Analysis
-
max time kernel
137s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
28-11-2024 10:14
General
-
Target
5cbe2ec3c59b2cffd0ff87d7931f3f406985cbeb5648f9afcd36475552e96cc1.exe
-
Size
23.8MB
-
MD5
ecc581297b2c637c187c5b8f2455d0a9
-
SHA1
3f07a6c4f13e193631f21db3950aa9393a5824b1
-
SHA256
5cbe2ec3c59b2cffd0ff87d7931f3f406985cbeb5648f9afcd36475552e96cc1
-
SHA512
a2271103092085798d4cdc47aec4c6cf685cfd5a4c6ea5d6116c2053649dd4f6c3c9e2c555485c708a0a2aed78b610009e1a0aa0413d1d4b491bfb5abd21da68
-
SSDEEP
393216:d8jU2t/X9E3JMUNccjPql0NbgVunl22V5v+6m8FavWoB+Ysjuvk:CjU2p9EZvNdjP6Kbaunldv+6mLZ+YAuc
Malware Config
Signatures
-
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
-
SectopRAT payload 1 IoCs
-
Sectoprat family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 1 IoCs
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious behavior: MapViewOfSection 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5cbe2ec3c59b2cffd0ff87d7931f3f406985cbeb5648f9afcd36475552e96cc1.exe"C:\Users\Admin\AppData\Local\Temp\5cbe2ec3c59b2cffd0ff87d7931f3f406985cbeb5648f9afcd36475552e96cc1.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-P8F67.tmp\5cbe2ec3c59b2cffd0ff87d7931f3f406985cbeb5648f9afcd36475552e96cc1.tmp"C:\Users\Admin\AppData\Local\Temp\is-P8F67.tmp\5cbe2ec3c59b2cffd0ff87d7931f3f406985cbeb5648f9afcd36475552e96cc1.tmp" /SL5="$7005E,18032967,815616,C:\Users\Admin\AppData\Local\Temp\5cbe2ec3c59b2cffd0ff87d7931f3f406985cbeb5648f9afcd36475552e96cc1.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\is-4OV31.tmp\ExtractedContent.ps1"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\SystemUtil\Simple.exe"C:\Users\Admin\AppData\Roaming\SystemUtil\Simple.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\more.comC:\Windows\SysWOW64\more.com5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe6⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD588b009ccacf0eb1b4a141470d3f160c4
SHA1ee0d1a44562ccdedbcde92d232fa541f53826b4b
SHA256d2254ed99166a12ce00f93379142acfcbf9a49af3fb8789e8215b0c1cccb4587
SHA512d07c7b90a12e7e48a90bf450a57e4479ae5bb130efe9950a316d9a7ab9063d94af0f35942925aca41a7c2c149a0f31a075c38dd0b34821f88bd81588660d0be1
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1.6MB
MD5503141a46b747128cd364f4ec7d30585
SHA144f3c3869dead2d6e2ce13e7e134175f66424658
SHA256f69ee4ec3c9c36d8b32904dd769568c875176e1f8c0583efd0173da706b5d3c7
SHA51257b5d8d1a54c3943a27e5445a05f5fdf5a0d4ae32ee0c77e9ce1a4724bc3b3bed028a52daa83d6afd35f29ee6c72efc22d20e419aad4e6008fbce49ad5920bb1
-
Filesize
1.4MB
MD5b5f758134e11ae91b58db6e95e659470
SHA1f99e49363c71b29d37e4ef21de0d9d217b1b576a
SHA256db120168ea10d2bc7b3ecdef812402a1cc8db6837b48e825dc197230ce5b94dd
SHA51281bb26c1b94edc7f834280568ec68f2dfd91cdf270c34f2fb4c98a57060c2eccf906b1cd1ff860a3089a78a659d72d3ad1020a7983aa423e061db84dfa3ed566
-
Filesize
7.1MB
MD51e7e0d839739d361a490f6816de30dd7
SHA1982f175e8585b0ffef8203095cbb7cf4a4fc708f
SHA256a0a3a16453e9c8b9b529f8e5a1631ce7a0c67b60295033efdf06a76092d70d2d
SHA5127c85f8248920e3d3d94e907fcc48b06621b5b3e0cca3b9d88b18d3eb948a834897fe64f949d5af4208c15fd56048e8bb03317718db39f7487fc614e66361dd7e
-
Filesize
3.2MB
MD577264dbcb409de0c426bd5088b0fbe09
SHA111c02946ea15eea615ede3ed5597ed223d3879cf
SHA25685c71bb847f0b29db1d790c631d586167942ffceae96605f5673438fe3c8dd1a
SHA5125604a2fee723cea3238aca10dd44e1b1a4d5316a1e2c860619e34b9076fee501e9a9fc22c7e3e3dad1fdc7690f1992a57778b74b40fe6f3307085549ccfc6a83
-
Filesize
20KB
MD549693267e0adbcd119f9f5e02adf3a80
SHA13ba3d7f89b8ad195ca82c92737e960e1f2b349df
SHA256d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f
SHA512b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2
-
Filesize
10.5MB
MD54e4b37708a5780e19101a3c081b0992a
SHA1df5a5e50017c759906cb3dd31e564c54bdf7d844
SHA2561201aaef87fbd2be3b27b325e7fb99ef4edf5d38150846f94622c385b473e6f6
SHA512baf71393027412d62ec070b01f85e141e29ee6f31399e5021c66809bfc505840ec1c1ce706dce99164331f93711a86349ecec23fa344b151dc1b2b941021d413
-
Filesize
5.2MB
-
Filesize
792KB
-
Filesize
240KB
-
Filesize
320KB
-
Filesize
472KB
-
Filesize
1.8MB
-
Filesize
584KB
-
Filesize
120KB
-
Filesize
80KB
-
Filesize
40KB
-
Filesize
72KB
-
Filesize
852KB
-
Filesize
852KB
-
Filesize
852KB
-
Filesize
672KB
-
Filesize
7.7MB
-
Filesize
408KB
-
Filesize
136KB
-
Filesize
5.6MB
-
Filesize
304KB
-
Filesize
200KB
-
Filesize
3.3MB
-
Filesize
120KB
-
Filesize
7.7MB
-
Filesize
652KB
-
Filesize
7.7MB
-
Filesize
600KB
-
Filesize
6.5MB
-
Filesize
40KB
-
Filesize
68KB
-
Filesize
7.7MB
-
Filesize
72KB
-
Filesize
40KB
-
Filesize
304KB
-
Filesize
7.7MB
-
Filesize
136KB
-
Filesize
7.7MB
-
Filesize
120KB
-
Filesize
104KB
-
Filesize
408KB
-
Filesize
7.7MB
-
Filesize
3.3MB
-
Filesize
216KB
-
Filesize
6.2MB
-
Filesize
4KB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
3.2MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
2.0MB
-
Filesize
5.7MB
-
Filesize
2.0MB
-
Filesize
5.7MB
-
Filesize
10.6MB