sectoprat | d8f02ea1a16fa39ab32b84265833164ff9606862e0dbd7da3f1b02b5210c69a3

General

Target

Manifest/Compil32.exe
Size

4.0MB
MD5

20d23b37c54fc1434ff3105a165cdac7
SHA1

9cb3811fb5f2ecacadc831d82e7e850abedc19ae
SHA256

8fa9074cd74cbcedc44b12999dbc5f4e51ea82caa24be18b073686229f1f9db8
SHA512

40eb9cc31a97996237e69d975efc1a3c22297403bef211427752926a331e9913801bacc7236e4a67ce988c110ccbda3dbd3e65bcc185d512cfc951b0e05fb409
SSDEEP

98304:ByzK9w6TfpPaVG5I+Juv5380exR4KuNFL3N:QWViB3Mwx

Score

10^/10

sectoprat discovery rat trojan

Malware Config

Signatures

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 1 IoCs

resource	yara_rule
behavioral1/memory/2968-81-0x0000000000400000-0x00000000004C4000-memory.dmp	family_sectoprat

Sectoprat family
sectoprat

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2800 set thread context of 2876	2800	Compil32.exe	31
PID 2876 set thread context of 2968	2876	cmd.exe	33

Executes dropped EXE 1 IoCs

pid	Process
2800	Compil32.exe

Loads dropped DLL 3 IoCs

pid	Process
2208	Compil32.exe
2800	Compil32.exe
2876	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Compil32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Compil32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2208	Compil32.exe
2800	Compil32.exe
2800	Compil32.exe
2876	cmd.exe
2876	cmd.exe
2968	MSBuild.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
2800	Compil32.exe
2876	cmd.exe
2876	cmd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2968	MSBuild.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2968	MSBuild.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 2800	2208	Compil32.exe	30
PID 2208 wrote to memory of 2800	2208	Compil32.exe	30
PID 2208 wrote to memory of 2800	2208	Compil32.exe	30
PID 2208 wrote to memory of 2800	2208	Compil32.exe	30
PID 2208 wrote to memory of 2800	2208	Compil32.exe	30
PID 2208 wrote to memory of 2800	2208	Compil32.exe	30
PID 2208 wrote to memory of 2800	2208	Compil32.exe	30
PID 2800 wrote to memory of 2876	2800	Compil32.exe	31
PID 2800 wrote to memory of 2876	2800	Compil32.exe	31
PID 2800 wrote to memory of 2876	2800	Compil32.exe	31
PID 2800 wrote to memory of 2876	2800	Compil32.exe	31
PID 2800 wrote to memory of 2876	2800	Compil32.exe	31
PID 2876 wrote to memory of 2968	2876	cmd.exe	33
PID 2876 wrote to memory of 2968	2876	cmd.exe	33
PID 2876 wrote to memory of 2968	2876	cmd.exe	33
PID 2876 wrote to memory of 2968	2876	cmd.exe	33
PID 2876 wrote to memory of 2968	2876	cmd.exe	33
PID 2876 wrote to memory of 2968	2876	cmd.exe	33

C:\Users\Admin\AppData\Local\Temp\Manifest\Compil32.exe
"C:\Users\Admin\AppData\Local\Temp\Manifest\Compil32.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Users\Admin\AppData\Roaming\WordpadHelp_alpha\Compil32.exe
  C:\Users\Admin\AppData\Roaming\WordpadHelp_alpha\Compil32.exe
  2⤵
  - Suspicious use of SetThreadContext
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2800
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\SysWOW64\cmd.exe
    3⤵
    - Suspicious use of SetThreadContext
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:2876
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:2968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\26f27230

Filesize
1.4MB

MD5
8725d3fb41cc43f1204fc09f5ddaa655

SHA1
692f59db10854287e7275b22ed057e1a3837be3a

SHA256
4716e4634a3c2c0915ce719d16a6711ec0080d17f15aab799d768f83ca6233d8

SHA512
20ccbb76c08e898914c4974864503ef38162d1b529817a1199437a49b7157ccd8ae80989bf36be8960de2558e57046c131d7b1dc10a0f26954869329eb0de134

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp9C51.tmp

Filesize
20KB

MD5
c9ff7748d8fcef4cf84a5501e996a641

SHA1
02867e5010f62f97ebb0cfb32cb3ede9449fe0c9

SHA256
4d3f3194cb1133437aa69bb880c8cbb55ddf06ff61a88ca6c3f1bbfbfd35d988

SHA512
d36054499869a8f56ac8547ccd5455f1252c24e17d2b185955390b32da7e2a732ace4e0f30f9493fcc61425a2e31ed623465f998f41af69423ee0e3ed1483a73

