Analysis
- max time kernel
150s - max time network
139s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
19/09/2026, 12:30
General
- Target DC-F1-B1-F9-F4-6B.ps1
- Size 211KB
- Sample260919-ppmaqafd56
- SHA256 a38f40577566f1bd0087c8ea1114664878ceeca700ea5f34cbcca4eab500f44e
Malware Config
Signatures
- Family: SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- SectopRAT payload 1 IoCs
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE 4 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 38 IoCs
- Suspicious use of AdjustPrivilegeToken 43 IoCs
- Suspicious use of FindShellTrayWindow 6 IoCs
- Suspicious use of SendNotifyMessage 6 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\DC-F1-B1-F9-F4-6B.ps11⤵
- Badlisted process makes network request
- Adds Run key to start application
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jb0y15fi\jb0y15fi.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES451D.tmp" "c:\Users\Admin\AppData\Local\Temp\jb0y15fi\CSC17C3861D64FA408084DBF3E57811ABD.TMP"3⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yep0mbh1\yep0mbh1.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES46F2.tmp" "c:\Users\Admin\AppData\Local\Temp\yep0mbh1\CSCA98354A7E3DD439AA766A587B8637A8.TMP"3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\0211787d726a\AutoIt3.exe"C:\Users\Admin\AppData\Roaming\0211787d726a\AutoIt3.exe" "C:\Users\Admin\AppData\Roaming\0211787d726a\Fabrics.a3x"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\0211787d726a\RegAsm.exeC:\Users\Admin\AppData\Roaming\0211787d726a\RegAsm.exe2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\0211787d726a\AutoIt3.exe"C:\Users\Admin\AppData\Roaming\0211787d726a\AutoIt3.exe" "C:\Users\Admin\AppData\Roaming\0211787d726a\Fabrics.a3x"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\0211787d726a\RegAsm.exeC:\Users\Admin\AppData\Roaming\0211787d726a\RegAsm.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
RES451D.tmp
RES46F2.tmp
jb0y15fi.dll
yep0mbh1.dll
AutoIt3.exe
Fabrics.a3x
RegAsm.exe
CSC17C3861D64FA408084DBF3E57811ABD.TMP
jb0y15fi.0.cs
jb0y15fi.cmdline
CSCA98354A7E3DD439AA766A587B8637A8.TMP
yep0mbh1.0.cs
yep0mbh1.cmdline
memory/3360-64-0x0000000000400000-0x000000000046C000-memory.dmp
memory/3360-66-0x0000000000400000-0x000000000046C000-memory.dmp
memory/4580-58-0x00007FFBF88E0000-0x00007FFBF8B43000-memory.dmp
memory/4580-62-0x000001F292CA0000-0x000001F292CA1000-memory.dmp
memory/4944-60-0x00007FFBF88E0000-0x00007FFBF8B43000-memory.dmp
memory/6124-12-0x00007FFBD5B60000-0x00007FFBD6504000-memory.dmp
memory/6124-51-0x00007FFBD5B60000-0x00007FFBD6504000-memory.dmp
memory/6124-30-0x00007FFBD5B60000-0x00007FFBD6504000-memory.dmp
memory/6124-26-0x000001F67C750000-0x000001F67C758000-memory.dmp
memory/6124-41-0x000001F67C760000-0x000001F67C768000-memory.dmp
memory/6124-18-0x00007FFBD5B60000-0x00007FFBD6504000-memory.dmp
memory/6124-0-0x00007FFBD5CEF000-0x00007FFBD5CF0000-memory.dmp
memory/6124-11-0x00007FFBD5B60000-0x00007FFBD6504000-memory.dmp
memory/6124-45-0x000001F67CA10000-0x000001F67CAC2000-memory.dmp
memory/6124-46-0x000001F67C7C0000-0x000001F67C7CA000-memory.dmp
memory/6124-44-0x000001F67C7A0000-0x000001F67C7BE000-memory.dmp
memory/6124-48-0x000001F67CC20000-0x000001F67CC44000-memory.dmp
memory/6124-47-0x000001F67CC20000-0x000001F67CC4A000-memory.dmp
memory/6124-31-0x00007FFBD5B60000-0x00007FFBD6504000-memory.dmp
memory/6124-52-0x00007FFBD5B60000-0x00007FFBD6504000-memory.dmp
memory/6124-54-0x00007FFBD5B60000-0x00007FFBD6504000-memory.dmp
memory/6124-10-0x00007FFBD5B60000-0x00007FFBD6504000-memory.dmp
memory/6124-9-0x00007FFBD5B60000-0x00007FFBD6504000-memory.dmp
memory/6124-8-0x00007FFBD5B60000-0x00007FFBD6504000-memory.dmp
memory/6124-7-0x00007FFBD5B60000-0x00007FFBD6504000-memory.dmp
memory/6124-61-0x00007FFBD5B60000-0x00007FFBD6504000-memory.dmp
memory/6124-6-0x00007FFBD5B60000-0x00007FFBD6504000-memory.dmp
memory/6124-5-0x00007FFBD5B60000-0x00007FFBD6504000-memory.dmp
memory/6124-4-0x000001F67C6E0000-0x000001F67C702000-memory.dmp
memory/6124-1-0x00007FFBD5B60000-0x00007FFBD6504000-memory.dmp