sectoprat | 44997a5aa2709c2cef26ea501d4f01140d34b59f0fd182282354598eef4b224b

General

Target

file.exe
Size

6.5MB
MD5

bfc5ea31b4aeefec1508e8f5b458e574
SHA1

976fe53a467068719f70a856dca3bb7b65a9d6dc
SHA256

44997a5aa2709c2cef26ea501d4f01140d34b59f0fd182282354598eef4b224b
SHA512

146ef0163df8be2c8e5a834c27d731c817e0540a30d4e4746109fd564c33d2d7f00560017f0d5b9ade9eea05611ed440f64022f97e30949e5bb58041452f590e
SSDEEP

98304:vi0rHj8I5IxALsFFyTFaYTXMHyAw8aMAKa392mAYYqUSoYTk0KGjp2kizn:vi0rDyraTFNKyLUAKw2B7qUShTkQjDir

Score

10^/10

sectoprat discovery rat spyware trojan

Malware Config

Signatures

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/848-51-0x0000000001300000-0x00000000013C6000-memory.dmp	family_sectoprat

Sectoprat family
sectoprat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	file.exe

Executes dropped EXE 2 IoCs

pid	Process
4652	Mp3tag.exe
2064	Mp3tag.exe

Loads dropped DLL 4 IoCs

pid	Process
4652	Mp3tag.exe
4652	Mp3tag.exe
2064	Mp3tag.exe
2064	Mp3tag.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2064 set thread context of 2232	2064	Mp3tag.exe	93
PID 2232 set thread context of 848	2232	cmd.exe	106

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4652	Mp3tag.exe
2064	Mp3tag.exe
2064	Mp3tag.exe
2232	cmd.exe
2232	cmd.exe
848	MSBuild.exe
848	MSBuild.exe
848	MSBuild.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
2064	Mp3tag.exe
2232	cmd.exe
2232	cmd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	848	MSBuild.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
848	MSBuild.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 3268 wrote to memory of 4652	3268	file.exe	83
PID 3268 wrote to memory of 4652	3268	file.exe	83
PID 4652 wrote to memory of 2064	4652	Mp3tag.exe	90
PID 4652 wrote to memory of 2064	4652	Mp3tag.exe	90
PID 2064 wrote to memory of 2232	2064	Mp3tag.exe	93
PID 2064 wrote to memory of 2232	2064	Mp3tag.exe	93
PID 2064 wrote to memory of 2232	2064	Mp3tag.exe	93
PID 2064 wrote to memory of 2232	2064	Mp3tag.exe	93
PID 2232 wrote to memory of 848	2232	cmd.exe	106
PID 2232 wrote to memory of 848	2232	cmd.exe	106
PID 2232 wrote to memory of 848	2232	cmd.exe	106
PID 2232 wrote to memory of 848	2232	cmd.exe	106
PID 2232 wrote to memory of 848	2232	cmd.exe	106

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3268
- C:\Users\Admin\AppData\Local\Temp\Bijouterie\Mp3tag.exe
  "C:\Users\Admin\AppData\Local\Temp\Bijouterie\Mp3tag.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4652
- - C:\Users\Admin\AppData\Roaming\Downloadplugin\Mp3tag.exe
    C:\Users\Admin\AppData\Roaming\Downloadplugin\Mp3tag.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:2064
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\SysWOW64\cmd.exe
      4⤵
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:2232
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1bab1255

Filesize
1.4MB

MD5
8c4be91f6bce5214109d0916c9c4af54

SHA1
63dc87bf5624acfa7a163e5655d1988b04ca5481

SHA256
83df8462e9d2b0b9a37e0b396f8c6f4431f117a6eda6709146e1b8b8d139b133

SHA512
a4781190bde8a7f832b674cd4d020b9d96884be73e29c8d2a0be4d762f4cd365660e7a2e770cbd505cecc26c287295e6d4f5b6a1338fb7a3f6aa83ea61a36fdd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Bijouterie\Mp3tag.exe

Filesize
12.0MB

MD5
a7118dffeac3772076f1a39a364d608d

SHA1
6b984d9446f23579e154ec47437b9cf820fd6b67

SHA256
f1973746ac0a703b23526f68c639436f0b26b0bc71c4f5adf36dc5f6e8a7f4d0

SHA512
f547c13b78acda9ca0523f0f8cd966c906f70a23a266ac86156dc7e17e6349e5f506366787e7a7823e2b07b0d614c9bd08e34ca5cc4f48799b0fe36ac836e890

Download Submit
C:\Users\Admin\AppData\Local\Temp\Bijouterie\fgq

Filesize
1.2MB

MD5
f6461ccd814a2ead19beeba2125b5368

SHA1
449ede26eeb5234f02a9d4b5a19fa7b6ffc4a1df

SHA256
8fb4e6d589830f39db50877b542b11281e56762caaa2742719b2ac042dd6cbd1

SHA512
fa8c7368597d79451fc47447ea1ac9e831b2b7835c6542a161bd74b0084da66fff4ac0555dce0eea64630887a2d953674125b1e2e9295a37b7bac678dc606fcd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Bijouterie\tak_deco_lib.dll

Filesize
315KB

MD5
ee7f11beaf317ef7185b0cec9a8ccff4

SHA1
274ebb8d1adfa6d49e1d3fc85cf942357c8a7653

SHA256
6c2d0a8831e82fc3889e94ef3e986660e38175ae406fea5a66e3d1f5c014ee97

SHA512
cdeec3fbd4eff63f64aad6559c36654416afae5e7314df1a756580dc52b6024c52f0f3803356b85d2095dfc136de9234271a14ec843af3cf3836b67bb30362b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Bijouterie\ymv

Filesize
14KB

MD5
c40639e251f6f49d3f4c140cd1fc3d9c

SHA1
7f531f2ad30f3bf2f637cea7087f3e432cc54adf

SHA256
2481d67eeef5025767464e90969c913f198eaa8171f8ebb8e61cd92ca880293f

SHA512
d327399a1fb31203fd1b8aa991369da907a4538bd77f69b0fc6568221cc3099300437d8e5f3f959c501ffcef2e728971f33e2fcf0d453e96a84458a23abb9480

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp320B.tmp

Filesize
20KB

MD5
49693267e0adbcd119f9f5e02adf3a80

SHA1
3ba3d7f89b8ad195ca82c92737e960e1f2b349df

SHA256
d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f

SHA512
b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2

Download Submit
memory/848-57-0x0000000005A30000-0x0000000005A3A000-memory.dmp

Filesize
40KB

Download
memory/848-58-0x0000000006C60000-0x000000000718C000-memory.dmp

Filesize
5.2MB

Download
memory/848-81-0x0000000005EF0000-0x0000000005F2C000-memory.dmp

Filesize
240KB

Download
memory/848-80-0x0000000005C70000-0x0000000005C82000-memory.dmp

Filesize
72KB

Download
memory/848-77-0x0000000008270000-0x000000000827A000-memory.dmp

Filesize
40KB

Download
memory/848-60-0x0000000006820000-0x0000000006886000-memory.dmp

Filesize
408KB

Download
memory/848-59-0x0000000006730000-0x000000000674E000-memory.dmp

Filesize
120KB

Download
memory/848-56-0x0000000005AD0000-0x0000000005B20000-memory.dmp

Filesize
320KB

Download
memory/848-48-0x00000000737D0000-0x0000000074A24000-memory.dmp

Filesize
18.3MB

Download
memory/848-51-0x0000000001300000-0x00000000013C6000-memory.dmp

Filesize
792KB

Download
memory/848-52-0x0000000005970000-0x0000000005A02000-memory.dmp

Filesize
584KB

Download
memory/848-53-0x0000000006080000-0x0000000006624000-memory.dmp

Filesize
5.6MB

Download
memory/848-54-0x0000000005CA0000-0x0000000005E62000-memory.dmp

Filesize
1.8MB

Download
memory/848-55-0x0000000005B50000-0x0000000005BC6000-memory.dmp

Filesize
472KB

Download
memory/2064-35-0x00000000008E0000-0x000000000093E000-memory.dmp

Filesize
376KB

Download
memory/2064-41-0x00000000008E0000-0x000000000093E000-memory.dmp

Filesize
376KB

Download
memory/2064-39-0x00007FFBC4B90000-0x00007FFBC4D02000-memory.dmp

Filesize
1.4MB

Download
memory/2064-38-0x00007FFBC4B90000-0x00007FFBC4D02000-memory.dmp

Filesize
1.4MB

Download
memory/2232-46-0x0000000075250000-0x00000000753CB000-memory.dmp

Filesize
1.5MB

Download
memory/2232-43-0x00007FFBE22F0000-0x00007FFBE24E5000-memory.dmp

Filesize
2.0MB

Download
memory/4652-23-0x00007FFBC3800000-0x00007FFBC3972000-memory.dmp

Filesize
1.4MB

Download
memory/4652-31-0x00000000004D0000-0x000000000052E000-memory.dmp

Filesize
376KB

Download
memory/4652-20-0x00000000004D0000-0x000000000052E000-memory.dmp

Filesize
376KB

Download

Analysis

Sharing