA512
d36054499869a8f56ac8547ccd5455f1252c24e17d2b185955390b32da7e2a732ace4e0f30f9493fcc61425a2e31ed623465f998f41af69423ee0e3ed1483a73

Download Submit
\Users\Admin\AppData\Local\Temp\Protect544cd51a.dll

Filesize
742KB

MD5
544cd51a596619b78e9b54b70088307d

SHA1
4769ddd2dbc1dc44b758964ed0bd231b85880b65

SHA256
dfce2d4d06de6452998b3c5b2dc33eaa6db2bd37810d04e3d02dc931887cfddd

SHA512
f56d8b81022bb132d40aa78596da39b5c212d13b84b5c7d2c576bbf403924f1d22e750de3b09d1be30aea359f1b72c5043b19685fc9bf06d8040bfee16b17719

Download Submit
memory/804-45-0x0000000000EA0000-0x0000000000EE0000-memory.dmp

Filesize
256KB

Download
memory/804-5-0x0000000074BE0000-0x00000000752CE000-memory.dmp

Filesize
6.9MB

Download
memory/804-53-0x0000000000EA0000-0x0000000000EE0000-memory.dmp

Filesize
256KB

Download
memory/804-52-0x0000000000EA0000-0x0000000000EE0000-memory.dmp

Filesize
256KB

Download
memory/804-6-0x0000000000EA0000-0x0000000000EE0000-memory.dmp

Filesize
256KB

Download
memory/804-7-0x0000000005890000-0x0000000005A22000-memory.dmp

Filesize
1.6MB

Download
memory/804-2-0x0000000000970000-0x000000000098A000-memory.dmp

Filesize
104KB

Download
memory/804-12-0x0000000000EA0000-0x0000000000EE0000-memory.dmp

Filesize
256KB

Download
memory/804-14-0x0000000000EA0000-0x0000000000EE0000-memory.dmp

Filesize
256KB

Download
memory/804-13-0x0000000002420000-0x0000000002430000-memory.dmp

Filesize
64KB

Download
memory/804-17-0x0000000000EA0000-0x0000000000EE0000-memory.dmp

Filesize
256KB

Download
memory/804-18-0x0000000000EA0000-0x0000000000EE0000-memory.dmp

Filesize
256KB

Download
memory/804-16-0x0000000000EA0000-0x0000000000EE0000-memory.dmp

Filesize
256KB

Download
memory/804-15-0x0000000000EA0000-0x0000000000EE0000-memory.dmp

Filesize
256KB

Download
memory/804-19-0x0000000000EA0000-0x0000000000EE0000-memory.dmp

Filesize
256KB

Download
memory/804-51-0x0000000000EA0000-0x0000000000EE0000-memory.dmp

Filesize
256KB

Download
memory/804-4-0x0000000000C30000-0x0000000000C38000-memory.dmp

Filesize
32KB

Download
memory/804-50-0x0000000000EA0000-0x0000000000EE0000-memory.dmp

Filesize
256KB

Download
memory/804-3-0x0000000000EA0000-0x0000000000EE0000-memory.dmp

Filesize
256KB

Download
memory/804-49-0x0000000000EA0000-0x0000000000EE0000-memory.dmp

Filesize
256KB

Download
memory/804-48-0x0000000000EA0000-0x0000000000EE0000-memory.dmp

Filesize
256KB

Download
memory/804-47-0x0000000000EA0000-0x0000000000EE0000-memory.dmp

Filesize
256KB

Download
memory/804-46-0x0000000000EA0000-0x0000000000EE0000-memory.dmp

Filesize
256KB

Download
memory/804-1-0x0000000074BE0000-0x00000000752CE000-memory.dmp

Filesize
6.9MB

Download
memory/804-0-0x0000000000340000-0x00000000008EE000-memory.dmp

Filesize
5.7MB

Download
memory/2736-35-0x0000000074BE0000-0x00000000752CE000-memory.dmp

Filesize
6.9MB

Download
memory/2736-28-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2736-26-0x0000000000400000-0x00000000004D4000-memory.dmp

Filesize
848KB

Download
memory/2736-30-0x0000000000400000-0x00000000004D4000-memory.dmp

Filesize
848KB

Download
memory/2736-32-0x0000000000400000-0x00000000004D4000-memory.dmp

Filesize
848KB

Download
memory/2736-34-0x0000000000400000-0x00000000004D4000-memory.dmp

Filesize
848KB

Download
memory/2736-20-0x0000000000400000-0x00000000004D4000-memory.dmp

Filesize
848KB

Download
memory/2736-24-0x0000000000400000-0x00000000004D4000-memory.dmp

Filesize
848KB

Download
memory/2736-22-0x0000000000400000-0x00000000004D4000-memory.dmp

Filesize
848KB

Download
memory/2736-54-0x0000000074BE0000-0x00000000752CE000-memory.dmp

Filesize
6.9MB

Download
memory/2736-55-0x0000000004FC0000-0x0000000005000000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads