Overview

overview

10

Static

static

5

Kernel/sta...g4.dll

windows10-2004-x64

3

Kernel/sta...g4.dll

windows11-ltsc_2024-x64

3

Kernel/x64...lot.js

windows10-2004-x64

3

Kernel/x64...lot.js

windows11-ltsc_2024-x64

3

Kernel/x64...f4.dll

windows10-2004-x64

3

Kernel/x64...f4.dll

windows11-ltsc_2024-x64

3

Kernel/x64...g4.dll

windows10-2004-x64

3

Kernel/x64...g4.dll

windows11-ltsc_2024-x64

3

Kernel/x64...g4.dll

windows10-2004-x64

3

Kernel/x64...g4.dll

windows11-ltsc_2024-x64

3

Kernel/x64...g4.dll

windows10-2004-x64

3

Kernel/x64...g4.dll

windows11-ltsc_2024-x64

3

Kernel/x64...f4.dll

windows10-2004-x64

3

Kernel/x64...f4.dll

windows11-ltsc_2024-x64

3

Kernel/x64...de.dll

windows10-2004-x64

3

Kernel/x64...de.dll

windows11-ltsc_2024-x64

3

Setup.exe

windows10-2004-x64

10

Setup.exe

windows11-ltsc_2024-x64

10

ccl30.dll

windows10-2004-x64

1

ccl30.dll

windows11-ltsc_2024-x64

1

lib/KillProcess.dll

windows10-2004-x64

3

lib/KillProcess.dll

windows11-ltsc_2024-x64

3

lib/MigDLL.dll

windows10-2004-x64

3

lib/MigDLL.dll

windows11-ltsc_2024-x64

3

lib/Migrat...ce.exe

windows10-2004-x64

7

lib/Migrat...ce.exe

windows11-ltsc_2024-x64

7

lib/SSDInfo.dll

windows10-2004-x64

3

lib/SSDInfo.dll

windows11-ltsc_2024-x64

3

lib/WinClon64i.exe

windows10-2004-x64

lib/WinClon64i.exe

windows11-ltsc_2024-x64

lib/WinClon64x.exe

windows10-2004-x64

1

lib/WinClon64x.exe

windows11-ltsc_2024-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    SETUP.zip
  • Size 20.9MB
  • Sample261105-gyadhsff89
  • SHA256 2e71fa8333960948544fbddbbfb84d6d429aa4accb27016e86b9c2c16a00f49a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
sectopratdefense_evasiondiscoveryexecutionpersistenceprivilege_escalationratspywaretrojan

Malware Config

Targets

    • Target
      Kernel/stats/Devices/qsvg4.dll
    • Size 24KB
    • SHA256 6e31a5592490e39c46bf379dceabe57219a246510367b8cff52f080ad5ac8dd9
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral1behavioral2
    • Target
      Kernel/x64/Data/ExtraPackages/DifferentialEquations/BoundaryRegionPlot.m
    • Size 5KB
    • SHA256 3b515ddc6253195e1250d440450dbc10d72ad86d65d7e90dfeca7408c9dcd57c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral3behavioral4
    • Target
      Kernel/x64/Data/ExtraPackages/imageformats/qgif4.dll
    • Size 28KB
    • SHA256 fe8b67e424dafce5b6a2b8334d22f3b24126b957fce1d4c6e911b3f564161ba1
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral5behavioral6
    • Target
      Kernel/x64/Data/ExtraPackages/imageformats/qjpeg4.dll
    • Size 100KB
    • SHA256 bc82e8fe15670ada26d4f684d3cbe5f33901284bc366047722de8b7f62996a46
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral7behavioral8
    • Target
      Kernel/x64/Data/ExtraPackages/imageformats/qmng4.dll
    • Size 188KB
    • SHA256 06f966e4f069d797dd0e629f7874fd8f11d9accedc9f5e68d4d81f3cee023a29
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral10behavioral9
    • Target
      Kernel/x64/Data/ExtraPackages/imageformats/qsvg4.dll
    • Size 24KB
    • SHA256 6e31a5592490e39c46bf379dceabe57219a246510367b8cff52f080ad5ac8dd9
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral11behavioral12
    • Target
      Kernel/x64/Data/ExtraPackages/imageformats/qtiff4.dll
    • Size 244KB
    • SHA256 7ca868368b685167d90316b7f8c6b5f7c90eef8c08f3176bfa23d0ce7a298692
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral13behavioral14
    • Target
      Kernel/x64/Rapid_Upgrade.dll
    • Size 2.4MB
    • SHA256 523c1c03fa4daddac66688e74fd8ab362f651d247f96c97e9343ff12753e0e1a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral15behavioral16
    • Target
      Setup.exe
    • Size 94KB
    • SHA256 8c1b9b8e72264e27253a7cc14d6f9a560a127ebd9f8bcec81faba94710c19a47
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    defense_evasiondiscoveryexecutionsectopratpersistenceprivilege_escalationratspywaretrojan

    • Detects SectopRAT aka Arechclient2

    • Family: SectopRAT

      SectopRAT also known as Arechclient2 is a remote access trojan first seen in November 2019.

      trojanratsectoprat

    • Suspicious use of NtCreateUserProcessOtherParentProcess

      defense_evasionprivilege_escalation

    • Badlisted process makes network request

      Network request originating from process or tool commonly abused by malware.

    • Registers new Windows logon scripts automatically executed at logon.

      persistence

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Suspicious use of SetThreadContext

    behavioral17behavioral18
    • Target
      ccl30.dll
    • Size 696KB
    • SHA256 cd1ff88908d95cb8b0865352f2ff4b5ae06648ff087abfa38269b371bd6a4c8a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral19behavioral20
    • Target
      lib/KillProcess.dll
    • Size 132KB
    • SHA256 7a2b828c0999186eb9b8b3951188d8805b0c0627032bc450ff0bfb91ce56b8e9
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral21behavioral22
    • Target
      lib/MigDLL.dll
    • Size 500KB
    • SHA256 0a727b5d7a4b9e7403d15383e2855423abcb803e85d0f3cf61f16628b12b8cf6
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral23behavioral24
    • Target
      lib/MigrationService.exe
    • Size 747KB
    • SHA256 0670d1474b5fc5a0fbbfc1c5d13e47f817321b6a81cc5118721ac98f0bf43536
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    7/10
    discoveryexecution
    behavioral25behavioral26
    • Target
      lib/SSDInfo.dll
    • Size 2.0MB
    • SHA256 536102f89fdbfbb9e4145722778efe9f6219dc87e3d3227b4a2e29c6e3eea925
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral27behavioral28
    • Target
      lib/WinClon64i.exe
    • Size 1.8MB
    • SHA256 929ed557616d65af64fda9b1465220957e4280eed7c0c5198a6df2c3a6514892
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral29behavioral30
    • Target
      lib/WinClon64x.exe
    • Size 1.1MB
    • SHA256 32afde07a21d333256c3f4bfebdcde013d74ed20ad06b6e7ad57be11abcf50ac
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral31behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

3
T1059

JavaScript

1
T1059.007

PowerShell

1
T1059.001

Windows Command Shell

1
T1059.003

Persistence

Boot or Logon Initialization Scripts

1
T1037

Logon Script (Windows)

1
T1037.001

Privilege Escalation

Access Token Manipulation

1
T1134

Parent PID Spoofing

1
T1134.004

Boot or Logon Initialization Scripts

1
T1037

Logon Script (Windows)

1
T1037.001

Process Injection

1
T1055

Defense Evasion

Access Token Manipulation

1
T1134

Parent PID Spoofing

1
T1134.004

File and Directory Permissions Modification

1
T1222

Process Injection

1
T1055

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Browser Information Discovery

1
T1217

Query Registry

2
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

System Time Discovery

1
T1124

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Tasks

static1

Score
5/10

behavioral1

discovery
Score
3/10

behavioral2

discovery
Score
3/10

behavioral3

execution
Score
3/10

behavioral4

execution
Score
3/10

behavioral5

discovery
Score
3/10

behavioral6

discovery
Score
3/10

behavioral7

discovery
Score
3/10

behavioral8

discovery
Score
3/10

behavioral9

discovery
Score
3/10

behavioral10

discovery
Score
3/10

behavioral11

discovery
Score
3/10

behavioral12

discovery
Score
3/10

behavioral13

discovery
Score
3/10

behavioral14

discovery
Score
3/10

behavioral15

discovery
Score
3/10

behavioral16

discovery
Score
3/10

behavioral17

defense_evasiondiscoveryexecutionsectopratpersistenceprivilege_escalationratspywaretrojan
Score
10/10

behavioral18

defense_evasiondiscoveryprivilege_escalation
Score
10/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

discovery
Score
3/10

behavioral22

discovery
Score
3/10

behavioral23

discovery
Score
3/10

behavioral24

discovery
Score
3/10

behavioral25

discoveryexecution
Score
7/10

behavioral26

discoveryexecution
Score
7/10

behavioral27

discovery
Score
3/10

behavioral28

discovery
Score
3/10

behavioral29

Score
1/10

behavioral30

Score
1/10

behavioral31

Score
1/10

behavioral32

Score
1/10