Malware Analysis Report

2024-09-11 08:43

Sample ID 240507-2lj3eabh9z
Target tungbot.exe
SHA256 52de83987941b92875cecdd1661cc2757eae4f02ef564fd2e147d06eb9d8ab44
Tags
redline sectoprat cheat evasion infostealer persistence rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

52de83987941b92875cecdd1661cc2757eae4f02ef564fd2e147d06eb9d8ab44

Threat Level: Known bad

The file tungbot.exe was found to be: Known bad.

Malicious Activity Summary

redline sectoprat cheat evasion infostealer persistence rat trojan

Sectoprat family

Modifies visiblity of hidden/system files in Explorer

SectopRAT

Redline family

SectopRAT payload

RedLine

RedLine payload

Executes dropped EXE

Adds Run key to start application

Drops file in System32 directory

Drops file in Windows directory

Unsigned PE

Program crash

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Privilege Escalation
TA0004
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Defense Evasion
TA0005
Hide Artifacts
T1564
Hidden Files and Directories
T1564.001
Modify Registry
T1112
Credential Access
TA0006
Discovery
TA0007
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-05-07 22:40

Signatures

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A

Redline family

redline

SectopRAT payload

Description Indicator Process Target
N/A N/A N/A N/A

Sectoprat family

sectoprat

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-07 22:40

Reported

2024-05-07 22:42

Platform

win10v2004-20240419-en

Max time kernel

105s

Max time network

101s

Command Line

"C:\Users\Admin\AppData\Local\Temp\tungbot.exe"

Signatures

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\resources\themes\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\resources\svchost.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

SectopRAT

trojan rat sectoprat

SectopRAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A \??\c:\users\admin\appdata\local\temp\tungbot.exe  N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A \??\c:\windows\resources\themes\explorer.exe N/A
N/A N/A \??\c:\windows\resources\spoolsv.exe N/A
N/A N/A \??\c:\windows\resources\svchost.exe N/A
N/A N/A \??\c:\windows\resources\spoolsv.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" \??\c:\windows\resources\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" \??\c:\windows\resources\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" \??\c:\windows\resources\themes\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" \??\c:\windows\resources\themes\explorer.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\explorer.exe \??\c:\windows\resources\svchost.exe N/A
File opened for modification C:\Windows\SysWOW64\explorer.exe \??\c:\windows\resources\themes\explorer.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Resources\tjud.exe \??\c:\windows\resources\themes\explorer.exe N/A
File opened for modification C:\Windows\Resources\Themes\icsys.icn.exe C:\Users\Admin\AppData\Local\Temp\tungbot.exe N/A
File opened for modification \??\c:\windows\resources\themes\explorer.exe C:\Windows\Resources\Themes\icsys.icn.exe N/A
File opened for modification \??\c:\windows\resources\spoolsv.exe \??\c:\windows\resources\themes\explorer.exe N/A
File opened for modification \??\c:\windows\resources\svchost.exe \??\c:\windows\resources\spoolsv.exe N/A

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe \??\c:\users\admin\appdata\local\temp\tungbot.exe 

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\tungbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tungbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tungbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tungbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tungbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tungbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tungbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tungbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tungbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tungbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tungbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tungbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tungbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tungbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tungbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tungbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tungbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tungbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tungbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tungbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tungbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tungbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tungbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tungbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tungbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tungbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tungbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tungbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tungbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tungbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tungbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tungbot.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A \??\c:\windows\resources\themes\explorer.exe N/A
N/A N/A \??\c:\windows\resources\svchost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A \??\c:\users\admin\appdata\local\temp\tungbot.exe  N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\tungbot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\tungbot.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A \??\c:\windows\resources\themes\explorer.exe N/A
N/A N/A \??\c:\windows\resources\themes\explorer.exe N/A
N/A N/A \??\c:\windows\resources\spoolsv.exe N/A
N/A N/A \??\c:\windows\resources\spoolsv.exe N/A
N/A N/A \??\c:\windows\resources\svchost.exe N/A
N/A N/A \??\c:\windows\resources\svchost.exe N/A
N/A N/A \??\c:\windows\resources\spoolsv.exe N/A
N/A N/A \??\c:\windows\resources\spoolsv.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2580 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\tungbot.exe \??\c:\users\admin\appdata\local\temp\tungbot.exe 
PID 2580 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\tungbot.exe \??\c:\users\admin\appdata\local\temp\tungbot.exe 
PID 2580 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\tungbot.exe \??\c:\users\admin\appdata\local\temp\tungbot.exe 
PID 2580 wrote to memory of 4592 N/A C:\Users\Admin\AppData\Local\Temp\tungbot.exe C:\Windows\Resources\Themes\icsys.icn.exe
PID 2580 wrote to memory of 4592 N/A C:\Users\Admin\AppData\Local\Temp\tungbot.exe C:\Windows\Resources\Themes\icsys.icn.exe
PID 2580 wrote to memory of 4592 N/A C:\Users\Admin\AppData\Local\Temp\tungbot.exe C:\Windows\Resources\Themes\icsys.icn.exe
PID 4592 wrote to memory of 2212 N/A C:\Windows\Resources\Themes\icsys.icn.exe \??\c:\windows\resources\themes\explorer.exe
PID 4592 wrote to memory of 2212 N/A C:\Windows\Resources\Themes\icsys.icn.exe \??\c:\windows\resources\themes\explorer.exe
PID 4592 wrote to memory of 2212 N/A C:\Windows\Resources\Themes\icsys.icn.exe \??\c:\windows\resources\themes\explorer.exe
PID 2212 wrote to memory of 4836 N/A \??\c:\windows\resources\themes\explorer.exe \??\c:\windows\resources\spoolsv.exe
PID 2212 wrote to memory of 4836 N/A \??\c:\windows\resources\themes\explorer.exe \??\c:\windows\resources\spoolsv.exe
PID 2212 wrote to memory of 4836 N/A \??\c:\windows\resources\themes\explorer.exe \??\c:\windows\resources\spoolsv.exe
PID 4836 wrote to memory of 2964 N/A \??\c:\windows\resources\spoolsv.exe \??\c:\windows\resources\svchost.exe
PID 4836 wrote to memory of 2964 N/A \??\c:\windows\resources\spoolsv.exe \??\c:\windows\resources\svchost.exe
PID 4836 wrote to memory of 2964 N/A \??\c:\windows\resources\spoolsv.exe \??\c:\windows\resources\svchost.exe
PID 2964 wrote to memory of 3468 N/A \??\c:\windows\resources\svchost.exe \??\c:\windows\resources\spoolsv.exe
PID 2964 wrote to memory of 3468 N/A \??\c:\windows\resources\svchost.exe \??\c:\windows\resources\spoolsv.exe
PID 2964 wrote to memory of 3468 N/A \??\c:\windows\resources\svchost.exe \??\c:\windows\resources\spoolsv.exe

Processes

C:\Users\Admin\AppData\Local\Temp\tungbot.exe

"C:\Users\Admin\AppData\Local\Temp\tungbot.exe"

\??\c:\users\admin\appdata\local\temp\tungbot.exe 

c:\users\admin\appdata\local\temp\tungbot.exe 

C:\Windows\Resources\Themes\icsys.icn.exe

C:\Windows\Resources\Themes\icsys.icn.exe

\??\c:\windows\resources\themes\explorer.exe

c:\windows\resources\themes\explorer.exe

\??\c:\windows\resources\spoolsv.exe

c:\windows\resources\spoolsv.exe SE

\??\c:\windows\resources\svchost.exe

c:\windows\resources\svchost.exe

\??\c:\windows\resources\spoolsv.exe

c:\windows\resources\spoolsv.exe PR

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2184 -ip 2184

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 1652

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
VN 103.170.118.35:80 tcp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 31.121.18.2.in-addr.arpa udp
US 8.8.8.8:53 49.15.97.104.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp

Files

memory/2580-0-0x0000000000400000-0x000000000041F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tungbot.exe 

MD5 a4979638b247751333d486aeb7481228
SHA1 4d8e13846df61c250d35c75a66987a3288db717b
SHA256 bc929754d1fee83d4faa1cefb6bc48e8304ff125606972962daa0799973df8b8
SHA512 7bed8a3c210f4a7e280ce14baea20af43f08754b1670803fdc3257954f4564c1cfbb9c227a5a5bc11ce63500b3abbaa333cac13476f36b5c543d24cfa5b15ba6

C:\Windows\Resources\Themes\icsys.icn.exe

MD5 084ec49bd1c825bcbbe00bf85f49a78e
SHA1 b553957a320d527cb669c7c1079f879fc8f0d8f4
SHA256 a666805ef2e56f676790a2ede0da6c71a780bec2e6425368775eb1758fca6405
SHA512 c717d82eafab34300f9aef1f7dd291e0298c947d54db863f265505b590c126155f5ee8937b7fbe35b5748b9bd079745319ca5856e1a79d22eea7b4df37c8d1c1

memory/4592-11-0x0000000000400000-0x000000000041F000-memory.dmp

C:\Windows\Resources\Themes\explorer.exe

MD5 0ac088e7ef3f0f0bb43ec8cc16b81422
SHA1 027a597fc2735562a804070b15d225a4b222cc2b
SHA256 cb768fab3fb54424ea8637dad0b8e755ce54bfb1f8bbba71d057189cd09379df
SHA512 a4f8e44dcb962834f944072789e0085cf083533552782cd0a933933a7b3a91266d4922d31eb972d8d543133cd39618f485266e9fd74c0b024c6fd1fbed0dc196

memory/2184-24-0x0000000074CEE000-0x0000000074CEF000-memory.dmp

memory/2184-25-0x00000000000E0000-0x0000000000100000-memory.dmp

C:\Windows\Resources\spoolsv.exe

MD5 876b4d83af30cd9fe1e690045dd32ee2
SHA1 e96558dce125fcc8a0949c32f5b496d98e209c8b
SHA256 ea38c7e662fcad1da88bc2c450d18d8ceb1f7c3b674165225c21fb2cf7a3ddaf
SHA512 a3a3edafd281c6a8dc2e7dcf74a7a8e22d1eddead1fa80163e41d3f6148c5adb528c33d6b5a3cb41f4fccec3294971b7bff2ea479e80634bdb944a0795b7e014

C:\Windows\Resources\svchost.exe

MD5 4b5c4576dc07e0cdd830fd04ff9a9781
SHA1 46c4665929715a05f4e802d329757bbcdfbedd51
SHA256 e6f6b4ada448391b28674a4b55198069ec6be578dbc8abce8b00460ebc54fd74
SHA512 a1901e7a68e925d5106f397163db2782a64c203c6f78ed7adfc0a0d693d56709322bb0d78401d522f3a5af3d393b43658c860b92c0ce7ceb2d44dfd9267b4166

memory/2184-42-0x0000000004FC0000-0x0000000005564000-memory.dmp

memory/3468-47-0x0000000000400000-0x000000000041F000-memory.dmp

memory/4836-48-0x0000000000400000-0x000000000041F000-memory.dmp

memory/4592-49-0x0000000000400000-0x000000000041F000-memory.dmp

memory/2580-50-0x0000000000400000-0x000000000041F000-memory.dmp

memory/2184-51-0x0000000074CEE000-0x0000000074CEF000-memory.dmp