Analysis
- max time kernel
148s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
01/11/2026, 12:22
General
- Target xamster.exe
- Size 411KB
- Sample261101-pj4b2scc32
- SHA256 17a2bbad4f7725b0b39f1063c0df3cce567b56bbcd3702182968a24743a0c616
Score
10/10
Malware Config
Signatures
- Family: SectopRAT
SectopRAT also known as Arechclient2 is a remote access trojan first seen in November 2019.
- Detects SectopRAT aka Arechclient2 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\xamster.exe"C:\Users\Admin\AppData\Local\Temp\xamster.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1376-0-0x0000000000AB0000-0x0000000000B1C000-memory.dmp
memory/1376-1-0x00007FFDBF02F000-0x00007FFDBF030000-memory.dmp
memory/1376-2-0x000000001BAA0000-0x000000001BC62000-memory.dmp
memory/1376-4-0x00007FFDBEEA0000-0x00007FFDBF844000-memory.dmp
memory/1376-3-0x0000000002CF0000-0x0000000002D40000-memory.dmp
memory/1376-6-0x000000001B950000-0x000000001B9C6000-memory.dmp
memory/1376-5-0x00007FFDBEEA0000-0x00007FFDBF844000-memory.dmp
memory/1376-7-0x00007FFDBEEA0000-0x00007FFDBF844000-memory.dmp
memory/1376-8-0x00007FFDBEEA0000-0x00007FFDBF844000-memory.dmp
memory/1376-9-0x00007FFDBEEA0000-0x00007FFDBF844000-memory.dmp