Analysis
-
max time kernel
133s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
29-04-2024 08:31
Behavioral task
behavioral1
Sample
2d8c1cae9f4d8aeb07e4780ab7c21297.exe
Resource
win7-20240221-en
8 signatures
150 seconds
General
-
Target
2d8c1cae9f4d8aeb07e4780ab7c21297.exe
-
Size
767KB
-
MD5
2d8c1cae9f4d8aeb07e4780ab7c21297
-
SHA1
711521bd838deb1aac2d2abd72f8ed899fc0cca3
-
SHA256
4ff41d9b16384fb388eaf0d8dc5142dc65f209fd779f407fd0dfe0df286812d2
-
SHA512
f533b2ef4c5b61c8b30b3bf1b69bdca01b122ad26461b8e1aa5f78a03faea89c883c23a7779e25d6d6b4f01ea4141838724a24e715d41e5b5323902cb02a2e56
-
SSDEEP
12288:aiMA0ejRLfxLY8flLb1MgX6WbkAsFWylkkoAbtESP4srX:qeDxttL66kAsFlSj4
Malware Config
Signatures
-
SectopRAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4924-0-0x0000000000D50000-0x0000000000E16000-memory.dmp family_sectoprat -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
2d8c1cae9f4d8aeb07e4780ab7c21297.exedescription pid process Token: SeDebugPrivilege 4924 2d8c1cae9f4d8aeb07e4780ab7c21297.exe