sectoprat | 0b1041617a0b6cb63b7746b8e431f3cfcec87200fea880b9e053a20116a31e78

Analysis

max time kernel
147s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
20-04-2024 15:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0b1041617a0b6cb63b7746b8e431f3cfcec87200fea880b9e053a20116a31e78.exe
Size

445KB
MD5

aa16a9a21d8d8f423f9660b1e98297ff
SHA1

bc943e191e5e6ade5b41f8ebadfda947587db7e1
SHA256

0b1041617a0b6cb63b7746b8e431f3cfcec87200fea880b9e053a20116a31e78
SHA512

15ee2f37f6f792a03bac5960fcd16121c153ea507ccb7fdf63f55893548729be6341cb1413f534a939ecfb7ee224cf2bd1dc7c582b6d020fc3c461c87180a319
SSDEEP

6144:Z9blLakMOxHYjN63y3Fz180hQk13xlBbyffsz34wf3XjQN5P:Z3LaTIHYjNKaFSg13Jbyffs8wPjQN5P

Score

10^/10

sectoprat stealc rat stealer trojan

Malware Config

Extracted

Family

stealc

http://185.172.128.209

Attributes

url_path
/3cd2b41cbde8fc9c.php

Signatures

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4208-114-0x0000000000900000-0x00000000009C6000-memory.dmp	family_sectoprat

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Downloads MZ/PE file
Executes dropped EXE 4 IoCs

Processes:

uxw.0.exeQg_Appv5.exeUniversalInstaller.exeUniversalInstaller.exe

pid process

4772 uxw.0.exe
2424 Qg_Appv5.exe
5012 UniversalInstaller.exe
1312 UniversalInstaller.exe
Loads dropped DLL 4 IoCs

Processes:

UniversalInstaller.exeUniversalInstaller.exe

pid process

5012 UniversalInstaller.exe
5012 UniversalInstaller.exe
1312 UniversalInstaller.exe
1312 UniversalInstaller.exe

pid	process
4772	uxw.0.exe
2424	Qg_Appv5.exe
5012	UniversalInstaller.exe
1312	UniversalInstaller.exe

pid	process
5012	UniversalInstaller.exe
5012	UniversalInstaller.exe
1312	UniversalInstaller.exe
1312	UniversalInstaller.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

UniversalInstaller.execmd.exe

description	pid	process	target process
PID 1312 set thread context of 2952	1312	UniversalInstaller.exe	cmd.exe
PID 2952 set thread context of 4208	2952	cmd.exe	MSBuild.exe

Drops file in Windows directory 1 IoCs

Processes:

cmd.exe

description ioc process

File created C:\Windows\Tasks\GS_Debug.job cmd.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2180 4772 WerFault.exe uxw.0.exe

description	ioc	process
File created	C:\Windows\Tasks\GS_Debug.job	cmd.exe

pid	pid_target	process	target process
2180	4772	WerFault.exe	uxw.0.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

Qg_Appv5.exeUniversalInstaller.exeUniversalInstaller.execmd.exe

pid	process
2424	Qg_Appv5.exe
2424	Qg_Appv5.exe
2424	Qg_Appv5.exe
2424	Qg_Appv5.exe
5012	UniversalInstaller.exe
1312	UniversalInstaller.exe
1312	UniversalInstaller.exe
2952	cmd.exe
2952	cmd.exe

Suspicious behavior: MapViewOfSection 3 IoCs

Processes:

UniversalInstaller.execmd.exe

pid process

1312 UniversalInstaller.exe
2952 cmd.exe
2952 cmd.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

MSBuild.exe

description pid process

Token: SeDebugPrivilege 4208 MSBuild.exe
Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

Qg_Appv5.exeUniversalInstaller.exeUniversalInstaller.exe

pid process

2424 Qg_Appv5.exe
5012 UniversalInstaller.exe
5012 UniversalInstaller.exe
1312 UniversalInstaller.exe
1312 UniversalInstaller.exe

pid	process
1312	UniversalInstaller.exe
2952	cmd.exe
2952	cmd.exe

description	pid	process
Token: SeDebugPrivilege	4208	MSBuild.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

0b1041617a0b6cb63b7746b8e431f3cfcec87200fea880b9e053a20116a31e78.exeQg_Appv5.exeUniversalInstaller.exeUniversalInstaller.execmd.exe

description	pid	process	target process
PID 1220 wrote to memory of 4772	1220	0b1041617a0b6cb63b7746b8e431f3cfcec87200fea880b9e053a20116a31e78.exe	uxw.0.exe
PID 1220 wrote to memory of 4772	1220	0b1041617a0b6cb63b7746b8e431f3cfcec87200fea880b9e053a20116a31e78.exe	uxw.0.exe
PID 1220 wrote to memory of 4772	1220	0b1041617a0b6cb63b7746b8e431f3cfcec87200fea880b9e053a20116a31e78.exe	uxw.0.exe
PID 1220 wrote to memory of 2424	1220	0b1041617a0b6cb63b7746b8e431f3cfcec87200fea880b9e053a20116a31e78.exe	Qg_Appv5.exe
PID 1220 wrote to memory of 2424	1220	0b1041617a0b6cb63b7746b8e431f3cfcec87200fea880b9e053a20116a31e78.exe	Qg_Appv5.exe
PID 2424 wrote to memory of 5012	2424	Qg_Appv5.exe	UniversalInstaller.exe
PID 2424 wrote to memory of 5012	2424	Qg_Appv5.exe	UniversalInstaller.exe
PID 2424 wrote to memory of 5012	2424	Qg_Appv5.exe	UniversalInstaller.exe
PID 5012 wrote to memory of 1312	5012	UniversalInstaller.exe	UniversalInstaller.exe
PID 5012 wrote to memory of 1312	5012	UniversalInstaller.exe	UniversalInstaller.exe
PID 5012 wrote to memory of 1312	5012	UniversalInstaller.exe	UniversalInstaller.exe
PID 1312 wrote to memory of 2952	1312	UniversalInstaller.exe	cmd.exe
PID 1312 wrote to memory of 2952	1312	UniversalInstaller.exe	cmd.exe
PID 1312 wrote to memory of 2952	1312	UniversalInstaller.exe	cmd.exe
PID 1312 wrote to memory of 2952	1312	UniversalInstaller.exe	cmd.exe
PID 2952 wrote to memory of 4208	2952	cmd.exe	MSBuild.exe
PID 2952 wrote to memory of 4208	2952	cmd.exe	MSBuild.exe
PID 2952 wrote to memory of 4208	2952	cmd.exe	MSBuild.exe
PID 2952 wrote to memory of 4208	2952	cmd.exe	MSBuild.exe
PID 2952 wrote to memory of 4208	2952	cmd.exe	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\0b1041617a0b6cb63b7746b8e431f3cfcec87200fea880b9e053a20116a31e78.exe
"C:\Users\Admin\AppData\Local\Temp\0b1041617a0b6cb63b7746b8e431f3cfcec87200fea880b9e053a20116a31e78.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Users\Admin\AppData\Local\Temp\uxw.0.exe
  "C:\Users\Admin\AppData\Local\Temp\uxw.0.exe"
  2⤵
  - Executes dropped EXE
  PID:4772
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 1236
    3⤵
    - Program crash
    PID:2180
- C:\Users\Admin\AppData\Local\Temp\Qg_Appv5.exe
  "C:\Users\Admin\AppData\Local\Temp\Qg_Appv5.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2424
- - C:\Users\Admin\AppData\Local\Temp\Zqicom_beta\UniversalInstaller.exe
    C:\Users\Admin\AppData\Local\Temp\Zqicom_beta\UniversalInstaller.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5012
  - - C:\Users\Admin\AppData\Roaming\Zqicom_beta\UniversalInstaller.exe
      C:\Users\Admin\AppData\Roaming\Zqicom_beta\UniversalInstaller.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1312
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\SysWOW64\cmd.exe
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:2952
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4772 -ip 4772
1⤵
PID:2124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Canon_Inc_IC\UniversalInstaller\ServiceLog\CANON_UIX_SERVICELOG_20240420151813.TXT

Filesize
455B

MD5
c74fa100f198e72213b201076d9b3cca

SHA1
abe348e262d596d779d7f42df7915cec687ad50b

SHA256
1cc5596cae02ba04a0f938e75ae3aa048a32fab2d55847c4c9e73ce4f3424e31

SHA512
4a2040a7de2a0465f445eca108e12049cef94f760defa238c407695922df707deaf488ed4e1b242fa108d34c52c86314d416e0e3ca74ac50d4801fff0ec5a37e

Download Submit
C:\Users\Admin\AppData\Local\Temp\2614930f

Filesize
5.9MB

MD5
dcc26dd014bad9eafa9066d3781b615d

SHA1
b0cb8621ca58a196ac73bed4e525deacfaf2d836

SHA256
69502ffc7e2b8946d420e682cd1421f58a17f489590f761c580ce2a4feb74ae3

SHA512
5a7804fdebe09aada86e327899fa7ce6830c26c426d398dd72ef68121c33e59c2572709a725f43d6f1d31c52e7b4ea10b2128d00d530a00ef9db9a8efef204e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\32e8fa1d

Filesize
1.4MB

MD5
fe63b343cfd03d87da30b68129388839

SHA1
0ff539c4ffbc65daf9ba4095ff17e7a55af0e433

SHA256
34fe07780a5661c7330e112d6c0103a817c627ea7e5b2c3cad213a83450e1dbc

SHA512
f4a99b1b03096cd236400db54d896f8570c1ef7cd4a26e85dac0b4b4f1b738a8ecd9016a43ae164f1096e7d6da3ea7ae089959f5771b4d04ac00cc711afce218

Download Submit
C:\Users\Admin\AppData\Local\Temp\Qg_Appv5.exe

Filesize
14.7MB

MD5
6955715b6ff15bdc153a2431cc395cca

SHA1
272e1eec66a1871b300484b2200b507a4abe5420

SHA256
a6d40169be9c151e9e6c86fe53d2bac3b4c2ddb41c0b650d961f8328939b4761

SHA512
cf82d27d7010be69ab1c288fef9d820905407c8018e2a91f3c39a0eda5e9378e0ff04d077520d556d46d7a9cb0a3a640d15a10ad4090e482be3c83930836019d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Zqicom_beta\UIxMarketPlugin.dll

Filesize
1.6MB

MD5
8f75e17a8bf3de6e22e77b5586f8a869

SHA1
e0bf196cfc19a8772e003b9058bdc211b419b261

SHA256
5f10a9fdcac32e93b1cebc365868ee3266f80c2734524b4aa7b6ea54e123f985

SHA512
5a1e78613ad90cb0dc855d8a935b136722749889b66d4d8fc0f52438f0a4f4c8c31fbb981e9c6a13ffb2cc2b77fe0747204b63a91c6fff4646eed915387c8d7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Zqicom_beta\UniversalInstaller.exe

Filesize
2.4MB

MD5
9fb4770ced09aae3b437c1c6eb6d7334

SHA1
fe54b31b0db8665aa5b22bed147e8295afc88a03

SHA256
a05b592a971fe5011554013bcfe9a4aaf9cfc633bdd1fe3a8197f213d557b8d3

SHA512
140fee6daf23fe8b7e441b3b4de83554af804f00ecedc421907a385ac79a63164bd9f28b4be061c2ea2262755d85e14d3a8e7dc910547837b664d78d93667256

Download Submit
C:\Users\Admin\AppData\Local\Temp\Zqicom_beta\relay.dll

Filesize
1.5MB

MD5
7d2f87123e63950159fb2c724e55bdab

SHA1
360f304a6311080e1fead8591cb4659a8d135f2d

SHA256
b3483bb771948ed8d3f76faaa3606c8ef72e3d2d355eaa652877e21e0651aa9a

SHA512
6cb8d27ebcfdf9e472c0a6fff86e6f4ec604b8f0f21c197ba6d5b76b703296c10c8d7c4fb6b082c7e77f5c35d364bcffd76ae54137e2c8944c1ea7bb9e2e5f08

Download Submit
C:\Users\Admin\AppData\Local\Temp\Zqicom_beta\somebody.rtf

Filesize
24KB

MD5
ff36ebcf134c8846aea77446867e5bc6

SHA1
53fdf2c0bec711e377edb4f97cd147728fb568f6

SHA256
e1c256e5a7f17cb64740223084009f37bddccc49b05e881133412057689b04e9

SHA512
b07d5065dd39843c8c7bdfccdd8d39f44b1ce9fe100a2fcf7210549ea1d46bcac54080cf91eff0a05360b26233c542daabdbd5d3f096a5bf0e366583ddb29ec1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Zqicom_beta\spawn.xml

Filesize
1.3MB

MD5
2d8de35aa00138b2bfc4fb0fc3d0f58b

SHA1
28c2d84e01815702c230da456aaa17c7d2519186

SHA256
19340e9202db71d8010563c8b8d325cbef5d8448a8df2ad730e74a5a46e36dac

SHA512
378116bc71de9f968aaef6ca27944e341a9a825a92831f5834c396160581f5e3656d3b6d1c2a304a65a74c0dd9ca0c50fb0e0016b6174d1fab68909ea1c95128

Download Submit
C:\Users\Admin\AppData\Local\Temp\uxw.0.exe

Filesize
301KB

MD5
1c1244c7ae1fa81c5c29f1e3d0004724

SHA1
8d83cc05f0a45a3cfd459c3150aa37b51fb0fddd

SHA256
740c1b4e39f54e7e6fb24575678786bfe92256cab9c92726cb0819501276c204

SHA512
6bd74eb189eae0ef5fda7b808516e93e4029fe6deddcf41b24917a3cdcc63f4a74eeecc591bc02023c2240dcefc3a469f98632cb7382cfea508af46d0315ed9d

Download Submit
memory/1220-22-0x0000000003890000-0x00000000038FE000-memory.dmp

Filesize
440KB

Download
memory/1220-20-0x0000000000400000-0x0000000001A3A000-memory.dmp

Filesize
22.2MB

Download
memory/1220-21-0x0000000001C70000-0x0000000001D70000-memory.dmp

Filesize
1024KB

Download
memory/1220-3-0x0000000000400000-0x0000000001A3A000-memory.dmp

Filesize
22.2MB

Download
memory/1220-1-0x0000000001C70000-0x0000000001D70000-memory.dmp

Filesize
1024KB

Download
memory/1220-2-0x0000000003890000-0x00000000038FE000-memory.dmp

Filesize
440KB

Download
memory/1220-94-0x0000000000400000-0x0000000001A3A000-memory.dmp

Filesize
22.2MB

Download
memory/1312-89-0x0000000072E90000-0x000000007300D000-memory.dmp

Filesize
1.5MB

Download
memory/1312-90-0x00007FFD66040000-0x00007FFD66249000-memory.dmp

Filesize
2.0MB

Download
memory/1312-91-0x0000000072E90000-0x000000007300D000-memory.dmp

Filesize
1.5MB

Download
memory/1312-95-0x0000000072E90000-0x000000007300D000-memory.dmp

Filesize
1.5MB

Download
memory/2424-45-0x0000000000D50000-0x0000000001C2D000-memory.dmp

Filesize
14.9MB

Download
memory/2424-62-0x00007FFD56900000-0x00007FFD56A7A000-memory.dmp

Filesize
1.5MB

Download
memory/2424-92-0x00007FFD56900000-0x00007FFD56A7A000-memory.dmp

Filesize
1.5MB

Download
memory/2424-53-0x00007FFD56900000-0x00007FFD56A7A000-memory.dmp

Filesize
1.5MB

Download
memory/2424-51-0x00007FFD56900000-0x00007FFD56A7A000-memory.dmp

Filesize
1.5MB

Download
memory/2424-44-0x00000250B1C00000-0x00000250B1C01000-memory.dmp

Filesize
4KB

Download
memory/2952-100-0x0000000072E90000-0x000000007300D000-memory.dmp

Filesize
1.5MB

Download
memory/2952-107-0x0000000072E90000-0x000000007300D000-memory.dmp

Filesize
1.5MB

Download
memory/2952-108-0x0000000072E90000-0x000000007300D000-memory.dmp

Filesize
1.5MB

Download
memory/2952-101-0x0000000072E90000-0x000000007300D000-memory.dmp

Filesize
1.5MB

Download
memory/2952-99-0x00007FFD66040000-0x00007FFD66249000-memory.dmp

Filesize
2.0MB

Download
memory/2952-97-0x0000000072E90000-0x000000007300D000-memory.dmp

Filesize
1.5MB

Download
memory/4208-117-0x0000000005570000-0x0000000005B16000-memory.dmp

Filesize
5.6MB

Download
memory/4208-118-0x0000000005080000-0x0000000005090000-memory.dmp

Filesize
64KB

Download
memory/4208-119-0x0000000005260000-0x0000000005422000-memory.dmp

Filesize
1.8MB

Download
memory/4208-116-0x0000000004F20000-0x0000000004FB2000-memory.dmp

Filesize
584KB

Download
memory/4208-115-0x0000000073660000-0x0000000073E11000-memory.dmp

Filesize
7.7MB

Download
memory/4208-120-0x0000000004FD0000-0x0000000005020000-memory.dmp

Filesize
320KB

Download
memory/4208-110-0x0000000071960000-0x0000000072C77000-memory.dmp

Filesize
19.1MB

Download
memory/4208-114-0x0000000000900000-0x00000000009C6000-memory.dmp

Filesize
792KB

Download
memory/4772-18-0x0000000003740000-0x0000000003767000-memory.dmp

Filesize
156KB

Download
memory/4772-19-0x0000000000400000-0x0000000001A16000-memory.dmp

Filesize
22.1MB

Download
memory/4772-17-0x0000000000400000-0x0000000001A16000-memory.dmp

Filesize
22.1MB

Download
memory/4772-16-0x0000000001AD0000-0x0000000001BD0000-memory.dmp

Filesize
1024KB

Download
memory/5012-73-0x00007FFD66040000-0x00007FFD66249000-memory.dmp

Filesize
2.0MB

Download
memory/5012-72-0x0000000072E90000-0x000000007300D000-memory.dmp

Filesize
1.5MB

Download