sectoprat | 6d97edcab4d3d2e18c5d321b443be7b6d21084a305413de465a4e92f6df720c5

General

Target

Manifest/SplashWin.exe
Size

446KB
MD5

4d20b83562eec3660e45027ad56fb444
SHA1

ff6134c34500a8f8e5881e6a34263e5796f83667
SHA256

c5e650b331fa5292872fdaede3a75c8167a0f1280ce0cd3d58b880d23854bdb1
SHA512

718bd66fcff80b8008a4523d88bd726cdbc95e6e7bdb3f50e337e291294505ed54e6f5995d431968b85415e96f6f7ed37381ca021401ad57fda3b08a1f0c27f4
SSDEEP

3072:unfVdw78434ei8HQbmiFp4KA+3Glxlwim2n/Xq0DdMqsxN4GnLG5N:W9dKxn/Xq082GLGX

Score

10^/10

sectoprat discovery rat spyware trojan

Malware Config

Signatures

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 1 IoCs

resource	yara_rule
behavioral4/memory/4480-37-0x0000000000500000-0x00000000005C4000-memory.dmp	family_sectoprat

Sectoprat family
sectoprat
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2728 set thread context of 3552	2728	SplashWin.exe	90
PID 3552 set thread context of 4480	3552	cmd.exe	96

Executes dropped EXE 1 IoCs

pid	Process
2728	SplashWin.exe

Loads dropped DLL 3 IoCs

pid	Process
2728	SplashWin.exe
2728	SplashWin.exe
2728	SplashWin.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SplashWin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SplashWin.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
264	SplashWin.exe
2728	SplashWin.exe
2728	SplashWin.exe
3552	cmd.exe
3552	cmd.exe
4480	MSBuild.exe
4480	MSBuild.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
2728	SplashWin.exe
3552	cmd.exe
3552	cmd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4480	MSBuild.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4480	MSBuild.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 264 wrote to memory of 2728	264	SplashWin.exe	89
PID 264 wrote to memory of 2728	264	SplashWin.exe	89
PID 264 wrote to memory of 2728	264	SplashWin.exe	89
PID 2728 wrote to memory of 3552	2728	SplashWin.exe	90
PID 2728 wrote to memory of 3552	2728	SplashWin.exe	90
PID 2728 wrote to memory of 3552	2728	SplashWin.exe	90
PID 2728 wrote to memory of 3552	2728	SplashWin.exe	90
PID 3552 wrote to memory of 4480	3552	cmd.exe	96
PID 3552 wrote to memory of 4480	3552	cmd.exe	96
PID 3552 wrote to memory of 4480	3552	cmd.exe	96
PID 3552 wrote to memory of 4480	3552	cmd.exe	96
PID 3552 wrote to memory of 4480	3552	cmd.exe	96

C:\Users\Admin\AppData\Local\Temp\Manifest\SplashWin.exe
"C:\Users\Admin\AppData\Local\Temp\Manifest\SplashWin.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:264
- C:\Users\Admin\AppData\Roaming\Okjcontrol_alpha\SplashWin.exe
  C:\Users\Admin\AppData\Roaming\Okjcontrol_alpha\SplashWin.exe
  2⤵
  - Suspicious use of SetThreadContext
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2728
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\SysWOW64\cmd.exe
    3⤵
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:3552
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:4480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\70dd64d7

Filesize
1.4MB

MD5
15590b136fce29971dd47b4bdbe7541e

SHA1
2ebf56929be0de9b8a53095f714b1fcc6eac9416

SHA256
f25d57f60ddce0e35bd05cea808846767dee92d122f5643d621a576458724d71

SHA512
b888c2d97b919e1a5a31f524d3fbde3e8604d7be40f127b65fcae6ba5329f4431ad94aa9c2d82009cb810af4b8fbcd6ceba44f102d33c98455401b701bb3af3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp53DB.tmp

Filesize
20KB

MD5
49693267e0adbcd119f9f5e02adf3a80

SHA1
3ba3d7f89b8ad195ca82c92737e960e1f2b349df

SHA256
d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f

SHA512
b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2

Download Submit
C:\Users\Admin\AppData\Roaming\Okjcontrol_alpha\DuiLib_u.dll

Filesize
840KB

MD5
27cdf66f9b92629a7dc8109d9590efec

SHA1
fc96fa0eae6d60adea067f17e9de063597f3227e

SHA256
5919ad0385b6465801fb44c00a79ec224a14cb8655c883ba4b564449fa3dcefd

SHA512
90f9bcacab284fa91d051a73f197b17049801130cf17df5f8b7656b92c19deccbd72659d12226897f47d16da37cf05fca96be5cf3688ff8bc297630e9c2ab554

Download Submit
C:\Users\Admin\AppData\Roaming\Okjcontrol_alpha\MSVCP140.dll

Filesize
437KB

MD5
e9f00dd8746712610706cbeffd8df0bd

SHA1
5004d98c89a40ebf35f51407553e38e5ca16fb98

SHA256
4cb882621a3d1c6283570447f842801b396db1b3dcd2e01c2f7002efd66a0a97

SHA512
4d1ce1fc92cea60859b27ca95ca1d1a7c2bec4e2356f87659a69bab9c1befa7a94a2c64669cef1c9dadf9d38ab77e836fe69acdda0f95fa1b32cba9e8c6bb554