Download Submit
C:\Users\Admin\AppData\Roaming\WordpadHelp_alpha\ISCmplr.dll

Filesize
1.4MB

MD5
4a6dbda25a80cbb1df9ce69ff6fa6303

SHA1
d069c82c6b34b36d336c7b15bf0dae5410c8fd46

SHA256
5bd542000aa5585f44e07ba88e0fb52660566209f76adf85926093446447b113

SHA512
215287711399aa26ebcc5e300fb35487f32a7c1897e2158f00fa06764520890fb4d7670b275b1e48d763d950816519f79a491738794b7e417602f17e9634fe6b

Download Submit
C:\Users\Admin\AppData\Roaming\WordpadHelp_alpha\chiliad.tar.gz

Filesize
1.2MB

MD5
a267bf243eeee769163e561036edb71f

SHA1
39217f9da3fe30273f260c10626fe13a38fbec4b

SHA256
199d4cc63746edb09d4147b7ba375ffe952eae4a4d6e0082e37759e549058cb8

SHA512
71499a7141aaa06ab479c9363b0f83538ad79adbbfda1e9fbca11871c3db5e868ce5538c79165fa77fafa765bf3d3d1a57ea18c492b5a2588af3747cc63d779b

Download Submit
C:\Users\Admin\AppData\Roaming\WordpadHelp_alpha\junco.zip

Filesize
26KB

MD5
caae9ed08d157b0ddccf9d2b587b7438

SHA1
1c6a9948b47c85622ebe40a16d8dd9edf13c1823

SHA256
a6f6c770d169d8078676ec322b8c2366b636e0da957a1a146fa51d425c31d149

SHA512
90d4608e40905416558598f65d8af2bd76140010c588fe1eb7602ab9dc97c0c027c159c744483c3bb70c6f99b5c25218a20e945ce494affb61239f8ccdab6e50

Download Submit
\Users\Admin\AppData\Roaming\WordpadHelp_alpha\Compil32.exe

Filesize
4.0MB

MD5
20d23b37c54fc1434ff3105a165cdac7

SHA1
9cb3811fb5f2ecacadc831d82e7e850abedc19ae

SHA256
8fa9074cd74cbcedc44b12999dbc5f4e51ea82caa24be18b073686229f1f9db8

SHA512
40eb9cc31a97996237e69d975efc1a3c22297403bef211427752926a331e9913801bacc7236e4a67ce988c110ccbda3dbd3e65bcc185d512cfc951b0e05fb409

Download Submit
memory/2208-14-0x0000000000800000-0x000000000097C000-memory.dmp

Filesize
1.5MB

Download
memory/2208-1-0x00000000771C0000-0x0000000077369000-memory.dmp

Filesize
1.7MB

Download
memory/2208-10-0x00000000010B0000-0x00000000014B4000-memory.dmp

Filesize
4.0MB

Download
memory/2208-0-0x0000000074820000-0x0000000074994000-memory.dmp

Filesize
1.5MB

Download
memory/2800-20-0x00000000744E0000-0x0000000074654000-memory.dmp

Filesize
1.5MB

Download
memory/2800-19-0x00000000744E0000-0x0000000074654000-memory.dmp

Filesize
1.5MB

Download
memory/2800-18-0x00000000744F3000-0x00000000744F5000-memory.dmp

Filesize
8KB

Download
memory/2800-23-0x0000000000800000-0x000000000097C000-memory.dmp

Filesize
1.5MB

Download
memory/2800-17-0x00000000771C0000-0x0000000077369000-memory.dmp

Filesize
1.7MB

Download
memory/2800-22-0x00000000003E0000-0x00000000007E4000-memory.dmp

Filesize
4.0MB

Download
memory/2800-16-0x00000000744E0000-0x0000000074654000-memory.dmp

Filesize
1.5MB

Download
memory/2876-26-0x00000000771C0000-0x0000000077369000-memory.dmp

Filesize
1.7MB

Download
memory/2876-75-0x00000000744E0000-0x0000000074654000-memory.dmp

Filesize
1.5MB

Download
memory/2876-74-0x00000000744E0000-0x0000000074654000-memory.dmp

Filesize
1.5MB

Download
memory/2876-78-0x00000000744E0000-0x0000000074654000-memory.dmp

Filesize
1.5MB

Download
memory/2876-24-0x00000000744E0000-0x0000000074654000-memory.dmp

Filesize
1.5MB

Download
memory/2968-79-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2968-80-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2968-77-0x0000000072740000-0x00000000737A2000-memory.dmp

Filesize
16.4MB

Download
memory/2968-81-0x0000000000400000-0x00000000004C4000-memory.dmp

Filesize
784KB

Download

Analysis

Sharing