Analysis
- max time kernel
149s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
09/11/2026, 07:14
General
- Target SmartLab.exe
- Size 5.4MB
- Sample261109-h24bfaay2y
- SHA256 0bcdb372f12666baf0c8eaee6faa5edf58aa153399c0fcad9e927e5537564fa1
Malware Config
Signatures
- Family: SectopRAT
SectopRAT also known as Arechclient2 is a remote access trojan first seen in November 2019.
- Detects SectopRAT aka Arechclient2 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Drops file in Windows directory 1 IoCs
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 9 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 17 IoCs
- Suspicious behavior: MapViewOfSection 1 TTPs 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SmartLab.exe"C:\Users\Admin\AppData\Local\Temp\SmartLab.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\WordpadDownload_v3\SmartLab.exeC:\ProgramData\WordpadDownload_v3\SmartLab.exe2⤵
- Suspicious use of SetThreadContext
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\QuantumS86.exeC:\Users\Admin\AppData\Local\QuantumS86.exe3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\WordpadDownload_v3\XPFix.exe"C:\Users\Admin\AppData\Roaming\WordpadDownload_v3\XPFix.exe" "C:\Users\Admin\AppData\Roaming\WordpadDownload_v3\XPFix.exe" /u3⤵
- Drops file in Windows directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
SmartLab.exe
WebView2Loader.dll
mfc140u.dll
msvcp140.dll
vcruntime140.dll
vcruntime140_1.dll
QuantumS86.exe
3CA50B1.tmp
3CA50B1.tmp
7A4791B.tmp
XPFix.exe
memory/2848-27-0x00007FFDF6F40000-0x00007FFDF6F41000-memory.dmp
memory/2848-28-0x00007FFDD4DEF000-0x00007FFDD4DF0000-memory.dmp
memory/2848-20-0x00007FF737790000-0x00007FF737829000-memory.dmp
memory/2848-34-0x000001FA93150000-0x000001FA931C6000-memory.dmp
memory/2848-50-0x00007FFDD4C60000-0x00007FFDD5604000-memory.dmp
memory/2848-52-0x00007FFDF6F40000-0x00007FFDF6F41000-memory.dmp
memory/2848-40-0x00007FF737790000-0x00007FF737829000-memory.dmp
memory/2848-24-0x00007FF737790000-0x00007FF737829000-memory.dmp
memory/2848-42-0x00007FFDD4C60000-0x00007FFDD5604000-memory.dmp
memory/2848-35-0x00007FFDD4C60000-0x00007FFDD5604000-memory.dmp
memory/2848-29-0x000001FA92250000-0x000001FA922BC000-memory.dmp
memory/2848-30-0x00007FFDD4C60000-0x00007FFDD5604000-memory.dmp
memory/2848-31-0x00007FFDD4C60000-0x00007FFDD5604000-memory.dmp
memory/2848-32-0x000001FAAB9C0000-0x000001FAABB82000-memory.dmp
memory/2848-33-0x000001FA92380000-0x000001FA923D0000-memory.dmp
memory/3532-0-0x00007FFDE7E20000-0x00007FFDE7E83000-memory.dmp
memory/4056-12-0x00007FFDE7E20000-0x00007FFDE7E83000-memory.dmp
memory/4056-26-0x00007FF61F690000-0x00007FF61FC02000-memory.dmp
memory/4056-18-0x00007FFDE7E20000-0x00007FFDE7E83000-memory.dmp
memory/4056-16-0x00007FFDE7E20000-0x00007FFDE7E83000-memory.dmp
memory/4056-13-0x00007FFDE7E20000-0x00007FFDE7E83000-memory.dmp
memory/4056-10-0x00007FFDE7E3D000-0x00007FFDE7E3F000-memory.dmp
memory/4056-9-0x00007FFDE7E20000-0x00007FFDE7E83000-memory.dmp
memory/4752-43-0x00007FFDF8000000-0x00007FFDF8263000-memory.dmp
memory/4752-45-0x0000000074F60000-0x0000000074FB2000-memory.dmp