sectoprat | 0bcdb372f12666baf0c8eaee6faa5edf58aa153399c0fcad9e927e5537564fa1

Analysis

max time kernel
150s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/11/2026, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SmartLab.exe
Size 5.4MB
Sample261109-ppqcdazycy
SHA256 0bcdb372f12666baf0c8eaee6faa5edf58aa153399c0fcad9e927e5537564fa1
MD5 af38e0c7438ff03b1c9a7abcb5f1ec7b
SHA1 70193aa46434e24261537012813ecd20c160dfb8
SHA512 1654649695f9ec3afd0ffac41ea31c3916c2985e7a90d5020f4017ee0014994e73355de1e3fd95b317b2ab452c9c40d3dd72d1213f70b50f98ca68dc514e76d7
SSDEEP 49152:hr3bJzBQN4cQ75rDAgCuHbIy5kcStHPI8GNrU77i6htA4lYSdDyGwewEcgf9htm:BbZBixmg7/D5lYSdDrwew89htm
TLSH
T1E7464A25279F1093E092E5398D5E5637DAA0BC07437E51EBD2A6BF060E326F3163BB14
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery sectoprat privilege_escalation rat trojan

Malware Config

Signatures

Family: SectopRAT
SectopRAT also known as Arechclient2 is a remote access trojan first seen in November 2019.
trojan rat sectoprat

Detects SectopRAT aka Arechclient2 1 IoCs

resource	yara_rule
behavioral2/memory/3460-36-0x000001E416CB0000-0x000001E416D1C000-memory.dmp	family_sectoprat

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 5708 set thread context of 3460	5708	SmartLab.exe	91
PID 5708 set thread context of 4320	5708	SmartLab.exe	92

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\MSFTShield_rel.job	XPFix.exe

Executes dropped EXE 1 IoCs

pid	Process
5708	SmartLab.exe

Loads dropped DLL 9 IoCs

pid	Process
5708	SmartLab.exe
5708	SmartLab.exe
5708	SmartLab.exe
5708	SmartLab.exe
5708	SmartLab.exe
5708	SmartLab.exe
5708	SmartLab.exe
3460	QuantumS86.exe
4320	XPFix.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XPFix.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
4988	SmartLab.exe
5708	SmartLab.exe
5708	SmartLab.exe
5708	SmartLab.exe
5708	SmartLab.exe
3460	QuantumS86.exe
3460	QuantumS86.exe
3460	QuantumS86.exe
3460	QuantumS86.exe
4320	XPFix.exe
4320	XPFix.exe
4320	XPFix.exe
4320	XPFix.exe
4320	XPFix.exe
4320	XPFix.exe
4320	XPFix.exe
4320	XPFix.exe

Suspicious behavior: MapViewOfSection 1 TTPs 2 IoCs

defense_evasion privilege_escalation

Process Injection

T1055

pid	Process
5708	SmartLab.exe
5708	SmartLab.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3460	QuantumS86.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4988 wrote to memory of 5708	4988	SmartLab.exe	89
PID 5708 wrote to memory of 3460	5708	SmartLab.exe	91
PID 5708 wrote to memory of 3460	5708	SmartLab.exe	91
PID 5708 wrote to memory of 4320	5708	SmartLab.exe	92
PID 5708 wrote to memory of 4320	5708	SmartLab.exe	92

C:\Users\Admin\AppData\Local\Temp\SmartLab.exe
"C:\Users\Admin\AppData\Local\Temp\SmartLab.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4988
- C:\ProgramData\WordpadDownload_v3\SmartLab.exe
  C:\ProgramData\WordpadDownload_v3\SmartLab.exe
  2⤵
  - Suspicious use of SetThreadContext
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:5708
- - C:\Users\Admin\AppData\Local\QuantumS86.exe
    C:\Users\Admin\AppData\Local\QuantumS86.exe
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3460
- - C:\Users\Admin\AppData\Roaming\WordpadDownload_v3\XPFix.exe
    "C:\Users\Admin\AppData\Roaming\WordpadDownload_v3\XPFix.exe" "C:\Users\Admin\AppData\Roaming\WordpadDownload_v3\XPFix.exe" /u
    3⤵
    - Drops file in Windows directory
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Process Injection

T1055

Defense Evasion

Process Injection

T1055

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SmartLab.exe

Path C:\ProgramData\WordpadDownload_v3\SmartLab.exe
Size 5.4MB
SHA256 0bcdb372f12666baf0c8eaee6faa5edf58aa153399c0fcad9e927e5537564fa1
MD5 af38e0c7438ff03b1c9a7abcb5f1ec7b
SHA1 70193aa46434e24261537012813ecd20c160dfb8
SHA512 1654649695f9ec3afd0ffac41ea31c3916c2985e7a90d5020f4017ee0014994e73355de1e3fd95b317b2ab452c9c40d3dd72d1213f70b50f98ca68dc514e76d7
SSDEEP 49152:hr3bJzBQN4cQ75rDAgCuHbIy5kcStHPI8GNrU77i6htA4lYSdDyGwewEcgf9htm:BbZBixmg7/D5lYSdDrwew89htm
TLSH
T1E7464A25279F1093E092E5398D5E5637DAA0BC07437E51EBD2A6BF060E326F3163BB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebView2Loader.dll

Path C:\ProgramData\WordpadDownload_v3\WebView2Loader.dll
Size 145KB
SHA256 a86733c70d1eed6bbcd4e587ada4580289abc740187eb7cefff3b1a41b4d0434
MD5 7b4a5f64bd77100059baea5d6d884f38
SHA1 b1e3139a0a6007ffe06ba14392c81d024e069725
SHA512 164c68068cd9cc3e08c02d905a35bbada2faeb67afc642c48dadbc3668d33d5130c0dd42028c88bee4648ed4c706e67eed4c67915e2188d99f6bf6dd61e1a417
SSDEEP 3072:ALT7tOWKpfVR/5KYhXlU/tO7+Z6pATzgEtal9A2Fp:ApyVR/5KaXq1OZEtKA
TLSH
T145E34B5773E500BBE16686B8C9A34A15E77378100B609FDF03A442695F237D5AE3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mfc140u.dll

Path C:\ProgramData\WordpadDownload_v3\mfc140u.dll
Size 5.4MB
SHA256 8d97422cb84fd123deafce190fce6f34d868f7e692593fe1ed7d91ee7161ac27
MD5 b4d93addb6f8cd8baefe3004f94a12a4
SHA1 e65d55dadc2f799dc8af209452fa8bdee2f0b12b
SHA512 1ce894d6bedf52e8446dc3590d41c7d80b1951508c33d4fac43645ae6baa71228295d43be5204f34c2af9409fd508f664cff3040c2715744d019714fe843b2b4
SSDEEP 98304:Njy+T3PDBkmAvKFLOAkGkzdnEVomFHKnP:Nj/T3LR7FLOyomFHKnP
TLSH
T186467D8A7AED0494D5A5D07AC6678E5FD3B3FC50132193CF0061A78EAF737D2493A622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\ProgramData\WordpadDownload_v3\msvcp140.dll
Size 544KB
SHA256 1e2e2bcb916931f0ee6d0a567212511244e7442da574757c331c1b91087f2a0f
MD5 b08063e2d0bb587538575af2babac0b2
SHA1 82a72fad0b6935880fa9909db183b54d09285b39
SHA512 f1345e0ed02c5f4208766458b68792995b37a103e8951286d9b97dcb02d52d1905f63a395a03459643518e5b51817744548bfbce8d5835fdc1c4e828e29acde7
SSDEEP 12288:ihSlSEiVO3dam7VDIsZEXES1gfQEKZm+jWodEEV4Ks:ihWiVO3dNIsZTS4QEKZm+jWodEEOf
TLSH
T152C41A27F74906F0E195E3B8A1838702D7F1BC4A8322A3C792EB955D2F573D0A67B650
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\ProgramData\WordpadDownload_v3\vcruntime140.dll
Size 121KB
SHA256 60b813f8b87ff4fa344f081c163c1a2234b5e3e41f748721c28fbdecbcfecb8a
MD5 ec0117040bd1e880088753d9b8467234
SHA1 ccadc48b2df78c1622073200aaf1d4f1624c8f84
SHA512 fb169c2395438d5ae491ea8b0fde1e6ff94616c19dd427566feb6cece678a0a990514dbc208ed6fc0010068b342eaab89756baf266daaa4abf776db84fe0b0c5
SSDEEP 1536:rbmQhxfqEu7IrHwOsEDzvvGfWJhEMjaecbWIG9lM5zM6dgzHv:r+EFrHw43GfWJhE8aecbWIG8UL
TLSH
T188C36B42B2B802FBD12BC174C2A2DA23FBB5B4454B605BDF07AA9A640F53BD06D3D745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\ProgramData\WordpadDownload_v3\vcruntime140_1.dll
Size 48KB
SHA256 e30b3f4979b63b50438d061858c9cde962f4494e585c627a11c98b6c5b7b2592
MD5 851760a3cc87354e057985e42e69f425
SHA1 9ad109ef885e5a07c59c010ca006cfcd06a00f30
SHA512 598450a96c5db0958cbaf84a35104ad52dcce1786dca5943294bc5cb50f68202ea9717e8fb96e46a826efede25515db9374ea86f2e89db74419178ae27f36de3
SSDEEP 768:/J1E6sCUocm8zuAMFAz3SPZMsJGJ+x9z1Vjk6bK9z6:/UjU+KesgJuzU6az6
TLSH
T1DB236BD197A84042D4AB9970C1E7EE27BD3CF7A61B50968B07E5E24C0E537D0EB3931A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QuantumS86.exe

Path C:\Users\Admin\AppData\Local\QuantumS86.exe
Size 511KB
SHA256 f7c666dbcb9c1c9ac1204cf62ca3efa5c3eaf3e7dd08ea9258eaee490a9bd050
MD5 65d17cce4863d028f81456f711c03bd9
SHA1 e53337ab536f4c4c915a5ce706a0a82803b6903f
SHA512 47bac25b2c4c7f015d3702d66c2c84248a975b9f5e9f2f912bdfad9c648c512d2ea3c2248a6840dc098cc0abe9a52276fd55f29ca4eac4f7b7b9bf68bf547820
SSDEEP 6144:KUbqVIrt8zwHRePB4ck/XlSCl0iA7+67R9etDMSwMd7wvc5:K2r7xGadSdt+67RktISwM+k
TLSH
T158B45B42B36C3DF9D067D139C9724692E971BC155720E70E03BD676A1F23362BE2AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7EDCD2.tmp

Path C:\Users\Admin\AppData\Local\Temp\7EDCD2.tmp
Size 1.9MB
SHA256 bc120b10bfc73f0e8a87732e23803a669c4f3d72081159ce40a2f8b7f5b175c2
MD5 84deb452b69d1a1d3b7a0923487bcf06
SHA1 e3000d75d371c8a961c993812b678fa7d74c2ff7
SHA512 9b07fc3542ce06f0e13ae659d8e90e18fdc409afbfeb5a0cd54ae1efbe12caa2f3d3243d40d170f72b46d90652d13b2c5bd528b2fe2accf1588ed7d07dbb5408
SSDEEP 49152:LXD9DUtvuUrsfwhe0PMLrlv0EOMhkDWZ3V2CvDRs5YJG:DD9DMvLIfwhJPMX+YvvDRsKJG
TLSH
T13295335AF3B913B434AFCED522DFC32FD2E7A236EB7C676604A053B64C11B880451696
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7EDCD2.tmp

Path C:\Users\Admin\AppData\Local\Temp\7EDCD2.tmp
Size 1.9MB
SHA256 11e73ac4301a33f91fab3ce0b44c8236042bab9c2c9335965717f208cc6923a9
MD5 d1c1be7eef8dc9ff02df6a244a5acb81
SHA1 a1f0d9a6d6701df28e4c4ccd8bcd0206f89234a4
SHA512 960d169cb056874d1d9cd73f77d146e252b9ae8f1bf17c9d7f6ada467dc63193d6b42446c828b6d7417c6755fe2879513ef16603051e7243c668f3cccb40e503
SSDEEP 49152:2pD9DUtvuUrsfwhY0PMLrlv0EOMhkDWZ3V2CvDRs5YJG:CD9DMvLIfwhvPMX+YvvDRsKJG
TLSH
T1B795335AF3B913B434AFCED522DFC32FD2E7A236EB7C676604A053B64C11B880451696
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C2C3963.tmp

Path C:\Users\Admin\AppData\Local\Temp\C2C3963.tmp
Size 40B
SHA256 235e0fb4cb578b19bd0b1fde7d009d260de19879739f6e228983137c6ea56905
MD5 054abbc2a8d1a496cead1a40d785359b
SHA1 30ae50cd75c942fe5427a50e7cc3a6e3be3d5852
SHA512 ab716b60e1a6a45b16394b58b1945a9523a6d80ef4e8ff4e7fe07620e0836dd1adb8edaa7252beb17e771cbb7fcbcf4e6119f7182e12dfdc2629d966665d0942
MD5 SHA1 SHA512

Submit Download

XPFix.exe

Path C:\Users\Admin\AppData\Roaming\WordpadDownload_v3\XPFix.exe
Size 286KB
SHA256 5ec174af8a18a5516b8a6e11d8a27481d70df14d1edb67c48b5458ff44df9146
MD5 810d42177538ad5ca18d4dd597c00658
SHA1 7374bbe63c44de9536c22cdc111894c6d4929eb3
SHA512 233cdbaa1658719e9e44869930aef8ed09a17bd1e227c43785ce1b4298fd9f767818b75888db9cb5184a134a0babedd32cc0788059c251a1dff3f6aa27ebd30d
SSDEEP 6144:WEDFuBN6zANskE9qgfyMEvt93L2kx3W71+KL:WiuB4fyzvtFt3WFL
TLSH
T164547E00B651C136F5F318768AFE9B79993DBD312B1551C363C40EAEBE22BE1793121A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3460-27-0x00007FF6DDDF0000-0x00007FF6DDE89000-memory.dmp

Download

memory/3460-21-0x00007FF6DDDF0000-0x00007FF6DDE89000-memory.dmp

Download

memory/3460-45-0x00007FF6DDDF0000-0x00007FF6DDE89000-memory.dmp

Download

memory/3460-39-0x000001E42F460000-0x000001E42F4D6000-memory.dmp

Download

memory/3460-38-0x000001E416D80000-0x000001E416DD0000-memory.dmp

Download

memory/3460-37-0x000001E42F630000-0x000001E42F7F2000-memory.dmp

Download

memory/3460-36-0x000001E416CB0000-0x000001E416D1C000-memory.dmp

Download

memory/4320-40-0x0000000074F20000-0x0000000074F72000-memory.dmp

Download

memory/4320-34-0x00007FF944180000-0x00007FF9443E3000-memory.dmp

Download

memory/4988-0-0x00007FF92CAF0000-0x00007FF92CB53000-memory.dmp

Download

memory/5708-16-0x00007FF92CAF0000-0x00007FF92CB53000-memory.dmp

Download

memory/5708-13-0x00007FF92CAF0000-0x00007FF92CB53000-memory.dmp

Download

memory/5708-28-0x00007FF736A60000-0x00007FF736FD2000-memory.dmp

Download

memory/5708-10-0x00007FF92CB0D000-0x00007FF92CB0F000-memory.dmp

Download

memory/5708-25-0x00007FF92CAF0000-0x00007FF92CB53000-memory.dmp

Download

memory/5708-19-0x00007FF92CAF0000-0x00007FF92CB53000-memory.dmp

Download

memory/5708-17-0x00007FF92CAF0000-0x00007FF92CB53000-memory.dmp

Download

memory/5708-9-0x00007FF92CAF0000-0x00007FF92CB53000-memory.dmp

Download