sectoprat | d8f02ea1a16fa39ab32b84265833164ff9606862e0dbd7da3f1b02b5210c69a3

General

Target

Manifest/Compil32.exe
Size

4.0MB
MD5

20d23b37c54fc1434ff3105a165cdac7
SHA1

9cb3811fb5f2ecacadc831d82e7e850abedc19ae
SHA256

8fa9074cd74cbcedc44b12999dbc5f4e51ea82caa24be18b073686229f1f9db8
SHA512

40eb9cc31a97996237e69d975efc1a3c22297403bef211427752926a331e9913801bacc7236e4a67ce988c110ccbda3dbd3e65bcc185d512cfc951b0e05fb409
SSDEEP

98304:ByzK9w6TfpPaVG5I+Juv5380exR4KuNFL3N:QWViB3Mwx

Score

10^/10

sectoprat discovery rat trojan

Malware Config

Signatures

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/4712-34-0x0000000000900000-0x00000000009C4000-memory.dmp	family_sectoprat

Sectoprat family
sectoprat

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2052 set thread context of 2388	2052	Compil32.exe	83
PID 2388 set thread context of 4712	2388	cmd.exe	86

Executes dropped EXE 1 IoCs

pid	Process
2052	Compil32.exe

Loads dropped DLL 1 IoCs

pid	Process
2052	Compil32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Compil32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Compil32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1800	Compil32.exe
2052	Compil32.exe
2052	Compil32.exe
2388	cmd.exe
2388	cmd.exe
4712	MSBuild.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
2052	Compil32.exe
2388	cmd.exe
2388	cmd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4712	MSBuild.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4712	MSBuild.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 2052	1800	Compil32.exe	82
PID 1800 wrote to memory of 2052	1800	Compil32.exe	82
PID 1800 wrote to memory of 2052	1800	Compil32.exe	82
PID 2052 wrote to memory of 2388	2052	Compil32.exe	83
PID 2052 wrote to memory of 2388	2052	Compil32.exe	83
PID 2052 wrote to memory of 2388	2052	Compil32.exe	83
PID 2052 wrote to memory of 2388	2052	Compil32.exe	83
PID 2388 wrote to memory of 4712	2388	cmd.exe	86
PID 2388 wrote to memory of 4712	2388	cmd.exe	86
PID 2388 wrote to memory of 4712	2388	cmd.exe	86
PID 2388 wrote to memory of 4712	2388	cmd.exe	86
PID 2388 wrote to memory of 4712	2388	cmd.exe	86

C:\Users\Admin\AppData\Local\Temp\Manifest\Compil32.exe
"C:\Users\Admin\AppData\Local\Temp\Manifest\Compil32.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Users\Admin\AppData\Roaming\WordpadHelp_alpha\Compil32.exe
  C:\Users\Admin\AppData\Roaming\WordpadHelp_alpha\Compil32.exe
  2⤵
  - Suspicious use of SetThreadContext
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2052
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\SysWOW64\cmd.exe
    3⤵
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:2388
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:4712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\343fb76f

Filesize
1.4MB

MD5
eaaccc84c95119b3be71b5405e87bbd5

SHA1
86388105c7adb7d7e67c3649fa307ad2328bedc3

SHA256
29232e60a4e658b88b65efd14716455cc6b01004d149c9da82f9c509e6ee4b46

SHA512
a5c463d16e42a80317c0b23a5d7900874727a056081be0c13327f0e2b5366668a8c601f733c6f6056d65b45dc01b0ea672f91ea35bd53b640559567968a01680

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp398C.tmp

Filesize
20KB

MD5
49693267e0adbcd119f9f5e02adf3a80

SHA1
3ba3d7f89b8ad195ca82c92737e960e1f2b349df

SHA256
d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f

SHA512
b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2

Download Submit
C:\Users\Admin\AppData\Roaming\WordpadHelp_alpha\Compil32.exe

Filesize
4.0MB

MD5
20d23b37c54fc1434ff3105a165cdac7

SHA1
9cb3811fb5f2ecacadc831d82e7e850abedc19ae

SHA256
8fa9074cd74cbcedc44b12999dbc5f4e51ea82caa24be18b073686229f1f9db8

SHA512
40eb9cc31a97996237e69d975efc1a3c22297403bef211427752926a331e9913801bacc7236e4a67ce988c110ccbda3dbd3e65bcc185d512cfc951b0e05fb409

Download Submit
C:\Users\Admin\AppData\Roaming\WordpadHelp_alpha\ISCmplr.dll

Filesize
1.4MB

MD5
4a6dbda25a80cbb1df9ce69ff6fa6303

SHA1
d069c82c6b34b36d336c7b15bf0dae5410c8fd46

SHA256
5bd542000aa5585f44e07ba88e0fb52660566209f76adf85926093446447b113

SHA512
215287711399aa26ebcc5e300fb35487f32a7c1897e2158f00fa06764520890fb4d7670b275b1e48d763d950816519f79a491738794b7e417602f17e9634fe6b

