Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29-04-2024 08:31
Behavioral task
behavioral1
Sample
2d8c1cae9f4d8aeb07e4780ab7c21297.exe
Resource
win7-20240221-en
General
-
Target
2d8c1cae9f4d8aeb07e4780ab7c21297.exe
-
Size
767KB
-
MD5
2d8c1cae9f4d8aeb07e4780ab7c21297
-
SHA1
711521bd838deb1aac2d2abd72f8ed899fc0cca3
-
SHA256
4ff41d9b16384fb388eaf0d8dc5142dc65f209fd779f407fd0dfe0df286812d2
-
SHA512
f533b2ef4c5b61c8b30b3bf1b69bdca01b122ad26461b8e1aa5f78a03faea89c883c23a7779e25d6d6b4f01ea4141838724a24e715d41e5b5323902cb02a2e56
-
SSDEEP
12288:aiMA0ejRLfxLY8flLb1MgX6WbkAsFWylkkoAbtESP4srX:qeDxttL66kAsFlSj4
Malware Config
Signatures
-
SectopRAT payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1300-0-0x0000000000C20000-0x0000000000CE6000-memory.dmp family_sectoprat -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
2d8c1cae9f4d8aeb07e4780ab7c21297.exedescription pid process Token: SeDebugPrivilege 1300 2d8c1cae9f4d8aeb07e4780ab7c21297.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20KB
MD5c9ff7748d8fcef4cf84a5501e996a641
SHA102867e5010f62f97ebb0cfb32cb3ede9449fe0c9
SHA2564d3f3194cb1133437aa69bb880c8cbb55ddf06ff61a88ca6c3f1bbfbfd35d988
SHA512d36054499869a8f56ac8547ccd5455f1252c24e17d2b185955390b32da7e2a732ace4e0f30f9493fcc61425a2e31ed623465f998f41af69423ee0e3ed1483a73