Analysis
- user interaction
yes - max time kernel
298s - max time network
300s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260911-en - resource tags
- submitted
31/10/2026, 23:50
General
- Target AsgardProtector.zip
- Size 1.5MB
- Sample261031-3vl4ssst2j
- SHA256 0e0bd7f508d40cf5760c659ab07bf178b27055cb7b601ff39c4ff4e0c2582a1a
Score
10/10
Malware Config
Signatures
- Family: SectopRAT
SectopRAT also known as Arechclient2 is a remote access trojan first seen in November 2019.
- Detects SectopRAT aka Arechclient2 1 IoCs
- Executes dropped EXE 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SendNotifyMessage 3 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\AsgardProtector.zip1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Desktop\AsgardProtector\AutoIt3.exe"C:\Users\Admin\Desktop\AsgardProtector\AutoIt3.exe" C:\Users\Admin\Desktop\AsgardProtector\installation_status.json1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Desktop\AsgardProtector\RegAsm.exeC:\Users\Admin\Desktop\AsgardProtector\RegAsm.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
RegAsm.exe
memory/1392-0-0x00007FF813D70000-0x00007FF813F68000-memory.dmp
memory/1392-1-0x0000020B04EF0000-0x0000020B04EF1000-memory.dmp
memory/1628-2-0x0000000000400000-0x000000000046C000-memory.dmp
memory/1628-3-0x0000000000400000-0x000000000046C000-memory.dmp
memory/1628-5-0x00000131D98E0000-0x00000131D9AA2000-memory.dmp
memory/1628-6-0x00000131C0E00000-0x00000131C0E50000-memory.dmp
memory/1628-7-0x00000131D9700000-0x00000131D9776000-memory.dmp