sectoprat | 304555a63b7a431a158fd9e527bdfcb7610f6dfa9231f4184f2e80e85a0dc520

General

Target

304555a63b7a431a158fd9e527bdfcb7610f6dfa9231f4184f2e80e85a0dc520.exe
Size

3.5MB
MD5

2e2358523bbe722450a7e49eed0534b6
SHA1

10ac0bbf6ab7e2db1d53a93973bf73573160eeab
SHA256

304555a63b7a431a158fd9e527bdfcb7610f6dfa9231f4184f2e80e85a0dc520
SHA512

13fbfe2ee2ca37d9ace32e0a1c84f0aa726d5dd4145ed9a7385317140486ab8688a8defe71fd31dffe70a7fd17c4c1305b7eeaa5b11a32e55b57b05152a26ce5
SSDEEP

49152:xSee3hQidqT4kgJmNqf9YWBTg+E5EiCh8:I3hQidXZQNqiWLgR6

Score

10^/10

sectoprat discovery rat spyware stealer trojan

Malware Config

Signatures

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 5 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1940-3-0x0000000000400000-0x00000000004C6000-memory.dmp	family_sectoprat
behavioral2/memory/1940-5-0x0000000000400000-0x00000000004C6000-memory.dmp	family_sectoprat
behavioral2/memory/1940-4-0x0000000000400000-0x00000000004C6000-memory.dmp	family_sectoprat
behavioral2/memory/1560-6-0x0000000002320000-0x00000000023F7000-memory.dmp	family_sectoprat
behavioral2/memory/1560-0-0x0000000002320000-0x00000000023F7000-memory.dmp	family_sectoprat

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 1 IoCs

Processes:

304555a63b7a431a158fd9e527bdfcb7610f6dfa9231f4184f2e80e85a0dc520.exe

description	pid	process	target process
PID 1560 set thread context of 1940	1560	304555a63b7a431a158fd9e527bdfcb7610f6dfa9231f4184f2e80e85a0dc520.exe	RegAsm.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

RegAsm.exe

pid process

1940 RegAsm.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegAsm.exe

description pid process

Token: SeDebugPrivilege 1940 RegAsm.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

RegAsm.exe

pid process

1940 RegAsm.exe

pid	process
1940	RegAsm.exe

description	pid	process
Token: SeDebugPrivilege	1940	RegAsm.exe

pid	process
1940	RegAsm.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

304555a63b7a431a158fd9e527bdfcb7610f6dfa9231f4184f2e80e85a0dc520.exe

description	pid	process	target process
PID 1560 wrote to memory of 1940	1560	304555a63b7a431a158fd9e527bdfcb7610f6dfa9231f4184f2e80e85a0dc520.exe	RegAsm.exe
PID 1560 wrote to memory of 1940	1560	304555a63b7a431a158fd9e527bdfcb7610f6dfa9231f4184f2e80e85a0dc520.exe	RegAsm.exe
PID 1560 wrote to memory of 1940	1560	304555a63b7a431a158fd9e527bdfcb7610f6dfa9231f4184f2e80e85a0dc520.exe	RegAsm.exe
PID 1560 wrote to memory of 1940	1560	304555a63b7a431a158fd9e527bdfcb7610f6dfa9231f4184f2e80e85a0dc520.exe	RegAsm.exe
PID 1560 wrote to memory of 1940	1560	304555a63b7a431a158fd9e527bdfcb7610f6dfa9231f4184f2e80e85a0dc520.exe	RegAsm.exe
PID 1560 wrote to memory of 1940	1560	304555a63b7a431a158fd9e527bdfcb7610f6dfa9231f4184f2e80e85a0dc520.exe	RegAsm.exe
PID 1560 wrote to memory of 1940	1560	304555a63b7a431a158fd9e527bdfcb7610f6dfa9231f4184f2e80e85a0dc520.exe	RegAsm.exe
PID 1560 wrote to memory of 1940	1560	304555a63b7a431a158fd9e527bdfcb7610f6dfa9231f4184f2e80e85a0dc520.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\304555a63b7a431a158fd9e527bdfcb7610f6dfa9231f4184f2e80e85a0dc520.exe
"C:\Users\Admin\AppData\Local\Temp\304555a63b7a431a158fd9e527bdfcb7610f6dfa9231f4184f2e80e85a0dc520.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1560

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpC594.tmp

Filesize
20KB

MD5
a603e09d617fea7517059b4924b1df93

SHA1
31d66e1496e0229c6a312f8be05da3f813b3fa9e

SHA256
ccd15f9c7a997ae2b5320ea856c7efc54b5055254d41a443d21a60c39c565cb7

SHA512
eadb844a84f8a660c578a2f8e65ebcb9e0b9ab67422be957f35492ff870825a4b363f96fd1c546eaacfd518f6812fcf57268ef03c149e5b1a7af145c7100e2cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpC5B6.tmp

Filesize
20KB

MD5
49693267e0adbcd119f9f5e02adf3a80

SHA1
3ba3d7f89b8ad195ca82c92737e960e1f2b349df

SHA256
d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f

SHA512
b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2

Download Submit
memory/1560-6-0x0000000002320000-0x00000000023F7000-memory.dmp

Filesize
860KB

Download
memory/1560-0-0x0000000002320000-0x00000000023F7000-memory.dmp

Filesize
860KB

Download
memory/1940-10-0x0000000005960000-0x0000000005B22000-memory.dmp

Filesize
1.8MB

Download
memory/1940-13-0x0000000005790000-0x00000000057E0000-memory.dmp

Filesize
320KB

Download
memory/1940-5-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/1940-7-0x000000007465E000-0x000000007465F000-memory.dmp

Filesize
4KB

Download
memory/1940-8-0x0000000005590000-0x0000000005622000-memory.dmp

Filesize
584KB

Download
memory/1940-9-0x0000000005BE0000-0x0000000006184000-memory.dmp

Filesize
5.6MB

Download
memory/1940-2-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/1940-11-0x00000000056B0000-0x0000000005726000-memory.dmp

Filesize
472KB

Download
memory/1940-12-0x0000000074650000-0x0000000074E00000-memory.dmp

Filesize
7.7MB

Download
memory/1940-4-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/1940-14-0x0000000005580000-0x000000000558A000-memory.dmp

Filesize
40KB

Download
memory/1940-15-0x00000000067C0000-0x0000000006CEC000-memory.dmp

Filesize
5.2MB

Download
memory/1940-16-0x0000000006310000-0x000000000632E000-memory.dmp

Filesize
120KB

Download
memory/1940-17-0x0000000006400000-0x0000000006466000-memory.dmp

Filesize
408KB

Download
memory/1940-3-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/1940-1-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/1940-36-0x0000000007BE0000-0x0000000007BEA000-memory.dmp

Filesize
40KB

Download
memory/1940-37-0x000000007465E000-0x000000007465F000-memory.dmp

Filesize
4KB

Download
memory/1940-38-0x0000000074650000-0x0000000074E00000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads