sectoprat | 9475d40751701e8e5cf44c54e428043d4e76a4868ccfa5924b687881eedca5f3

Analysis

max time kernel
134s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
03-07-2024 00:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-07-02_24bcf28f8fb2c7910c3a25a8eb015312_magniber.exe
Size

9.9MB
MD5

24bcf28f8fb2c7910c3a25a8eb015312
SHA1

2babbd7a3f87327219a50a553dc50e035a6e3f9a
SHA256

9475d40751701e8e5cf44c54e428043d4e76a4868ccfa5924b687881eedca5f3
SHA512

3b5c123d868caba1bd853dbe08425814788bc8411c780e8b9030957079be7c5d11dd15ccd4e96363587c35f3ef9fce64a1bd665b6a6bc6f9410f94c54e33d6d4
SSDEEP

196608:TaetdpmxiHUbVaw5zph8qU9m/zmtseRML2l3hDHaI6HMaJTtGb/ki00Sv5TiK/nT:Gmf+iHoT5P8SzaD8lpiK/YBNENa29

Score

10^/10

sectoprat rat spyware trojan

Malware Config

Signatures

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/5156-4888-0x0000000000400000-0x00000000004C6000-memory.dmp	family_sectoprat

Drops startup file 1 IoCs

Processes:

2024-07-02_24bcf28f8fb2c7910c3a25a8eb015312_magniber.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ma94.vbs	2024-07-02_24bcf28f8fb2c7910c3a25a8eb015312_magniber.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Suspicious use of SetThreadContext 1 IoCs

Processes:

2024-07-02_24bcf28f8fb2c7910c3a25a8eb015312_magniber.exe

description pid process target process

PID 3952 set thread context of 5156 3952 2024-07-02_24bcf28f8fb2c7910c3a25a8eb015312_magniber.exe MSBuild.exe

description	pid	process	target process
PID 3952 set thread context of 5156	3952	2024-07-02_24bcf28f8fb2c7910c3a25a8eb015312_magniber.exe	MSBuild.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

Processes:

2024-07-02_24bcf28f8fb2c7910c3a25a8eb015312_magniber.exeMSBuild.exe

pid	process
3952	2024-07-02_24bcf28f8fb2c7910c3a25a8eb015312_magniber.exe
3952	2024-07-02_24bcf28f8fb2c7910c3a25a8eb015312_magniber.exe
5156	MSBuild.exe
5156	MSBuild.exe
5156	MSBuild.exe
5156	MSBuild.exe
5156	MSBuild.exe
5156	MSBuild.exe
5156	MSBuild.exe
5156	MSBuild.exe
5156	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

2024-07-02_24bcf28f8fb2c7910c3a25a8eb015312_magniber.exeMSBuild.exe

description	pid	process
Token: SeDebugPrivilege	3952	2024-07-02_24bcf28f8fb2c7910c3a25a8eb015312_magniber.exe
Token: SeDebugPrivilege	3952	2024-07-02_24bcf28f8fb2c7910c3a25a8eb015312_magniber.exe
Token: SeDebugPrivilege	5156	MSBuild.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

MSBuild.exe

pid process

5156 MSBuild.exe

pid	process
5156	MSBuild.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

2024-07-02_24bcf28f8fb2c7910c3a25a8eb015312_magniber.exe

description	pid	process	target process
PID 3952 wrote to memory of 5156	3952	2024-07-02_24bcf28f8fb2c7910c3a25a8eb015312_magniber.exe	MSBuild.exe
PID 3952 wrote to memory of 5156	3952	2024-07-02_24bcf28f8fb2c7910c3a25a8eb015312_magniber.exe	MSBuild.exe
PID 3952 wrote to memory of 5156	3952	2024-07-02_24bcf28f8fb2c7910c3a25a8eb015312_magniber.exe	MSBuild.exe
PID 3952 wrote to memory of 5156	3952	2024-07-02_24bcf28f8fb2c7910c3a25a8eb015312_magniber.exe	MSBuild.exe
PID 3952 wrote to memory of 5156	3952	2024-07-02_24bcf28f8fb2c7910c3a25a8eb015312_magniber.exe	MSBuild.exe
PID 3952 wrote to memory of 5156	3952	2024-07-02_24bcf28f8fb2c7910c3a25a8eb015312_magniber.exe	MSBuild.exe
PID 3952 wrote to memory of 5156	3952	2024-07-02_24bcf28f8fb2c7910c3a25a8eb015312_magniber.exe	MSBuild.exe
PID 3952 wrote to memory of 5156	3952	2024-07-02_24bcf28f8fb2c7910c3a25a8eb015312_magniber.exe	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\2024-07-02_24bcf28f8fb2c7910c3a25a8eb015312_magniber.exe
"C:\Users\Admin\AppData\Local\Temp\2024-07-02_24bcf28f8fb2c7910c3a25a8eb015312_magniber.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3952

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5156

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3928,i,11751898164297348119,13021661521765644467,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:8
1⤵
PID:392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --field-trial-handle=3636,i,11751898164297348119,13021661521765644467,262144 --variations-seed-version --mojo-platform-channel-handle=3792 /prefetch:3
1⤵
PID:4336

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --field-trial-handle=3660,i,11751898164297348119,13021661521765644467,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:8
1⤵
PID:5524

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp86E2.tmp
Filesize
20KB

MD5
04d4c386aaf03e6dca3ac87334f03d3f

SHA1
74627631ce3bd2ba43a12aac39f232da662a32c5

SHA256
c130cf082fdce58c9055dba5775490ad8e41055ead5edb0b1e411330144c971d

SHA512
01bce1bbdf00825e19c23559ec41a0236b059cec2e891cf4729288b6275aaff62f442b4556c869bfbe17a91475f22dc98522381b2e4f3bef6d1611f7f9f9bc1a

Download Submit
memory/3952-0-0x0000000002F00000-0x000000000318E000-memory.dmp

Filesize
2.6MB

Download
memory/3952-2-0x0000000002F00000-0x000000000318E000-memory.dmp

Filesize
2.6MB

Download
memory/3952-3-0x000000007476E000-0x000000007476F000-memory.dmp

Filesize
4KB

Download
memory/3952-4-0x0000000006080000-0x000000000630E000-memory.dmp

Filesize
2.6MB

Download
memory/3952-5-0x0000000074760000-0x0000000074F10000-memory.dmp

Filesize
7.7MB

Download
memory/3952-6-0x0000000074760000-0x0000000074F10000-memory.dmp

Filesize
7.7MB

Download
memory/3952-8-0x0000000006310000-0x0000000006592000-memory.dmp

Filesize
2.5MB

Download
memory/3952-9-0x0000000074760000-0x0000000074F10000-memory.dmp

Filesize
7.7MB

Download
memory/3952-7-0x0000000074760000-0x0000000074F10000-memory.dmp

Filesize
7.7MB

Download
memory/3952-10-0x0000000006590000-0x0000000006814000-memory.dmp

Filesize
2.5MB

Download
memory/3952-11-0x0000000006DC0000-0x0000000007364000-memory.dmp

Filesize
5.6MB

Download
memory/3952-12-0x00000000068B0000-0x0000000006942000-memory.dmp

Filesize
584KB

Download
memory/3952-20-0x0000000006590000-0x000000000680E000-memory.dmp

Filesize
2.5MB

Download
memory/3952-24-0x0000000006590000-0x000000000680E000-memory.dmp

Filesize
2.5MB

Download
memory/3952-28-0x0000000006590000-0x000000000680E000-memory.dmp

Filesize
2.5MB

Download
memory/3952-26-0x0000000006590000-0x000000000680E000-memory.dmp

Filesize
2.5MB

Download
memory/3952-30-0x0000000006590000-0x000000000680E000-memory.dmp

Filesize
2.5MB

Download
memory/3952-34-0x0000000006590000-0x000000000680E000-memory.dmp

Filesize
2.5MB

Download
memory/3952-72-0x0000000006590000-0x000000000680E000-memory.dmp

Filesize
2.5MB

Download
memory/3952-70-0x0000000006590000-0x000000000680E000-memory.dmp

Filesize
2.5MB

Download
memory/3952-68-0x0000000006590000-0x000000000680E000-memory.dmp

Filesize
2.5MB

Download
memory/3952-66-0x0000000006590000-0x000000000680E000-memory.dmp

Filesize
2.5MB

Download
memory/3952-64-0x0000000006590000-0x000000000680E000-memory.dmp

Filesize
2.5MB

Download
memory/3952-62-0x0000000006590000-0x000000000680E000-memory.dmp

Filesize
2.5MB

Download
memory/3952-60-0x0000000006590000-0x000000000680E000-memory.dmp

Filesize
2.5MB

Download
memory/3952-58-0x0000000006590000-0x000000000680E000-memory.dmp

Filesize
2.5MB

Download
memory/3952-56-0x0000000006590000-0x000000000680E000-memory.dmp

Filesize
2.5MB

