Analysis
- max time kernel
141s - max time network
113s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
07/08/2024, 18:38
General
- Target carrier.exe
- Size 16.0MB
- Sample240807-xaablssaqr
- SHA256 d45b6b04ac18ef566ac0ecdaf6a1f73d1c3164a845b83e0899c66c608154b93d
Malware Config
Signatures
- SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- SectopRAT payload 1 IoCs
- Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Suspicious use of SetThreadContext 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious behavior: MapViewOfSection 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 4 IoCs
- Suspicious use of SendNotifyMessage 4 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\carrier.exe"C:\Users\Admin\AppData\Local\Temp\carrier.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\more.comC:\Windows\SysWOW64\more.com2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
5a0dab3f
5da77031
tmp5764.tmp
tmp5777.tmp
memory/1368-22-0x0000000077130000-0x00000000776E3000-memory.dmp
memory/1368-30-0x0000000003590000-0x0000000003B43000-memory.dmp
memory/1368-29-0x0000000077130000-0x00000000776E3000-memory.dmp
memory/1368-23-0x0000000077130000-0x00000000776E3000-memory.dmp
memory/1368-18-0x0000000077130000-0x00000000776E3000-memory.dmp
memory/1368-19-0x00007FFABD9F0000-0x00007FFABDBE5000-memory.dmp
memory/1368-21-0x0000000003590000-0x0000000003B43000-memory.dmp
memory/2680-33-0x0000000004FB0000-0x0000000005042000-memory.dmp
memory/2680-62-0x0000000000AF0000-0x0000000000AF8000-memory.dmp
memory/2680-26-0x00000000752D0000-0x00000000752D8000-memory.dmp
memory/2680-77-0x0000000005520000-0x000000000555C000-memory.dmp
memory/2680-76-0x0000000005240000-0x0000000005252000-memory.dmp
memory/2680-31-0x00000000749EE000-0x00000000749EF000-memory.dmp
memory/2680-32-0x0000000000A20000-0x0000000000AE6000-memory.dmp
memory/2680-75-0x00000000749E0000-0x0000000075190000-memory.dmp
memory/2680-34-0x00000000056C0000-0x0000000005C64000-memory.dmp
memory/2680-35-0x00000000052E0000-0x00000000054A2000-memory.dmp
memory/2680-36-0x0000000005110000-0x0000000005186000-memory.dmp
memory/2680-37-0x0000000005190000-0x00000000051E0000-memory.dmp
memory/2680-38-0x00000000749E0000-0x0000000075190000-memory.dmp
memory/2680-39-0x0000000005050000-0x000000000505A000-memory.dmp
memory/2680-40-0x00000000062A0000-0x00000000067CC000-memory.dmp
memory/2680-41-0x00000000056A0000-0x00000000056BE000-memory.dmp
memory/2680-42-0x0000000005E40000-0x0000000005EA6000-memory.dmp
memory/2680-72-0x00000000749EE000-0x00000000749EF000-memory.dmp
memory/2680-68-0x0000000007D30000-0x0000000007D3A000-memory.dmp
memory/4448-15-0x0000000077130000-0x00000000776E3000-memory.dmp
memory/4448-11-0x0000000077130000-0x00000000776E3000-memory.dmp
memory/4448-12-0x00007FFABD9F0000-0x00007FFABDBE5000-memory.dmp
memory/4448-5-0x0000000000870000-0x00000000018AB000-memory.dmp
memory/4448-13-0x0000000077143000-0x0000000077145000-memory.dmp
memory/4448-14-0x0000000077130000-0x00000000776E3000-memory.dmp