sectoprat | 60f4f3fd202f77f14d1eda4829c48b5c5fcd170951c914a0a73428c332df9844

Analysis

max time kernel
298s
max time network
278s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
31/10/2026, 23:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bbd224f8-8296-404b-ab7c-c93301380271.ps1
Size 447KB
Sample261031-3vb9laez6x
SHA256 60f4f3fd202f77f14d1eda4829c48b5c5fcd170951c914a0a73428c332df9844
MD5 7e6ae85fd49a0814ca052edad1a0e366
SHA1 22cb830907176b5bd73f62928d98238063a1d590
SHA512 a12455e0b16b7af15290db2bd405e03cc1062c64a6a0a97c1ea6b0502924fd7b975aea6d26f4777a7f57813e8e05422d2858e060c8132ee14cdaf17f01406185
SSDEEP 6144:zEC+uojeBdWOTNiywGdlYoA6auYauu+U4G46YHY7pdQpdepdVpdfzm2mXXJ/C88Z:I8ig888Sc5m
TLSH
T1E2A4316137C0B866914EDFB96C010C0B93DD607ADFCFA85EABC9E6844B87578468DCB1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution sectoprat persistence rat trojan

Malware Config

Signatures

Family: SectopRAT
SectopRAT also known as Arechclient2 is a remote access trojan first seen in November 2019.
trojan rat sectoprat

Detects SectopRAT aka Arechclient2 1 IoCs

resource	yara_rule
behavioral2/memory/4660-45-0x0000000000400000-0x000000000046C000-memory.dmp	family_sectoprat

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
34	5116	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
1912	AutoIt3.exe
4660	RegAsm.exe

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2545564138-786060179-1728272436-1000\Environment\UserInitMprLogonScript = "\"C:\\Users\\Admin\\AppData\\Roaming\\062e1bcc3efb\\AutoIt3.exe\" \"C:\\Users\\Admin\\AppData\\Roaming\\062e1bcc3efb\\app.asar\""	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1912 set thread context of 4660	1912	AutoIt3.exe	95

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5116	powershell.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	AutoIt3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	AutoIt3.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5116	powershell.exe
5116	powershell.exe
1912	AutoIt3.exe
1912	AutoIt3.exe
1912	AutoIt3.exe
1912	AutoIt3.exe
1912	AutoIt3.exe
1912	AutoIt3.exe
1912	AutoIt3.exe
1912	AutoIt3.exe

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeDebugPrivilege	5116	powershell.exe
Token: SeIncreaseQuotaPrivilege	5116	powershell.exe
Token: SeSecurityPrivilege	5116	powershell.exe
Token: SeTakeOwnershipPrivilege	5116	powershell.exe
Token: SeLoadDriverPrivilege	5116	powershell.exe
Token: SeSystemProfilePrivilege	5116	powershell.exe
Token: SeSystemtimePrivilege	5116	powershell.exe
Token: SeProfSingleProcessPrivilege	5116	powershell.exe
Token: SeIncBasePriorityPrivilege	5116	powershell.exe
Token: SeCreatePagefilePrivilege	5116	powershell.exe
Token: SeBackupPrivilege	5116	powershell.exe
Token: SeRestorePrivilege	5116	powershell.exe
Token: SeShutdownPrivilege	5116	powershell.exe
Token: SeDebugPrivilege	5116	powershell.exe
Token: SeSystemEnvironmentPrivilege	5116	powershell.exe
Token: SeRemoteShutdownPrivilege	5116	powershell.exe
Token: SeUndockPrivilege	5116	powershell.exe
Token: SeManageVolumePrivilege	5116	powershell.exe
Token: 33	5116	powershell.exe
Token: 34	5116	powershell.exe
Token: 35	5116	powershell.exe
Token: 36	5116	powershell.exe
Token: SeIncreaseQuotaPrivilege	5116	powershell.exe
Token: SeSecurityPrivilege	5116	powershell.exe
Token: SeTakeOwnershipPrivilege	5116	powershell.exe
Token: SeLoadDriverPrivilege	5116	powershell.exe
Token: SeSystemProfilePrivilege	5116	powershell.exe
Token: SeSystemtimePrivilege	5116	powershell.exe
Token: SeProfSingleProcessPrivilege	5116	powershell.exe
Token: SeIncBasePriorityPrivilege	5116	powershell.exe
Token: SeCreatePagefilePrivilege	5116	powershell.exe
Token: SeBackupPrivilege	5116	powershell.exe
Token: SeRestorePrivilege	5116	powershell.exe
Token: SeShutdownPrivilege	5116	powershell.exe
Token: SeDebugPrivilege	5116	powershell.exe
Token: SeSystemEnvironmentPrivilege	5116	powershell.exe
Token: SeRemoteShutdownPrivilege	5116	powershell.exe
Token: SeUndockPrivilege	5116	powershell.exe
Token: SeManageVolumePrivilege	5116	powershell.exe
Token: 33	5116	powershell.exe
Token: 34	5116	powershell.exe
Token: 35	5116	powershell.exe
Token: 36	5116	powershell.exe
Token: SeDebugPrivilege	4660	RegAsm.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1912	AutoIt3.exe
1912	AutoIt3.exe
1912	AutoIt3.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1912	AutoIt3.exe
1912	AutoIt3.exe
1912	AutoIt3.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5116 wrote to memory of 1912	5116	powershell.exe	94
PID 1912 wrote to memory of 4660	1912	AutoIt3.exe	95
PID 1912 wrote to memory of 4660	1912	AutoIt3.exe	95
PID 1912 wrote to memory of 4660	1912	AutoIt3.exe	95

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\bbd224f8-8296-404b-ab7c-c93301380271.ps1
1⤵
- Badlisted process makes network request
- Registers new Windows logon scripts automatically executed at logon.
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5116
- C:\Users\Admin\AppData\Roaming\062e1bcc3efb\AutoIt3.exe
  "C:\Users\Admin\AppData\Roaming\062e1bcc3efb\AutoIt3.exe" "C:\Users\Admin\AppData\Roaming\062e1bcc3efb\app.asar"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1912
- - C:\Users\Admin\AppData\Roaming\062e1bcc3efb\RegAsm.exe
    C:\Users\Admin\AppData\Roaming\062e1bcc3efb\RegAsm.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4660

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Privilege Escalation

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_fywmvkxs.3s3.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fywmvkxs.3s3.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

AutoIt3.exe

Path C:\Users\Admin\AppData\Roaming\062e1bcc3efb\AutoIt3.exe
Size 1.1MB
SHA256 5d69a932a077fee044b193c28e84564143f5c7e51079ab48e88fef74ab0b77b7
MD5 80cdd5f19d704a001589976bae277bab
SHA1 96bb030389ac938c5ebc6bd2e9fcc86a10e5f2fd
SHA512 03fbfd02d348c2b54af3eeb022ae2f1be4e4f9b30352ceb2c7589233275a914ec4fd81ff8c1544bebf96a87e28c75fd81811e658f092536367395048a82bf8fa
SSDEEP 24576:HsTBc4JYoji1a2gOI6fQJ77jkD1KV3wKct4frNFOB:MTC4a4p+E72SwRcrK
TLSH
T1DA356C0673A4419EFEA7F1329607C60BD6B17C4A07779A6F02646B626F337711A2E331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RegAsm.exe

Path C:\Users\Admin\AppData\Roaming\062e1bcc3efb\RegAsm.exe
Size 63KB
SHA256 dc45704ba97d974d157c1c4a27dba402afa595eac2468d8def2ee8d0a2ee9a81
MD5 a4eb36bae72c5cb7392f2b85609d4a7e
SHA1 5c58053a3a18c0226b98a4ac7e7320581300b6c9
SHA512 8ebdd20b7c1ee87aa3766d812960b0d8cfa0a6ba6e371f730e589895d202dd540eb475f69940261c1532e90d1030370e9eb5102cadbf6e546f99b350de79b95a
SSDEEP 768:/8XcJiMjm2ieHFYPyCsSuJbn8dBhFwjSMF6Iq8KSYDKvc7qWk81:zYMaNyFYPYSAb8dBnWHsPDKvcN91
TLSH
T1D353E714A7E84216F6FB4B71AEF5C4479936B593AD65C34C248D438D0B223C1DA23BBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.asar

Path C:\Users\Admin\AppData\Roaming\062e1bcc3efb\app.asar
Size 1.0MB
SHA256 5b6e971609d520d394b77ce8bfaac7d2ca52883e74921086345d6c08904577b9
MD5 ae9c1fbba8abbb5d4c3ae15fad2469b7
SHA1 41548a4618bdc4bc46b13cca87ba465ac64c908b
SHA512 5d33df2a2a1331d747b02cb31947cd6a681a0510d54a5cc0912c0ed56076467046dc26a2ad9b1a49c3c0d0474d1ddc9472eb217559b949ee8ecdb5849a99db39
SSDEEP 24576:B89DekHtrBTohm0s+VcmdlCEzRC0IEV7OHbtB+Aiog:B8UT0wVBz7ABEVyP+B
TLSH
T1B435332F214071EB6E40D76A4CB387F919AF2027C1CD5BAA120D513A9E2647EE4BFC95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1912-43-0x0000025A17E60000-0x0000025A17E61000-memory.dmp

Download

memory/1912-42-0x00007FF902710000-0x00007FF902908000-memory.dmp

Download

memory/4660-49-0x0000025EBFCD0000-0x0000025EBFD46000-memory.dmp

Download

memory/4660-48-0x0000025EA62C0000-0x0000025EA6310000-memory.dmp

Download

memory/4660-47-0x0000025EBFF40000-0x0000025EC0102000-memory.dmp

Download

memory/4660-45-0x0000000000400000-0x000000000046C000-memory.dmp

Download

memory/4660-44-0x0000000000400000-0x000000000046C000-memory.dmp

Download

memory/5116-11-0x000002022BAC0000-0x000002022BAD0000-memory.dmp

Download

memory/5116-24-0x0000020247580000-0x00000202475A4000-memory.dmp

Download

memory/5116-23-0x0000020247580000-0x00000202475AA000-memory.dmp

Download

memory/5116-22-0x0000020246FE0000-0x0000020246FEA000-memory.dmp

Download

memory/5116-14-0x00007FF4357E0000-0x00007FF4357F0000-memory.dmp

Download

memory/5116-13-0x000002022BAC0000-0x000002022BAD0000-memory.dmp

Download

memory/5116-12-0x000002022BAC0000-0x000002022BAD0000-memory.dmp

Download

memory/5116-0-0x000002022BAC0000-0x000002022BAD0000-memory.dmp

Download

memory/5116-10-0x000002022BAC0000-0x000002022BAD0000-memory.dmp

Download

memory/5116-9-0x000002022BAC0000-0x000002022BAD0000-memory.dmp

Download

memory/5116-8-0x00000202463C0000-0x00000202463E2000-memory.dmp

Download