Analysis
-
max time kernel
135s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
26-01-2025 17:14
General
-
Target
4D8E624F384094C048F779B9BB94A3BB.exe
-
Size
13.9MB
-
MD5
4d8e624f384094c048f779b9bb94a3bb
-
SHA1
d81dca9f8165c915d88c9cc4c645f296198dc95e
-
SHA256
1d40788ce56c4cafdd19ae5f2b567e51234a32fa179ec8fba45452dd46b4fab1
-
SHA512
ae0294b02a073cff03d0272c74da2157807305d38993b91285a29b7ae000600324ae822fe6ee1e5986a87fdd7838979d84eda9d6b2499b28000f5d7586d34c47
-
SSDEEP
196608:fqzd1L5Rbl1d363KTzuZhd1L5Rbl1d363KvhA54CbkAX//:yd1L51JfzuZhd1L51JS4CbkAH
Score
10/10
Malware Config
Signatures
-
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
-
SectopRAT payload 2 IoCs
-
Sectoprat family
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4D8E624F384094C048F779B9BB94A3BB.exe"C:\Users\Admin\AppData\Local\Temp\4D8E624F384094C048F779B9BB94A3BB.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
4KB
-
Filesize
792KB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
6.9MB