sectoprat | d8f02ea1a16fa39ab32b84265833164ff9606862e0dbd7da3f1b02b5210c69a3

General

Target

Manifest/Compil32.exe
Size

4.0MB
MD5

20d23b37c54fc1434ff3105a165cdac7
SHA1

9cb3811fb5f2ecacadc831d82e7e850abedc19ae
SHA256

8fa9074cd74cbcedc44b12999dbc5f4e51ea82caa24be18b073686229f1f9db8
SHA512

40eb9cc31a97996237e69d975efc1a3c22297403bef211427752926a331e9913801bacc7236e4a67ce988c110ccbda3dbd3e65bcc185d512cfc951b0e05fb409
SSDEEP

98304:ByzK9w6TfpPaVG5I+Juv5380exR4KuNFL3N:QWViB3Mwx

Score

10^/10

sectoprat discovery rat trojan

Malware Config

Signatures

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/3988-35-0x0000000000D00000-0x0000000000DC4000-memory.dmp	family_sectoprat

Sectoprat family
sectoprat

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1420 set thread context of 4760	1420	Compil32.exe	87
PID 4760 set thread context of 3988	4760	cmd.exe	90

Executes dropped EXE 1 IoCs

pid	Process
1420	Compil32.exe

Loads dropped DLL 1 IoCs

pid	Process
1420	Compil32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Compil32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Compil32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3556	Compil32.exe
1420	Compil32.exe
1420	Compil32.exe
4760	cmd.exe
4760	cmd.exe
3988	MSBuild.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
1420	Compil32.exe
4760	cmd.exe
4760	cmd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3988	MSBuild.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3988	MSBuild.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3556 wrote to memory of 1420	3556	Compil32.exe	86
PID 3556 wrote to memory of 1420	3556	Compil32.exe	86
PID 3556 wrote to memory of 1420	3556	Compil32.exe	86
PID 1420 wrote to memory of 4760	1420	Compil32.exe	87
PID 1420 wrote to memory of 4760	1420	Compil32.exe	87
PID 1420 wrote to memory of 4760	1420	Compil32.exe	87
PID 1420 wrote to memory of 4760	1420	Compil32.exe	87
PID 4760 wrote to memory of 3988	4760	cmd.exe	90
PID 4760 wrote to memory of 3988	4760	cmd.exe	90
PID 4760 wrote to memory of 3988	4760	cmd.exe	90
PID 4760 wrote to memory of 3988	4760	cmd.exe	90
PID 4760 wrote to memory of 3988	4760	cmd.exe	90

C:\Users\Admin\AppData\Local\Temp\Manifest\Compil32.exe
"C:\Users\Admin\AppData\Local\Temp\Manifest\Compil32.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3556
- C:\Users\Admin\AppData\Roaming\WordpadHelp_alpha\Compil32.exe
  C:\Users\Admin\AppData\Roaming\WordpadHelp_alpha\Compil32.exe
  2⤵
  - Suspicious use of SetThreadContext
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1420
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\SysWOW64\cmd.exe
    3⤵
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:4760
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:3988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1e0defc5

Filesize
1.4MB

MD5
aa33e336f39fb63c3132c50c11889501

SHA1
3948a97995ddf2ddf4f03835847bd52ca451c8ef

SHA256
5d22daa747175228dba0418bfc23192075c3fa2581f2115a419cce425a85a7ff

SHA512
b0424d5625301c28e3869d6c0f2adae78bc9190a657357348ee716adb3e932202534499ed68f479df968ad006c0d7d5f7830269cf66208e6266da6e372760861

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp274D.tmp

Filesize
20KB

MD5
49693267e0adbcd119f9f5e02adf3a80

SHA1
3ba3d7f89b8ad195ca82c92737e960e1f2b349df

SHA256
d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f

SHA512
b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2

Download Submit
C:\Users\Admin\AppData\Roaming\WordpadHelp_alpha\Compil32.exe

Filesize
4.0MB

MD5
20d23b37c54fc1434ff3105a165cdac7

SHA1
9cb3811fb5f2ecacadc831d82e7e850abedc19ae

SHA256
8fa9074cd74cbcedc44b12999dbc5f4e51ea82caa24be18b073686229f1f9db8

SHA512
40eb9cc31a97996237e69d975efc1a3c22297403bef211427752926a331e9913801bacc7236e4a67ce988c110ccbda3dbd3e65bcc185d512cfc951b0e05fb409

Download Submit
C:\Users\Admin\AppData\Roaming\WordpadHelp_alpha\ISCmplr.dll

Filesize
1.4MB

MD5
4a6dbda25a80cbb1df9ce69ff6fa6303

SHA1
d069c82c6b34b36d336c7b15bf0dae5410c8fd46

SHA256
5bd542000aa5585f44e07ba88e0fb52660566209f76adf85926093446447b113

SHA512
215287711399aa26ebcc5e300fb35487f32a7c1897e2158f00fa06764520890fb4d7670b275b1e48d763d950816519f79a491738794b7e417602f17e9634fe6b

Download Submit
C:\Users\Admin\AppData\Roaming\WordpadHelp_alpha\chiliad.tar.gz

Filesize
1.2MB

MD5
a267bf243eeee769163e561036edb71f

SHA1
39217f9da3fe30273f260c10626fe13a38fbec4b

SHA256
199d4cc63746edb09d4147b7ba375ffe952eae4a4d6e0082e37759e549058cb8

SHA512
71499a7141aaa06ab479c9363b0f83538ad79adbbfda1e9fbca11871c3db5e868ce5538c79165fa77fafa765bf3d3d1a57ea18c492b5a2588af3747cc63d779b

Download Submit
C:\Users\Admin\AppData\Roaming\WordpadHelp_alpha\junco.zip

Filesize
26KB

MD5
caae9ed08d157b0ddccf9d2b587b7438

SHA1
1c6a9948b47c85622ebe40a16d8dd9edf13c1823

SHA256
a6f6c770d169d8078676ec322b8c2366b636e0da957a1a146fa51d425c31d149

SHA512
90d4608e40905416558598f65d8af2bd76140010c588fe1eb7602ab9dc97c0c027c159c744483c3bb70c6f99b5c25218a20e945ce494affb61239f8ccdab6e50

Download Submit
memory/1420-18-0x0000000074E10000-0x0000000074F8B000-memory.dmp

Filesize
1.5MB

Download
memory/1420-14-0x0000000074E10000-0x0000000074F8B000-memory.dmp

Filesize
1.5MB

Download
memory/1420-15-0x00007FFDBB1F0000-0x00007FFDBB3E5000-memory.dmp

Filesize
2.0MB

Download
memory/1420-16-0x0000000074E23000-0x0000000074E25000-memory.dmp

Filesize
8KB

Download
memory/1420-17-0x0000000074E10000-0x0000000074F8B000-memory.dmp

Filesize
1.5MB

Download
memory/1420-21-0x0000000000FB0000-0x00000000013B4000-memory.dmp

Filesize
4.0MB

Download
memory/1420-23-0x00000000746E0000-0x000000007485C000-memory.dmp

Filesize
1.5MB

Download
memory/3556-10-0x0000000074E10000-0x0000000074F8C000-memory.dmp

Filesize
1.5MB

Download
memory/3556-0-0x0000000074B00000-0x0000000074C7B000-memory.dmp

Filesize
1.5MB

Download
memory/3556-8-0x0000000000C70000-0x0000000001074000-memory.dmp

Filesize
4.0MB

Download
memory/3556-1-0x00007FFDBB1F0000-0x00007FFDBB3E5000-memory.dmp

Filesize
2.0MB

Download
memory/3988-37-0x0000000005A00000-0x0000000005FA4000-memory.dmp

Filesize
5.6MB

Download
memory/3988-39-0x00000000056C0000-0x0000000005882000-memory.dmp

Filesize
1.8MB

Download
memory/3988-57-0x0000000007CE0000-0x0000000007CEA000-memory.dmp

Filesize
40KB

Download
memory/3988-44-0x0000000006190000-0x00000000061F6000-memory.dmp

Filesize
408KB

Download
memory/3988-32-0x0000000073140000-0x0000000074394000-memory.dmp

Filesize
18.3MB

Download
memory/3988-35-0x0000000000D00000-0x0000000000DC4000-memory.dmp

Filesize
784KB

Download
memory/3988-36-0x0000000005310000-0x00000000053A2000-memory.dmp

Filesize
584KB

Download
memory/3988-43-0x00000000060B0000-0x00000000060CE000-memory.dmp

Filesize
120KB

Download
memory/3988-38-0x00000000052B0000-0x00000000052BA000-memory.dmp

Filesize
40KB

Download
memory/3988-42-0x00000000065E0000-0x0000000006B0C000-memory.dmp

Filesize
5.2MB

Download
memory/3988-40-0x0000000005450000-0x00000000054C6000-memory.dmp

Filesize
472KB

Download
memory/3988-41-0x00000000054F0000-0x0000000005540000-memory.dmp

Filesize
320KB

Download
memory/4760-28-0x0000000074E10000-0x0000000074F8B000-memory.dmp

Filesize
1.5MB

Download
memory/4760-24-0x00007FFDBB1F0000-0x00007FFDBB3E5000-memory.dmp

Filesize
2.0MB

Download
memory/4760-31-0x0000000074E10000-0x0000000074F8B000-memory.dmp

Filesize
1.5MB

Download
memory/4760-20-0x0000000074E10000-0x0000000074F8B000-memory.dmp

Filesize
1.5MB

Download
memory/4760-29-0x0000000074E10000-0x0000000074F8B000-memory.dmp

Filesize
1.5MB

Download

Analysis

Sharing