Analysis

  • max time kernel
    110s
  • max time network
    112s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31-05-2024 18:21

General

  • Target

    7f386e57807f0c2d48b0b33f35e6baf50ba5ee8b000bbd7b4bdd454cedc9ae81.exe

  • Size

    768KB

  • MD5

    ad3d3124026a6a9c8017b57bc71ba72c

  • SHA1

    387657e93af3c08e74fe35a2e7c9fc34c8c5b734

  • SHA256

    7f386e57807f0c2d48b0b33f35e6baf50ba5ee8b000bbd7b4bdd454cedc9ae81

  • SHA512

    7d5e1ace6fc184df2ad96dfaddf270f9191b80d67da60296fba17d49d9b2fb3f48a608cc919a43d53c512978722460adcfa7fee2669a6083cefc5888b46f1e6e

  • SSDEEP

    12288:bvsXZv8km0OHcbGbvzWHz0HnquwTy+g0ssFWylkkoAbtEjQwfNqbYS2VbICKMIUb:EfPz0HILg0ssFlSj4nm

Malware Config

Signatures

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7f386e57807f0c2d48b0b33f35e6baf50ba5ee8b000bbd7b4bdd454cedc9ae81.exe
    "C:\Users\Admin\AppData\Local\Temp\7f386e57807f0c2d48b0b33f35e6baf50ba5ee8b000bbd7b4bdd454cedc9ae81.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:4592

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmp3AA9.tmp

    Filesize

    20KB

    MD5

    42c395b8db48b6ce3d34c301d1eba9d5

    SHA1

    b7cfa3de344814bec105391663c0df4a74310996

    SHA256

    5644546ecefc6786c7be5b1a89e935e640963ccd34b130f21baab9370cb9055d

    SHA512

    7b9214db96e9bec8745b4161a41c4c0520cdda9950f0cd3f12c7744227a25d639d07c0dd68b552cf1e032181c2e4f8297747f27bad6c7447b0f415a86bd82845

  • C:\Users\Admin\AppData\Local\Temp\tmp3ACC.tmp

    Filesize

    20KB

    MD5

    49693267e0adbcd119f9f5e02adf3a80

    SHA1

    3ba3d7f89b8ad195ca82c92737e960e1f2b349df

    SHA256

    d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f

    SHA512

    b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2

  • memory/4592-4-0x00000000057C0000-0x0000000005982000-memory.dmp

    Filesize

    1.8MB

  • memory/4592-11-0x0000000006440000-0x00000000064A6000-memory.dmp

    Filesize

    408KB

  • memory/4592-0-0x00000000751AE000-0x00000000751AF000-memory.dmp

    Filesize

    4KB

  • memory/4592-5-0x0000000005660000-0x00000000056D6000-memory.dmp

    Filesize

    472KB

  • memory/4592-6-0x00000000056E0000-0x0000000005730000-memory.dmp

    Filesize

    320KB

  • memory/4592-7-0x00000000751A0000-0x0000000075950000-memory.dmp

    Filesize

    7.7MB

  • memory/4592-8-0x00000000054B0000-0x00000000054BA000-memory.dmp

    Filesize

    40KB

  • memory/4592-9-0x0000000006770000-0x0000000006C9C000-memory.dmp

    Filesize

    5.2MB

  • memory/4592-10-0x0000000006360000-0x000000000637E000-memory.dmp

    Filesize

    120KB

  • memory/4592-3-0x0000000005B90000-0x0000000006134000-memory.dmp

    Filesize

    5.6MB

  • memory/4592-2-0x00000000054C0000-0x0000000005552000-memory.dmp

    Filesize

    584KB

  • memory/4592-1-0x0000000000B70000-0x0000000000C36000-memory.dmp

    Filesize

    792KB

  • memory/4592-35-0x0000000008270000-0x000000000827A000-memory.dmp

    Filesize

    40KB

  • memory/4592-37-0x00000000751AE000-0x00000000751AF000-memory.dmp

    Filesize

    4KB

  • memory/4592-38-0x00000000751A0000-0x0000000075950000-memory.dmp

    Filesize

    7.7MB

  • memory/4592-39-0x00000000061E0000-0x00000000061F2000-memory.dmp

    Filesize

    72KB

  • memory/4592-40-0x0000000008280000-0x00000000082BC000-memory.dmp

    Filesize

    240KB