Download Submit
C:\Users\Admin\AppData\Roaming\Okjcontrol_alpha\SplashWin.exe

Filesize
446KB

MD5
4d20b83562eec3660e45027ad56fb444

SHA1
ff6134c34500a8f8e5881e6a34263e5796f83667

SHA256
c5e650b331fa5292872fdaede3a75c8167a0f1280ce0cd3d58b880d23854bdb1

SHA512
718bd66fcff80b8008a4523d88bd726cdbc95e6e7bdb3f50e337e291294505ed54e6f5995d431968b85415e96f6f7ed37381ca021401ad57fda3b08a1f0c27f4

Download Submit
C:\Users\Admin\AppData\Roaming\Okjcontrol_alpha\VCRUNTIME140.dll

Filesize
74KB

MD5
a554e4f1addc0c2c4ebb93d66b790796

SHA1
9fbd1d222da47240db92cd6c50625eb0cf650f61

SHA256
e610cdac0a37147919032d0d723b967276c217ff06ea402f098696ab4112512a

SHA512
5f3253f071da3e0110def888682d255186f2e2a30a8480791c0cad74029420033b5c90f818ae845b5f041ee4005f6de174a687aca8f858371026423f017902cc

Download Submit
C:\Users\Admin\AppData\Roaming\Okjcontrol_alpha\basinful.odp

Filesize
58KB

MD5
984e6cd075b61eb5993f0a103c37e6cd

SHA1
8ef89a1fe86c6b5e34b50962738bee7fd1f40cae

SHA256
37cfc0ece89f5b3acd99a90d56357f1bf27d35a10977bb2fac6a1d2ddc649258

SHA512
af0c3625c29e95c9693ba7f2164941453d1e0aec74eddda1f74ec412e732a697987074ca29c9d0c6b5b7571014a212f4295d19cb10be7616c1feca032bdf321c

Download Submit
C:\Users\Admin\AppData\Roaming\Okjcontrol_alpha\fief.jpeg

Filesize
1.2MB

MD5
776dfb2df48b4b0f7c61e479947eff09

SHA1
ab5d027e709454744415a4c0ea784ae3c5c4b7b3

SHA256
72dfeecd64ba9b22a268040dc5af779b13e450712b1067f7a501be82bf5aad88

SHA512
f6fbca8845de0910e2db49ce71c8c57222a8c3a036685d9d1b8a6fb2d072047228671bc55a477074e20e5e8d3e4218699ebcdb0d0f9533e2d3ee6861407e014e

Download Submit
memory/264-0-0x0000000075200000-0x000000007537B000-memory.dmp

Filesize
1.5MB

Download
memory/264-1-0x00007FFB4DF10000-0x00007FFB4E105000-memory.dmp

Filesize
2.0MB

Download
memory/2728-19-0x0000000075200000-0x000000007537B000-memory.dmp

Filesize
1.5MB

Download
memory/2728-20-0x00007FFB4DF10000-0x00007FFB4E105000-memory.dmp

Filesize
2.0MB

Download
memory/2728-21-0x0000000075213000-0x0000000075215000-memory.dmp

Filesize
8KB

Download
memory/2728-22-0x0000000075200000-0x000000007537B000-memory.dmp

Filesize
1.5MB

Download
memory/2728-23-0x0000000075200000-0x000000007537B000-memory.dmp

Filesize
1.5MB

Download
memory/3552-30-0x0000000075200000-0x000000007537B000-memory.dmp

Filesize
1.5MB

Download
memory/3552-27-0x00007FFB4DF10000-0x00007FFB4E105000-memory.dmp

Filesize
2.0MB

Download
memory/3552-31-0x0000000075200000-0x000000007537B000-memory.dmp

Filesize
1.5MB

Download
memory/3552-33-0x0000000075200000-0x000000007537B000-memory.dmp

Filesize
1.5MB

Download
memory/3552-25-0x0000000075200000-0x000000007537B000-memory.dmp

Filesize
1.5MB

Download
memory/4480-41-0x0000000004FE0000-0x00000000051A2000-memory.dmp

Filesize
1.8MB

Download
memory/4480-44-0x0000000005E40000-0x000000000636C000-memory.dmp

Filesize
5.2MB

Download
memory/4480-39-0x0000000005260000-0x0000000005804000-memory.dmp

Filesize
5.6MB

Download
memory/4480-40-0x0000000004B20000-0x0000000004B2A000-memory.dmp

Filesize
40KB

Download
memory/4480-37-0x0000000000500000-0x00000000005C4000-memory.dmp

Filesize
784KB

Download
memory/4480-42-0x0000000004CB0000-0x0000000004D26000-memory.dmp

Filesize
472KB

Download
memory/4480-43-0x0000000004BC0000-0x0000000004C10000-memory.dmp

Filesize
320KB

Download
memory/4480-38-0x0000000004C10000-0x0000000004CA2000-memory.dmp

Filesize
584KB

Download
memory/4480-45-0x0000000005910000-0x000000000592E000-memory.dmp

Filesize
120KB

Download
memory/4480-46-0x00000000059F0000-0x0000000005A56000-memory.dmp

Filesize
408KB

Download
memory/4480-34-0x0000000073CD0000-0x0000000074F24000-memory.dmp

Filesize
18.3MB

Download
memory/4480-59-0x0000000007460000-0x000000000746A000-memory.dmp

Filesize
40KB

Download
memory/4480-60-0x0000000004DD0000-0x0000000004DE2000-memory.dmp

Filesize
72KB

Download
memory/4480-61-0x0000000004E50000-0x0000000004E8C000-memory.dmp

Filesize
240KB

Download

Analysis

Sharing