Download
memory/3952-54-0x0000000006590000-0x000000000680E000-memory.dmp

Filesize
2.5MB

Download
memory/3952-53-0x0000000006590000-0x000000000680E000-memory.dmp

Filesize
2.5MB

Download
memory/3952-50-0x0000000006590000-0x000000000680E000-memory.dmp

Filesize
2.5MB

Download
memory/3952-48-0x0000000006590000-0x000000000680E000-memory.dmp

Filesize
2.5MB

Download
memory/3952-46-0x0000000006590000-0x000000000680E000-memory.dmp

Filesize
2.5MB

Download
memory/3952-44-0x0000000006590000-0x000000000680E000-memory.dmp

Filesize
2.5MB

Download
memory/3952-42-0x0000000006590000-0x000000000680E000-memory.dmp

Filesize
2.5MB

Download
memory/3952-40-0x0000000006590000-0x000000000680E000-memory.dmp

Filesize
2.5MB

Download
memory/3952-36-0x0000000006590000-0x000000000680E000-memory.dmp

Filesize
2.5MB

Download
memory/3952-32-0x0000000006590000-0x000000000680E000-memory.dmp

Filesize
2.5MB

Download
memory/3952-38-0x0000000006590000-0x000000000680E000-memory.dmp

Filesize
2.5MB

Download
memory/3952-22-0x0000000006590000-0x000000000680E000-memory.dmp

Filesize
2.5MB

Download
memory/3952-18-0x0000000006590000-0x000000000680E000-memory.dmp

Filesize
2.5MB

Download
memory/3952-16-0x0000000006590000-0x000000000680E000-memory.dmp

Filesize
2.5MB

Download
memory/3952-14-0x0000000006590000-0x000000000680E000-memory.dmp

Filesize
2.5MB

Download
memory/3952-13-0x0000000006590000-0x000000000680E000-memory.dmp

Filesize
2.5MB

Download
memory/3952-74-0x0000000006590000-0x000000000680E000-memory.dmp

Filesize
2.5MB

Download
memory/3952-4875-0x0000000074760000-0x0000000074F10000-memory.dmp

Filesize
7.7MB

Download
memory/3952-4877-0x0000000006AF0000-0x0000000006B3C000-memory.dmp

Filesize
304KB

Download
memory/3952-4876-0x0000000005EE0000-0x0000000005FA0000-memory.dmp

Filesize
768KB

Download
memory/3952-4878-0x0000000006B80000-0x0000000006BD4000-memory.dmp

Filesize
336KB

Download
memory/3952-4885-0x0000000002F00000-0x000000000318E000-memory.dmp

Filesize
2.6MB

Download
memory/3952-4886-0x0000000074760000-0x0000000074F10000-memory.dmp

Filesize
7.7MB

Download
memory/5156-4887-0x0000000074760000-0x0000000074F10000-memory.dmp

Filesize
7.7MB

Download
memory/5156-4888-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/5156-4889-0x0000000005AE0000-0x0000000005CA2000-memory.dmp

Filesize
1.8MB

Download
memory/5156-4891-0x0000000005830000-0x0000000005880000-memory.dmp

Filesize
320KB

Download
memory/5156-4890-0x0000000005910000-0x0000000005986000-memory.dmp

Filesize
472KB

Download
memory/5156-4892-0x0000000005700000-0x000000000570A000-memory.dmp

Filesize
40KB

Download
memory/5156-4894-0x0000000074760000-0x0000000074F10000-memory.dmp

Filesize
7.7MB

Download
memory/5156-4893-0x00000000069C0000-0x0000000006EEC000-memory.dmp

Filesize
5.2MB

Download
memory/5156-4895-0x00000000064B0000-0x00000000064CE000-memory.dmp

Filesize
120KB

Download
memory/5156-4896-0x0000000006540000-0x00000000065A6000-memory.dmp

Filesize
408KB

Download
memory/5156-4920-0x00000000084E0000-0x00000000084EA000-memory.dmp

Filesize
40KB

Download
memory/5156-4927-0x0000000074760000-0x0000000074F10000-memory.dmp

Filesize
7.7MB

Download
memory/5156-4928-0x0000000074760000-0x0000000074F10000-memory.dmp

Filesize
7.7MB

Download
memory/5156-4929-0x0000000005D50000-0x0000000005D62000-memory.dmp

Filesize
72KB

Download
memory/5156-4930-0x00000000063D0000-0x000000000640C000-memory.dmp

Filesize
240KB

Download