Download Submit
C:\Users\Admin\AppData\Roaming\WordpadHelp_alpha\chiliad.tar.gz

Filesize
1.2MB

MD5
a267bf243eeee769163e561036edb71f

SHA1
39217f9da3fe30273f260c10626fe13a38fbec4b

SHA256
199d4cc63746edb09d4147b7ba375ffe952eae4a4d6e0082e37759e549058cb8

SHA512
71499a7141aaa06ab479c9363b0f83538ad79adbbfda1e9fbca11871c3db5e868ce5538c79165fa77fafa765bf3d3d1a57ea18c492b5a2588af3747cc63d779b

Download Submit
C:\Users\Admin\AppData\Roaming\WordpadHelp_alpha\junco.zip

Filesize
26KB

MD5
caae9ed08d157b0ddccf9d2b587b7438

SHA1
1c6a9948b47c85622ebe40a16d8dd9edf13c1823

SHA256
a6f6c770d169d8078676ec322b8c2366b636e0da957a1a146fa51d425c31d149

SHA512
90d4608e40905416558598f65d8af2bd76140010c588fe1eb7602ab9dc97c0c027c159c744483c3bb70c6f99b5c25218a20e945ce494affb61239f8ccdab6e50

Download Submit
memory/1800-1-0x00007FFF06A70000-0x00007FFF06C65000-memory.dmp

Filesize
2.0MB

Download
memory/1800-13-0x0000000074CB0000-0x0000000074E2C000-memory.dmp

Filesize
1.5MB

Download
memory/1800-8-0x00000000007F0000-0x0000000000BF4000-memory.dmp

Filesize
4.0MB

Download
memory/1800-0-0x00000000749A0000-0x0000000074B1B000-memory.dmp

Filesize
1.5MB

Download
memory/2052-14-0x0000000074CB0000-0x0000000074E2B000-memory.dmp

Filesize
1.5MB

Download
memory/2052-15-0x00007FFF06A70000-0x00007FFF06C65000-memory.dmp

Filesize
2.0MB

Download
memory/2052-18-0x0000000074CB0000-0x0000000074E2B000-memory.dmp

Filesize
1.5MB

Download
memory/2052-20-0x0000000000760000-0x0000000000B64000-memory.dmp

Filesize
4.0MB

Download
memory/2052-21-0x0000000074580000-0x00000000746FC000-memory.dmp

Filesize
1.5MB

Download
memory/2052-16-0x0000000074CC3000-0x0000000074CC5000-memory.dmp

Filesize
8KB

Download
memory/2052-17-0x0000000074CB0000-0x0000000074E2B000-memory.dmp

Filesize
1.5MB

Download
memory/2388-22-0x0000000074CB0000-0x0000000074E2B000-memory.dmp

Filesize
1.5MB

Download
memory/2388-24-0x00007FFF06A70000-0x00007FFF06C65000-memory.dmp

Filesize
2.0MB

Download
memory/2388-27-0x0000000074CB0000-0x0000000074E2B000-memory.dmp

Filesize
1.5MB

Download
memory/2388-28-0x0000000074CB0000-0x0000000074E2B000-memory.dmp

Filesize
1.5MB

Download
memory/2388-30-0x0000000074CB0000-0x0000000074E2B000-memory.dmp

Filesize
1.5MB

Download
memory/4712-31-0x0000000072FE0000-0x0000000074234000-memory.dmp

Filesize
18.3MB

Download
memory/4712-35-0x0000000004F80000-0x0000000005012000-memory.dmp

Filesize
584KB

Download
memory/4712-36-0x00000000055D0000-0x0000000005B74000-memory.dmp

Filesize
5.6MB

Download
memory/4712-37-0x0000000004F50000-0x0000000004F5A000-memory.dmp

Filesize
40KB

Download
memory/4712-38-0x00000000052B0000-0x0000000005472000-memory.dmp

Filesize
1.8MB

Download
memory/4712-39-0x00000000050E0000-0x0000000005156000-memory.dmp

Filesize
472KB

Download
memory/4712-40-0x0000000005080000-0x00000000050D0000-memory.dmp

Filesize
320KB

Download
memory/4712-41-0x00000000061B0000-0x00000000066DC000-memory.dmp

Filesize
5.2MB

Download
memory/4712-42-0x0000000005D30000-0x0000000005D4E000-memory.dmp

Filesize
120KB

Download
memory/4712-43-0x0000000005E10000-0x0000000005E76000-memory.dmp

Filesize
408KB

Download
memory/4712-34-0x0000000000900000-0x00000000009C4000-memory.dmp

Filesize
784KB

Download
memory/4712-56-0x0000000007740000-0x000000000774A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing