sectoprat | d8f02ea1a16fa39ab32b84265833164ff9606862e0dbd7da3f1b02b5210c69a3

General

Target

Manifest/Compil32.exe
Size

4.0MB
MD5

20d23b37c54fc1434ff3105a165cdac7
SHA1

9cb3811fb5f2ecacadc831d82e7e850abedc19ae
SHA256

8fa9074cd74cbcedc44b12999dbc5f4e51ea82caa24be18b073686229f1f9db8
SHA512

40eb9cc31a97996237e69d975efc1a3c22297403bef211427752926a331e9913801bacc7236e4a67ce988c110ccbda3dbd3e65bcc185d512cfc951b0e05fb409
SSDEEP

98304:ByzK9w6TfpPaVG5I+Juv5380exR4KuNFL3N:QWViB3Mwx

Score

10^/10

sectoprat discovery rat trojan

Malware Config

Signatures

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 1 IoCs

resource	yara_rule
behavioral1/memory/1864-82-0x0000000000400000-0x00000000004C4000-memory.dmp	family_sectoprat

Sectoprat family
sectoprat

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1040 set thread context of 2860	1040	Compil32.exe	30
PID 2860 set thread context of 1864	2860	cmd.exe	32

Executes dropped EXE 1 IoCs

pid	Process
1040	Compil32.exe

Loads dropped DLL 3 IoCs

pid	Process
932	Compil32.exe
1040	Compil32.exe
2860	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Compil32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Compil32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
932	Compil32.exe
1040	Compil32.exe
1040	Compil32.exe
2860	cmd.exe
2860	cmd.exe
1864	MSBuild.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
1040	Compil32.exe
2860	cmd.exe
2860	cmd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1864	MSBuild.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1864	MSBuild.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 932 wrote to memory of 1040	932	Compil32.exe	29
PID 932 wrote to memory of 1040	932	Compil32.exe	29
PID 932 wrote to memory of 1040	932	Compil32.exe	29
PID 932 wrote to memory of 1040	932	Compil32.exe	29
PID 932 wrote to memory of 1040	932	Compil32.exe	29
PID 932 wrote to memory of 1040	932	Compil32.exe	29
PID 932 wrote to memory of 1040	932	Compil32.exe	29
PID 1040 wrote to memory of 2860	1040	Compil32.exe	30
PID 1040 wrote to memory of 2860	1040	Compil32.exe	30
PID 1040 wrote to memory of 2860	1040	Compil32.exe	30
PID 1040 wrote to memory of 2860	1040	Compil32.exe	30
PID 1040 wrote to memory of 2860	1040	Compil32.exe	30
PID 2860 wrote to memory of 1864	2860	cmd.exe	32
PID 2860 wrote to memory of 1864	2860	cmd.exe	32
PID 2860 wrote to memory of 1864	2860	cmd.exe	32
PID 2860 wrote to memory of 1864	2860	cmd.exe	32
PID 2860 wrote to memory of 1864	2860	cmd.exe	32
PID 2860 wrote to memory of 1864	2860	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\Manifest\Compil32.exe
"C:\Users\Admin\AppData\Local\Temp\Manifest\Compil32.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:932
- C:\Users\Admin\AppData\Roaming\WordpadHelp_alpha\Compil32.exe
  C:\Users\Admin\AppData\Roaming\WordpadHelp_alpha\Compil32.exe
  2⤵
  - Suspicious use of SetThreadContext
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1040
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\SysWOW64\cmd.exe
    3⤵
    - Suspicious use of SetThreadContext
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:2860
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:1864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2871a72b

Filesize
1.4MB

MD5
283c76135cf29a9714016bfacc320cc6

SHA1
cbae339fb88a001a4857e4af8109bb0fb6514168

SHA256
e9f2d2133c3607afb1c5e586034d1f39cdea389b66c95b195aa81170ede11913

SHA512
e1f6ca9bd53d78e24cbed7f4363d4fe7113326b342648d7496ed7713cbb339d704d8d7c5d20e40ca83e4beab8b32f32c37a71e021715d4a3a6b26a8c3a6b55a5

Download Submit
C:\Users\Admin\AppData\Roaming\WordpadHelp_alpha\ISCmplr.dll

Filesize
1.4MB

MD5
4a6dbda25a80cbb1df9ce69ff6fa6303

SHA1
d069c82c6b34b36d336c7b15bf0dae5410c8fd46

SHA256
5bd542000aa5585f44e07ba88e0fb52660566209f76adf85926093446447b113

SHA512
215287711399aa26ebcc5e300fb35487f32a7c1897e2158f00fa06764520890fb4d7670b275b1e48d763d950816519f79a491738794b7e417602f17e9634fe6b

Download Submit
C:\Users\Admin\AppData\Roaming\WordpadHelp_alpha\chiliad.tar.gz

Filesize
1.2MB

MD5
a267bf243eeee769163e561036edb71f

SHA1
39217f9da3fe30273f260c10626fe13a38fbec4b

SHA256
199d4cc63746edb09d4147b7ba375ffe952eae4a4d6e0082e37759e549058cb8

SHA512
71499a7141aaa06ab479c9363b0f83538ad79adbbfda1e9fbca11871c3db5e868ce5538c79165fa77fafa765bf3d3d1a57ea18c492b5a2588af3747cc63d779b

Download Submit
C:\Users\Admin\AppData\Roaming\WordpadHelp_alpha\junco.zip

Filesize
26KB

MD5
caae9ed08d157b0ddccf9d2b587b7438

SHA1
1c6a9948b47c85622ebe40a16d8dd9edf13c1823

SHA256
a6f6c770d169d8078676ec322b8c2366b636e0da957a1a146fa51d425c31d149

SHA512
90d4608e40905416558598f65d8af2bd76140010c588fe1eb7602ab9dc97c0c027c159c744483c3bb70c6f99b5c25218a20e945ce494affb61239f8ccdab6e50

Download Submit
\Users\Admin\AppData\Roaming\WordpadHelp_alpha\Compil32.exe

Filesize
4.0MB

MD5
20d23b37c54fc1434ff3105a165cdac7

SHA1
9cb3811fb5f2ecacadc831d82e7e850abedc19ae

SHA256
8fa9074cd74cbcedc44b12999dbc5f4e51ea82caa24be18b073686229f1f9db8

SHA512
40eb9cc31a97996237e69d975efc1a3c22297403bef211427752926a331e9913801bacc7236e4a67ce988c110ccbda3dbd3e65bcc185d512cfc951b0e05fb409

Download Submit
memory/932-0-0x0000000075210000-0x0000000075384000-memory.dmp

Filesize
1.5MB

Download
memory/932-1-0x0000000077C90000-0x0000000077E39000-memory.dmp

Filesize
1.7MB

Download
memory/932-11-0x0000000000800000-0x000000000097C000-memory.dmp

Filesize
1.5MB

Download
memory/932-9-0x0000000001000000-0x0000000001404000-memory.dmp

Filesize
4.0MB

Download
memory/1040-21-0x0000000075120000-0x0000000075294000-memory.dmp

Filesize
1.5MB

Download
memory/1040-20-0x0000000075133000-0x0000000075135000-memory.dmp

Filesize
8KB

Download
memory/1040-18-0x0000000075120000-0x0000000075294000-memory.dmp

Filesize
1.5MB

Download
memory/1040-24-0x0000000000330000-0x0000000000734000-memory.dmp

Filesize
4.0MB

Download
memory/1040-26-0x0000000075120000-0x0000000075294000-memory.dmp

Filesize
1.5MB

Download
memory/1040-14-0x0000000000A60000-0x0000000000BDC000-memory.dmp

Filesize
1.5MB

Download
memory/1040-19-0x0000000077C90000-0x0000000077E39000-memory.dmp

Filesize
1.7MB

Download
memory/1040-25-0x0000000000A60000-0x0000000000BDC000-memory.dmp

Filesize
1.5MB

Download
memory/1864-79-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1864-82-0x0000000000400000-0x00000000004C4000-memory.dmp

Filesize
784KB

Download
memory/1864-78-0x00000000732C0000-0x0000000074322000-memory.dmp

Filesize
16.4MB

Download
memory/1864-80-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2860-27-0x0000000075120000-0x0000000075294000-memory.dmp

Filesize
1.5MB

Download
memory/2860-76-0x0000000075120000-0x0000000075294000-memory.dmp

Filesize
1.5MB

Download
memory/2860-81-0x0000000075120000-0x0000000075294000-memory.dmp

Filesize
1.5MB

Download
memory/2860-29-0x0000000077C90000-0x0000000077E39000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing