Analysis

  • max time kernel
    150s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250207-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250207-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-02-2025 03:35

General

  • Target

    645e557e03904aca48c1e0467a94de924a8359b6e5a98354a6e44aa2abeba84a.exe

  • Size

    8.9MB

  • MD5

    aa1ec7571a7e45ee718fd35136abb2cc

  • SHA1

    354b52630cd08560aefe7b78efe5e0c0e9cc12a5

  • SHA256

    645e557e03904aca48c1e0467a94de924a8359b6e5a98354a6e44aa2abeba84a

  • SHA512

    c00bce637b1d2f5e28d34da816b0d0d3f1d81cc9fe59c953514b65c70c0e3f8b79c9677d4b928447b14829f884e8524b7966df5fd9d6d18bb87e580026e909c7

  • SSDEEP

    196608:9hjidJFvglcIAtzyRxJugLjygdnyYQ8X+uPOStz73vK:9QdJ1glxAFyRFjycnJnPt73vK

Malware Config

Signatures

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 1 IoCs
  • Sectoprat family
  • Downloads MZ/PE file 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 12 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 19 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\645e557e03904aca48c1e0467a94de924a8359b6e5a98354a6e44aa2abeba84a.exe
    "C:\Users\Admin\AppData\Local\Temp\645e557e03904aca48c1e0467a94de924a8359b6e5a98354a6e44aa2abeba84a.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3508
    • C:\Users\Admin\AppData\Local\Temp\is-MD2AM.tmp\645e557e03904aca48c1e0467a94de924a8359b6e5a98354a6e44aa2abeba84a.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-MD2AM.tmp\645e557e03904aca48c1e0467a94de924a8359b6e5a98354a6e44aa2abeba84a.tmp" /SL5="$80052,1997786,793600,C:\Users\Admin\AppData\Local\Temp\645e557e03904aca48c1e0467a94de924a8359b6e5a98354a6e44aa2abeba84a.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:3012
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\is-F27DJ.tmp\Content.ps1"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3532
        • C:\Users\Admin\AppData\Roaming\A9sQ\ISDbg.exe
          "C:\Users\Admin\AppData\Roaming\A9sQ\ISDbg.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1864
          • C:\Users\Admin\AppData\Roaming\vkt_secure\ISDbg.exe
            C:\Users\Admin\AppData\Roaming\vkt_secure\ISDbg.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of WriteProcessMemory
            PID:5116
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\SysWOW64\cmd.exe
              6⤵
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of WriteProcessMemory
              PID:3720
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                7⤵
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of SetWindowsHookEx
                PID:1728
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RDhFOUM5MTItQjNDMS00NkI2LUI5RTgtMEFDMjc5MjczOTlFfSIgdXNlcmlkPSJ7RDk4NTJBRTMtMjgxQi00NDE2LUEyRUItOUZDMURCMjQ3RjYxfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7QTY2MkY4QzctRkQ2OS00NDBFLTkwQUItODU2NjdENkZDMUQ2fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIxIiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDQ5MjgiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxNzQzMjM4OTAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1Mjk5OTc1NTgwIi8-PC9hcHA-PC9yZXF1ZXN0Pg
    1⤵
    • System Location Discovery: System Language Discovery
    • System Network Configuration Discovery: Internet Connection Discovery
    PID:4584

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nrc5rss0.uuq.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Local\Temp\fd8b76cc

    Filesize

    1.4MB

    MD5

    6ec06f04aac07104fdac1d2a0810395a

    SHA1

    5ce5f96df301a6c617885fa26babfe3e647b72cc

    SHA256

    7556fa611a07b2ef874d53b822dd969433fa2f4669be4a68f736fc21970479f1

    SHA512

    6334d8507d906c32f4f5a37630e72fb42e96c38814ffad81b0096e6826d9c4aeaf94f521288bc97a9a953453ef1a11b20d0ad510a4e73a2c406d6428e90896fe

  • C:\Users\Admin\AppData\Local\Temp\is-F27DJ.tmp\Content.ps1

    Filesize

    7.7MB

    MD5

    e9b8abe35cac28d8b49782c5c8eceac9

    SHA1

    b01460a1d72b4cf02460a4756431f0c048e44b52

    SHA256

    efd04c82dd0838cf7cb22ac8081bc0dafcf8bc34e778795a7ca608a9ab02148b

    SHA512

    8ed1be382d9e4d624e524640739aa67ae7aa4c14c52f30a87d88b82c30bdf580560f1736e009583318b056a719f8040bc9774d9342e9eebc9798e811c8733b6c

  • C:\Users\Admin\AppData\Local\Temp\is-MD2AM.tmp\645e557e03904aca48c1e0467a94de924a8359b6e5a98354a6e44aa2abeba84a.tmp

    Filesize

    3.3MB

    MD5

    1fe979e33257ace3388bc7e809e24379

    SHA1

    b3971ba1930fa75335d82c72e19939bbbad8a342

    SHA256

    7b7aaf4dd5e9bb0a3e18a1d948e5283953122da43ea6a42244d3550ffffac3a0

    SHA512

    7533a960dfb56977955ac2d0521ef5ba8642ec0e6f1a3e18c0e19c75498a113bbd2f4dc97b56250d98aac53cc27176b912afc8435bf0792e91007e913a993135

  • C:\Users\Admin\AppData\Local\Temp\tmpAAC5.tmp

    Filesize

    20KB

    MD5

    49693267e0adbcd119f9f5e02adf3a80

    SHA1

    3ba3d7f89b8ad195ca82c92737e960e1f2b349df

    SHA256

    d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f

    SHA512

    b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2

  • C:\Users\Admin\AppData\Roaming\A9sQ\FNP_Act_Installer.dll

    Filesize

    3.2MB

    MD5

    818abbbd3717505c01e4e8277406af8f

    SHA1

    4374b855c5a37e89daa37791d1a4f2c635bf66e7

    SHA256

    bc0acdfb672ad01ad3b658ee51e2ee6523d56ea4bc4c066b390cf9b494e2aa69

    SHA512

    7c73ec9b15e82964573db1b7d3996677b244b6efa64cab60cefff6d995d3ea3e6e89c1578c5b5a266b964a19336ce5b956a4a4f37be12b4907dbee827b6613b9

  • C:\Users\Admin\AppData\Roaming\A9sQ\ISDbg.exe

    Filesize

    3.6MB

    MD5

    7ca79f128adaf85ba662d15af223acac

    SHA1

    af6d8587efe0fa22b38e623b0358e4636ac7ea65

    SHA256

    af2f747f6daa4b949ee7e418e36aee0e40de8abd3cbd4dccc26105dbfa8211d6

    SHA512

    3ac8fd62d6f4143d0704233664d19271f00bc9322239975d3403272cb9f2b4836d8329431507543f973deb353ddb80ea26befe6217a400d3c6fb5e43bc7652fd

  • C:\Users\Admin\AppData\Roaming\A9sQ\ISUIServices.dll

    Filesize

    7.1MB

    MD5

    a7339e5a1ffc622095a0320d21cb0cf6

    SHA1

    32151c80dc4c6008d07fb607e9f17251fd4082d4

    SHA256

    f9a203f8dc6eca92b47c5cff489baadcefad93af234773e7c2a71c8744e3625f

    SHA512

    5f7158ae048e04f641adc94341638d262863ae6cf7d004dc0a8385b05e910349546aca45cbb8db598ba2e75784b9834e9ddbc312555cfb041ee6a08c10a34d39

  • C:\Users\Admin\AppData\Roaming\A9sQ\MSIMG32.dll

    Filesize

    3KB

    MD5

    ae2fb3295fd4bee1e651b7b6639d7bfe

    SHA1

    4ac939d67002aabccf7a5878302a37b8079dda12

    SHA256

    c1f88d099af72cae6f6baaf7473da78279dc50b112f7fb68f93b5c3f29051c45

    SHA512

    90c2adc288547a2fec7bf6865b1341f2708ecf1e9ca78e0e440de008c5b032192998a42de0359f267e51d7ed8ee6a8e3ecc007d002d394cc5629cb81d94e9db9

  • C:\Users\Admin\AppData\Roaming\A9sQ\MSVCP140.dll

    Filesize

    437KB

    MD5

    dc739066c9d0ca961cba2f320cade28e

    SHA1

    81ed5f7861e748b90c7ae2d18da80d1409d1fa05

    SHA256

    74e9268a68118bb1ac5154f8f327887715960ccc37ba9dabbe31ecd82dcbaa55

    SHA512

    4eb181984d989156b8703fd8bb8963d7a5a3b7f981fe747c6992993b7a1395a21f45dbedf08c1483d523e772bdf41330753e1771243b53da36d2539c01171cf1

  • C:\Users\Admin\AppData\Roaming\A9sQ\bacteroid.yml

    Filesize

    1.2MB

    MD5

    0d797316bd487c5e3fc756a2bb9c661f

    SHA1

    ddda0ea9bf18ab2f0354dc9e48bf80a67f027758

    SHA256

    55968c420227a244c2fb0c2642c560ab8b76839ef9df31ced94f2be3c260ddbf

    SHA512

    573c56acd1d09f9358dc9e6172c64f19ffde40ef6f2a61a349a43065134a545f31e75b81ea4e41480a33b0e083887c403229fa67d89255634afd975fc113e609

  • C:\Users\Admin\AppData\Roaming\A9sQ\vcruntime140.dll

    Filesize

    88KB

    MD5

    1d4ff3cf64ab08c66ae9a4013c89a3ac

    SHA1

    f9ee15d0e9b0b7e04ff4c8a5de5afcffe8b2527b

    SHA256

    65f620bc588d95fe2ed236d1602e49f89077b434c83102549eed137c7fdc7220

    SHA512

    65fbd68843280e933620c470e524fba993ab4c48ede4bc0917b4ebe25da0408d02daec3f5afcd44a3ff8aba676d2eff2dda3f354029d27932ef39c9fdea51c26

  • memory/1728-191-0x0000000005000000-0x00000000051C2000-memory.dmp

    Filesize

    1.8MB

  • memory/1728-194-0x0000000005F70000-0x000000000649C000-memory.dmp

    Filesize

    5.2MB

  • memory/1728-193-0x0000000004F30000-0x0000000004F80000-memory.dmp

    Filesize

    320KB

  • memory/1728-192-0x0000000004EB0000-0x0000000004F26000-memory.dmp

    Filesize

    472KB

  • memory/1728-195-0x0000000005AE0000-0x0000000005AFE000-memory.dmp

    Filesize

    120KB

  • memory/1728-214-0x0000000007980000-0x000000000798A000-memory.dmp

    Filesize

    40KB

  • memory/1728-190-0x0000000004D40000-0x0000000004DD2000-memory.dmp

    Filesize

    584KB

  • memory/1728-189-0x0000000000800000-0x00000000008C4000-memory.dmp

    Filesize

    784KB

  • memory/1728-216-0x0000000004FE0000-0x0000000004FF2000-memory.dmp

    Filesize

    72KB

  • memory/1728-186-0x0000000071800000-0x0000000072A54000-memory.dmp

    Filesize

    18.3MB

  • memory/1728-217-0x0000000005210000-0x000000000524C000-memory.dmp

    Filesize

    240KB

  • memory/1864-145-0x000000006DDE0000-0x000000006DF5B000-memory.dmp

    Filesize

    1.5MB

  • memory/1864-146-0x00007FF968FF0000-0x00007FF9691E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1864-135-0x0000000002D60000-0x000000000348A000-memory.dmp

    Filesize

    7.2MB

  • memory/3012-175-0x0000000000F60000-0x00000000012B7000-memory.dmp

    Filesize

    3.3MB

  • memory/3012-12-0x0000000000F60000-0x00000000012B7000-memory.dmp

    Filesize

    3.3MB

  • memory/3012-14-0x0000000000F60000-0x00000000012B7000-memory.dmp

    Filesize

    3.3MB

  • memory/3012-9-0x0000000000F60000-0x00000000012B7000-memory.dmp

    Filesize

    3.3MB

  • memory/3012-10-0x0000000001770000-0x0000000001771000-memory.dmp

    Filesize

    4KB

  • memory/3012-6-0x0000000001770000-0x0000000001771000-memory.dmp

    Filesize

    4KB

  • memory/3508-176-0x0000000000090000-0x0000000000160000-memory.dmp

    Filesize

    832KB

  • memory/3508-8-0x0000000000090000-0x0000000000160000-memory.dmp

    Filesize

    832KB

  • memory/3508-0-0x0000000000090000-0x0000000000160000-memory.dmp

    Filesize

    832KB

  • memory/3508-2-0x0000000000091000-0x0000000000139000-memory.dmp

    Filesize

    672KB

  • memory/3532-96-0x000000000CE60000-0x000000000CE6A000-memory.dmp

    Filesize

    40KB

  • memory/3532-74-0x000000000C980000-0x000000000CA16000-memory.dmp

    Filesize

    600KB

  • memory/3532-100-0x000000000D5A0000-0x000000000D5AA000-memory.dmp

    Filesize

    40KB

  • memory/3532-98-0x0000000072520000-0x0000000072CD0000-memory.dmp

    Filesize

    7.7MB

  • memory/3532-97-0x000000000D580000-0x000000000D591000-memory.dmp

    Filesize

    68KB

  • memory/3532-95-0x000000000DC00000-0x000000000E27A000-memory.dmp

    Filesize

    6.5MB

  • memory/3532-93-0x000000000CCC0000-0x000000000CD63000-memory.dmp

    Filesize

    652KB

  • memory/3532-94-0x0000000072520000-0x0000000072CD0000-memory.dmp

    Filesize

    7.7MB

  • memory/3532-81-0x0000000072520000-0x0000000072CD0000-memory.dmp

    Filesize

    7.7MB

  • memory/3532-82-0x000000006EF40000-0x000000006F294000-memory.dmp

    Filesize

    3.3MB

  • memory/3532-92-0x000000000CA50000-0x000000000CA6E000-memory.dmp

    Filesize

    120KB

  • memory/3532-79-0x000000000CA70000-0x000000000CAA2000-memory.dmp

    Filesize

    200KB

  • memory/3532-53-0x000000007252E000-0x000000007252F000-memory.dmp

    Filesize

    4KB

  • memory/3532-54-0x0000000002F80000-0x0000000002FB6000-memory.dmp

    Filesize

    216KB

  • memory/3532-134-0x0000000072520000-0x0000000072CD0000-memory.dmp

    Filesize

    7.7MB

  • memory/3532-80-0x000000006EDE0000-0x000000006EE2C000-memory.dmp

    Filesize

    304KB

  • memory/3532-77-0x000000000CFD0000-0x000000000D574000-memory.dmp

    Filesize

    5.6MB

  • memory/3532-99-0x000000000D5E0000-0x000000000D5F2000-memory.dmp

    Filesize

    72KB

  • memory/3532-56-0x0000000072520000-0x0000000072CD0000-memory.dmp

    Filesize

    7.7MB

  • memory/3532-75-0x0000000006DB0000-0x0000000006DCA000-memory.dmp

    Filesize

    104KB

  • memory/3532-55-0x00000000059A0000-0x0000000005FC8000-memory.dmp

    Filesize

    6.2MB

  • memory/3532-57-0x0000000072520000-0x0000000072CD0000-memory.dmp

    Filesize

    7.7MB

  • memory/3532-76-0x0000000006E30000-0x0000000006E52000-memory.dmp

    Filesize

    136KB

  • memory/3532-72-0x00000000068B0000-0x00000000068FC000-memory.dmp

    Filesize

    304KB

  • memory/3532-71-0x0000000006860000-0x000000000687E000-memory.dmp

    Filesize

    120KB

  • memory/3532-70-0x0000000006360000-0x00000000066B4000-memory.dmp

    Filesize

    3.3MB

  • memory/3532-60-0x00000000061F0000-0x0000000006256000-memory.dmp

    Filesize

    408KB

  • memory/3532-59-0x0000000006180000-0x00000000061E6000-memory.dmp

    Filesize

    408KB

  • memory/3532-58-0x00000000058E0000-0x0000000005902000-memory.dmp

    Filesize

    136KB

  • memory/3720-184-0x0000000072C60000-0x0000000072DDB000-memory.dmp

    Filesize

    1.5MB

  • memory/3720-180-0x00007FF968FF0000-0x00007FF9691E5000-memory.dmp

    Filesize

    2.0MB

  • memory/5116-177-0x0000000072C60000-0x0000000072DDB000-memory.dmp

    Filesize

    1.5MB

  • memory/5116-173-0x00007FF968FF0000-0x00007FF9691E5000-memory.dmp

    Filesize

    2.0MB

  • memory/5116-172-0x0000000072C60000-0x0000000072DDB000-memory.dmp

    Filesize

    1.5MB