Overview

overview

10

Static

static

1

556608.zip

windows7-x64

10

556608.zip

windows10-2004-x64

10

Analysis

  • max time kernel
    256s
  • max time network
    257s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    11-12-2024 14:23

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    556608.zip

  • Size

    1.5MB

  • MD5

    41eba955dd47961daa9ccd1ad26cf47c

  • SHA1

    1f282ec7791cb076387b4402ea231fc36dc79fc4

  • SHA256

    57f8db0ed487432436fb954a5bd13004751fe23eaa55c4148f22567a4b7dc43a

  • SHA512

    b351bd097c59878310896af18bc37ba3b74b8d4809dc786a086c3cf6c601d912e778b418e4da1d8fa015ee6a0aa4efcb97d8bf4d3d1d88208844327a861a3a5e

  • SSDEEP

    24576:9YlLzil+C4I5AC0OerLmmWTq79ODsJl1UwGQQ/TrGiDQm7rJinKAfLgp7gR:9Yo+w2xNzF8DclNGnyvCwKAfMtM

Score
10/10
sectopratdefense_evasiondiscoveryratspywarestealertrojan

Malware Config

Signatures

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat
  • SectopRAT payload 3 IoCs
  • Sectoprat family
    sectoprat
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • System Binary Proxy Execution: Regsvcs/Regasm 1 TTPs 2 IoCs

    Abuse Regasm to proxy execution of malicious code.

    defense_evasion
  • Drops startup file 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 53 IoCs
  • Suspicious behavior: EnumeratesProcesses 21 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1204
      • C:\Program Files\7-Zip\7zFM.exe
        "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\556608.zip"
        2⤵
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:2644
      • C:\Windows\explorer.exe
        "C:\Windows\explorer.exe"
        2⤵
          PID:1496
        • C:\Users\Admin\AppData\Local\Temp\Agreements.com
          "C:\Users\Admin\AppData\Local\Temp\Agreements.com"
          2⤵
          • Suspicious use of NtCreateUserProcessOtherParentProcess
          • System Binary Proxy Execution: Regsvcs/Regasm
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2612
          • C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
            C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:2744
        • C:\Windows\SysWOW64\cmd.exe
          cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CogniFlow.url" & echo URL="C:\Users\Admin\AppData\Local\NeuralTech Dynamics\CogniFlow.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CogniFlow.url" & exit
          2⤵
          • Drops startup file
          • System Location Discovery: System Language Discovery
          PID:1656
      • C:\Windows\system32\AUDIODG.EXE
        C:\Windows\system32\AUDIODG.EXE 0x4f4
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1228

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\0.au3
        Filesize

        1.0MB

        MD5

        00bf62da631b2a91afa1d4149f9e98fa

        SHA1

        c3857cfe2370c2bff28c5ecf61eb25e36cb73929

        SHA256

        d2ac35070b06503465cfb3acaab376176db3e6116efa065f3305c504c130be85

        SHA512

        b4bc553970b608915e442db4e36fae87b12a2169c25ceff8d9d8a572ad6a17cd6742466f6d64d59057f44ad55948b536f59d668d979c533e60c9e3412fef489b

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\Agreements.com
        Filesize

        872KB

        MD5

        6ee7ddebff0a2b78c7ac30f6e00d1d11

        SHA1

        f2f57024c7cc3f9ff5f999ee20c4f5c38bfc20a2

        SHA256

        865347471135bb5459ad0e647e75a14ad91424b6f13a5c05d9ecd9183a8a1cf4

        SHA512

        57d56de2bb882f491e633972003d7c6562ef2758c3731b913ff4d15379ada575062f4de2a48ca6d6d9241852a5b8a007f52792753fd8d8fee85b9a218714efd0

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\tmp7245.tmp
        Filesize

        20KB

        MD5

        c9ff7748d8fcef4cf84a5501e996a641

        SHA1

        02867e5010f62f97ebb0cfb32cb3ede9449fe0c9

        SHA256

        4d3f3194cb1133437aa69bb880c8cbb55ddf06ff61a88ca6c3f1bbfbfd35d988

        SHA512

        d36054499869a8f56ac8547ccd5455f1252c24e17d2b185955390b32da7e2a732ace4e0f30f9493fcc61425a2e31ed623465f998f41af69423ee0e3ed1483a73

        Download Submit

      • \Users\Admin\AppData\Local\Temp\RegAsm.exe
        Filesize

        63KB

        MD5

        b58b926c3574d28d5b7fdd2ca3ec30d5

        SHA1

        d260c4ffd603a9cfc057fcb83d678b1cecdf86f9

        SHA256

        6e70b56d748c4ccab13cc8a055d3795ea0dd95fe3b70568d7d3ac0c6621140a3

        SHA512

        b13cb998822b716b695013bcd6dec62a2290567d0d1743b2d982ca084235cf69c6ea1fc91c9d4e62657c6f9e102c7c60e81296ab055ffe43b887c5f8ec8958ab

        Download Submit

      • memory/2612-6-0x0000000004730000-0x0000000004732000-memory.dmp

        Filesize

        8KB

        Download

      • memory/2744-18-0x0000000000090000-0x0000000000156000-memory.dmp

        Filesize

        792KB

        Download

      • memory/2744-21-0x0000000000090000-0x0000000000156000-memory.dmp

        Filesize

        792KB

        Download

      • memory/2744-20-0x0000000000090000-0x0000000000156000-memory.dmp

        Filesize

        792KB

        Download