sectoprat | d8f02ea1a16fa39ab32b84265833164ff9606862e0dbd7da3f1b02b5210c69a3

General

Target

Manifest/Compil32.exe
Size

4.0MB
MD5

20d23b37c54fc1434ff3105a165cdac7
SHA1

9cb3811fb5f2ecacadc831d82e7e850abedc19ae
SHA256

8fa9074cd74cbcedc44b12999dbc5f4e51ea82caa24be18b073686229f1f9db8
SHA512

40eb9cc31a97996237e69d975efc1a3c22297403bef211427752926a331e9913801bacc7236e4a67ce988c110ccbda3dbd3e65bcc185d512cfc951b0e05fb409
SSDEEP

98304:ByzK9w6TfpPaVG5I+Juv5380exR4KuNFL3N:QWViB3Mwx

Score

10^/10

sectoprat discovery rat trojan

Malware Config

Signatures

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 1 IoCs

resource	yara_rule
behavioral1/memory/1700-81-0x0000000000400000-0x00000000004C4000-memory.dmp	family_sectoprat

Sectoprat family
sectoprat

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2464 set thread context of 2440	2464	Compil32.exe	32
PID 2440 set thread context of 1700	2440	cmd.exe	34

Executes dropped EXE 1 IoCs

pid	Process
2464	Compil32.exe

Loads dropped DLL 3 IoCs

pid	Process
2620	Compil32.exe
2464	Compil32.exe
2440	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Compil32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Compil32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2620	Compil32.exe
2464	Compil32.exe
2464	Compil32.exe
2440	cmd.exe
2440	cmd.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
2464	Compil32.exe
2440	cmd.exe
2440	cmd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1700	MSBuild.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2620 wrote to memory of 2464	2620	Compil32.exe	31
PID 2620 wrote to memory of 2464	2620	Compil32.exe	31
PID 2620 wrote to memory of 2464	2620	Compil32.exe	31
PID 2620 wrote to memory of 2464	2620	Compil32.exe	31
PID 2620 wrote to memory of 2464	2620	Compil32.exe	31
PID 2620 wrote to memory of 2464	2620	Compil32.exe	31
PID 2620 wrote to memory of 2464	2620	Compil32.exe	31
PID 2464 wrote to memory of 2440	2464	Compil32.exe	32
PID 2464 wrote to memory of 2440	2464	Compil32.exe	32
PID 2464 wrote to memory of 2440	2464	Compil32.exe	32
PID 2464 wrote to memory of 2440	2464	Compil32.exe	32
PID 2464 wrote to memory of 2440	2464	Compil32.exe	32
PID 2440 wrote to memory of 1700	2440	cmd.exe	34
PID 2440 wrote to memory of 1700	2440	cmd.exe	34
PID 2440 wrote to memory of 1700	2440	cmd.exe	34
PID 2440 wrote to memory of 1700	2440	cmd.exe	34
PID 2440 wrote to memory of 1700	2440	cmd.exe	34
PID 2440 wrote to memory of 1700	2440	cmd.exe	34

C:\Users\Admin\AppData\Local\Temp\Manifest\Compil32.exe
"C:\Users\Admin\AppData\Local\Temp\Manifest\Compil32.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2620
- C:\Users\Admin\AppData\Roaming\WordpadHelp_alpha\Compil32.exe
  C:\Users\Admin\AppData\Roaming\WordpadHelp_alpha\Compil32.exe
  2⤵
  - Suspicious use of SetThreadContext
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2464
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\SysWOW64\cmd.exe
    3⤵
    - Suspicious use of SetThreadContext
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:2440
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\21aa64fb

Filesize
1.4MB

MD5
589af14d1ad55636de4906a19f6f957b

SHA1
37a0f97af1f16d3aad61076ba4925f1768a5527e

SHA256
7a18313aaedff5fdb204f5df0219d5976e0722a53fec7235bc2a0dc9dee4ca7b

SHA512
8e1fcc6a1eb947580d08006678d6584b7ce5b4209dcf10059fc4ae3546f690040a5cb6fa0a6e11eff168497466ecc554fd1d6ca227fcfe5ae32745621552cfb0

Download Submit
C:\Users\Admin\AppData\Roaming\WordpadHelp_alpha\ISCmplr.dll

Filesize
1.4MB

MD5
4a6dbda25a80cbb1df9ce69ff6fa6303

SHA1
d069c82c6b34b36d336c7b15bf0dae5410c8fd46

SHA256
5bd542000aa5585f44e07ba88e0fb52660566209f76adf85926093446447b113

SHA512
215287711399aa26ebcc5e300fb35487f32a7c1897e2158f00fa06764520890fb4d7670b275b1e48d763d950816519f79a491738794b7e417602f17e9634fe6b

Download Submit
C:\Users\Admin\AppData\Roaming\WordpadHelp_alpha\chiliad.tar.gz

Filesize
1.2MB

MD5
a267bf243eeee769163e561036edb71f

SHA1
39217f9da3fe30273f260c10626fe13a38fbec4b

SHA256
199d4cc63746edb09d4147b7ba375ffe952eae4a4d6e0082e37759e549058cb8

SHA512
71499a7141aaa06ab479c9363b0f83538ad79adbbfda1e9fbca11871c3db5e868ce5538c79165fa77fafa765bf3d3d1a57ea18c492b5a2588af3747cc63d779b

Download Submit
C:\Users\Admin\AppData\Roaming\WordpadHelp_alpha\junco.zip

Filesize
26KB

MD5
caae9ed08d157b0ddccf9d2b587b7438

SHA1
1c6a9948b47c85622ebe40a16d8dd9edf13c1823

SHA256
a6f6c770d169d8078676ec322b8c2366b636e0da957a1a146fa51d425c31d149

SHA512
90d4608e40905416558598f65d8af2bd76140010c588fe1eb7602ab9dc97c0c027c159c744483c3bb70c6f99b5c25218a20e945ce494affb61239f8ccdab6e50

Download Submit
\Users\Admin\AppData\Roaming\WordpadHelp_alpha\Compil32.exe

Filesize
4.0MB

MD5
20d23b37c54fc1434ff3105a165cdac7

SHA1
9cb3811fb5f2ecacadc831d82e7e850abedc19ae

SHA256
8fa9074cd74cbcedc44b12999dbc5f4e51ea82caa24be18b073686229f1f9db8

SHA512
40eb9cc31a97996237e69d975efc1a3c22297403bef211427752926a331e9913801bacc7236e4a67ce988c110ccbda3dbd3e65bcc185d512cfc951b0e05fb409

Download Submit
memory/1700-81-0x0000000000400000-0x00000000004C4000-memory.dmp

Filesize
784KB

Download
memory/1700-77-0x0000000072DA0000-0x0000000073E02000-memory.dmp

Filesize
16.4MB

Download
memory/1700-79-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1700-80-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2440-75-0x0000000074F60000-0x00000000750D4000-memory.dmp

Filesize
1.5MB

Download
memory/2440-74-0x0000000074F60000-0x00000000750D4000-memory.dmp

Filesize
1.5MB

Download
memory/2440-78-0x0000000074F60000-0x00000000750D4000-memory.dmp

Filesize
1.5MB

Download
memory/2440-26-0x0000000077820000-0x00000000779C9000-memory.dmp

Filesize
1.7MB

Download
memory/2440-24-0x0000000074F60000-0x00000000750D4000-memory.dmp

Filesize
1.5MB

Download
memory/2464-17-0x0000000077820000-0x00000000779C9000-memory.dmp

Filesize
1.7MB

Download
memory/2464-23-0x0000000000800000-0x000000000097C000-memory.dmp

Filesize
1.5MB

Download
memory/2464-22-0x0000000001380000-0x0000000001784000-memory.dmp

Filesize
4.0MB

Download
memory/2464-20-0x0000000074F60000-0x00000000750D4000-memory.dmp

Filesize
1.5MB

Download
memory/2464-19-0x0000000074F60000-0x00000000750D4000-memory.dmp

Filesize
1.5MB

Download
memory/2464-18-0x0000000074F73000-0x0000000074F75000-memory.dmp

Filesize
8KB

Download
memory/2464-16-0x0000000074F60000-0x00000000750D4000-memory.dmp

Filesize
1.5MB

Download
memory/2620-0-0x0000000074C20000-0x0000000074D94000-memory.dmp

Filesize
1.5MB

Download
memory/2620-12-0x0000000000800000-0x000000000097C000-memory.dmp

Filesize
1.5MB

Download
memory/2620-10-0x0000000000E70000-0x0000000001274000-memory.dmp

Filesize
4.0MB

Download
memory/2620-1-0x0000000077820000-0x00000000779C9000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing