sectoprat | f9c7585bf95c609e91fb5de1caa48ab57b1afa0eac5bc8066b3d9ab2d1e5dc75

General

Target

304555a63b7a431a158fd9e527bdfcb7610f6dfa9231f4184f2e80e85a0dc520.exe
Size

3.5MB
MD5

2e2358523bbe722450a7e49eed0534b6
SHA1

10ac0bbf6ab7e2db1d53a93973bf73573160eeab
SHA256

304555a63b7a431a158fd9e527bdfcb7610f6dfa9231f4184f2e80e85a0dc520
SHA512

13fbfe2ee2ca37d9ace32e0a1c84f0aa726d5dd4145ed9a7385317140486ab8688a8defe71fd31dffe70a7fd17c4c1305b7eeaa5b11a32e55b57b05152a26ce5
SSDEEP

49152:xSee3hQidqT4kgJmNqf9YWBTg+E5EiCh8:I3hQidXZQNqiWLgR6

Score

10^/10

sectoprat discovery rat spyware stealer trojan

Malware Config

Signatures

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 5 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2740-0-0x0000000002340000-0x0000000002417000-memory.dmp	family_sectoprat
behavioral2/memory/5088-3-0x0000000000400000-0x00000000004C6000-memory.dmp	family_sectoprat
behavioral2/memory/2740-6-0x0000000002340000-0x0000000002417000-memory.dmp	family_sectoprat
behavioral2/memory/5088-5-0x0000000000400000-0x00000000004C6000-memory.dmp	family_sectoprat
behavioral2/memory/5088-4-0x0000000000400000-0x00000000004C6000-memory.dmp	family_sectoprat

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 1 IoCs

Processes:

304555a63b7a431a158fd9e527bdfcb7610f6dfa9231f4184f2e80e85a0dc520.exe

description	pid	process	target process
PID 2740 set thread context of 5088	2740	304555a63b7a431a158fd9e527bdfcb7610f6dfa9231f4184f2e80e85a0dc520.exe	RegAsm.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

RegAsm.exe

pid process

5088 RegAsm.exe
5088 RegAsm.exe
5088 RegAsm.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegAsm.exe

description pid process

Token: SeDebugPrivilege 5088 RegAsm.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

RegAsm.exe

pid process

5088 RegAsm.exe

pid	process
5088	RegAsm.exe
5088	RegAsm.exe
5088	RegAsm.exe

description	pid	process
Token: SeDebugPrivilege	5088	RegAsm.exe

pid	process
5088	RegAsm.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

304555a63b7a431a158fd9e527bdfcb7610f6dfa9231f4184f2e80e85a0dc520.exe

description	pid	process	target process
PID 2740 wrote to memory of 5088	2740	304555a63b7a431a158fd9e527bdfcb7610f6dfa9231f4184f2e80e85a0dc520.exe	RegAsm.exe
PID 2740 wrote to memory of 5088	2740	304555a63b7a431a158fd9e527bdfcb7610f6dfa9231f4184f2e80e85a0dc520.exe	RegAsm.exe
PID 2740 wrote to memory of 5088	2740	304555a63b7a431a158fd9e527bdfcb7610f6dfa9231f4184f2e80e85a0dc520.exe	RegAsm.exe
PID 2740 wrote to memory of 5088	2740	304555a63b7a431a158fd9e527bdfcb7610f6dfa9231f4184f2e80e85a0dc520.exe	RegAsm.exe
PID 2740 wrote to memory of 5088	2740	304555a63b7a431a158fd9e527bdfcb7610f6dfa9231f4184f2e80e85a0dc520.exe	RegAsm.exe
PID 2740 wrote to memory of 5088	2740	304555a63b7a431a158fd9e527bdfcb7610f6dfa9231f4184f2e80e85a0dc520.exe	RegAsm.exe
PID 2740 wrote to memory of 5088	2740	304555a63b7a431a158fd9e527bdfcb7610f6dfa9231f4184f2e80e85a0dc520.exe	RegAsm.exe
PID 2740 wrote to memory of 5088	2740	304555a63b7a431a158fd9e527bdfcb7610f6dfa9231f4184f2e80e85a0dc520.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\304555a63b7a431a158fd9e527bdfcb7610f6dfa9231f4184f2e80e85a0dc520.exe
"C:\Users\Admin\AppData\Local\Temp\304555a63b7a431a158fd9e527bdfcb7610f6dfa9231f4184f2e80e85a0dc520.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2740

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp8426.tmp

Filesize
20KB

MD5
a603e09d617fea7517059b4924b1df93

SHA1
31d66e1496e0229c6a312f8be05da3f813b3fa9e

SHA256
ccd15f9c7a997ae2b5320ea856c7efc54b5055254d41a443d21a60c39c565cb7

SHA512
eadb844a84f8a660c578a2f8e65ebcb9e0b9ab67422be957f35492ff870825a4b363f96fd1c546eaacfd518f6812fcf57268ef03c149e5b1a7af145c7100e2cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp8448.tmp

Filesize
20KB

MD5
49693267e0adbcd119f9f5e02adf3a80

SHA1
3ba3d7f89b8ad195ca82c92737e960e1f2b349df

SHA256
d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f

SHA512
b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2

Download Submit
memory/2740-0-0x0000000002340000-0x0000000002417000-memory.dmp

Filesize
860KB

Download
memory/2740-6-0x0000000002340000-0x0000000002417000-memory.dmp

Filesize
860KB

Download
memory/5088-1-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/5088-15-0x0000000006750000-0x0000000006C7C000-memory.dmp

Filesize
5.2MB

Download
memory/5088-5-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/5088-7-0x0000000074EDE000-0x0000000074EDF000-memory.dmp

Filesize
4KB

Download
memory/5088-8-0x0000000005520000-0x00000000055B2000-memory.dmp

Filesize
584KB

Download
memory/5088-9-0x0000000005B70000-0x0000000006114000-memory.dmp

Filesize
5.6MB

Download
memory/5088-10-0x0000000005870000-0x0000000005A32000-memory.dmp

Filesize
1.8MB

Download
memory/5088-11-0x00000000055C0000-0x0000000005636000-memory.dmp

Filesize
472KB

Download
memory/5088-12-0x0000000005640000-0x0000000005690000-memory.dmp

Filesize
320KB

Download
memory/5088-13-0x0000000074ED0000-0x0000000075680000-memory.dmp

Filesize
7.7MB

Download
memory/5088-14-0x0000000005490000-0x000000000549A000-memory.dmp

Filesize
40KB

Download
memory/5088-4-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/5088-16-0x0000000006220000-0x000000000623E000-memory.dmp

Filesize
120KB

Download
memory/5088-17-0x0000000006310000-0x0000000006376000-memory.dmp

Filesize
408KB

Download
memory/5088-3-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/5088-2-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/5088-41-0x00000000080C0000-0x00000000080CA000-memory.dmp

Filesize
40KB

Download
memory/5088-43-0x0000000074EDE000-0x0000000074EDF000-memory.dmp

Filesize
4KB

Download
memory/5088-44-0x0000000074ED0000-0x0000000075680000-memory.dmp

Filesize
7.7MB

Download
memory/5088-45-0x0000000005700000-0x0000000005712000-memory.dmp

Filesize
72KB

Download
memory/5088-46-0x0000000005790000-0x00000000057CC000-memory.dmp

Filesize
240KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads