Analysis
-
max time kernel
11s -
max time network
141s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
01-07-2021 14:19
Static task
static1
Behavioral task
behavioral1
Sample
2d9002135a5b85b3f3962eab45859f1e59d20ded771b94f0e1127c6c162cb0f4.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
2d9002135a5b85b3f3962eab45859f1e59d20ded771b94f0e1127c6c162cb0f4.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
-
Target
2d9002135a5b85b3f3962eab45859f1e59d20ded771b94f0e1127c6c162cb0f4.exe
Score
10/10
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat Payload 2 IoCs
resource yara_rule behavioral2/memory/4428-114-0x0000000010000000-0x000000001002A000-memory.dmp fatalrat behavioral2/memory/4836-119-0x0000000010000000-0x000000001002A000-memory.dmp fatalrat -
Executes dropped EXE 2 IoCs
pid Process 4836 Vwxyab.exe 4900 Vwxyab.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\Vwxyab.exe 2d9002135a5b85b3f3962eab45859f1e59d20ded771b94f0e1127c6c162cb0f4.exe File opened for modification C:\Windows\Vwxyab.exe 2d9002135a5b85b3f3962eab45859f1e59d20ded771b94f0e1127c6c162cb0f4.exe File opened for modification C:\Windows\Vwxyab.exe Vwxyab.exe File created C:\Windows\Vwxyab.exe Vwxyab.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Vwxyab.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Vwxyab.exe -
Modifies data under HKEY_USERS 21 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies Vwxyab.exe Key created \REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Services\Vwxyab Defghijk Vwxyab.exe Set value (str) \REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Services\Vwxyab Defghijk\InstallTime = "2021-07-01 14:23" Vwxyab.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum\Version = "7" Vwxyab.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft Vwxyab.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion Vwxyab.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableLockWorkstation = "1" Vwxyab.exe Key created \REGISTRY\USER\.DEFAULT\SYSTEM Vwxyab.exe Key created \REGISTRY\USER\.DEFAULT\System\CurrentControlSet Vwxyab.exe Set value (str) \REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Services\Vwxyab Defghijk\Group = "Fatal" Vwxyab.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft Vwxyab.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie Vwxyab.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Vwxyab.exe Key created \REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Services\Vwxyab Defghijk Vwxyab.exe Key created \REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Services Vwxyab.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum Vwxyab.exe Key created \REGISTRY\USER\.DEFAULT\Software Vwxyab.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableLockWorkstation = "1" Vwxyab.exe Key created \REGISTRY\USER\.DEFAULT\Software Vwxyab.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System Vwxyab.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System Vwxyab.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4900 Vwxyab.exe 4900 Vwxyab.exe 4900 Vwxyab.exe 4900 Vwxyab.exe 4900 Vwxyab.exe 4900 Vwxyab.exe 4900 Vwxyab.exe 4900 Vwxyab.exe 4900 Vwxyab.exe 4900 Vwxyab.exe 4900 Vwxyab.exe 4900 Vwxyab.exe 4900 Vwxyab.exe 4900 Vwxyab.exe 4900 Vwxyab.exe 4900 Vwxyab.exe 4900 Vwxyab.exe 4900 Vwxyab.exe 4900 Vwxyab.exe 4900 Vwxyab.exe 4900 Vwxyab.exe 4900 Vwxyab.exe 4900 Vwxyab.exe 4900 Vwxyab.exe 4900 Vwxyab.exe 4900 Vwxyab.exe 4900 Vwxyab.exe 4900 Vwxyab.exe 4900 Vwxyab.exe 4900 Vwxyab.exe 4900 Vwxyab.exe 4900 Vwxyab.exe 4900 Vwxyab.exe 4900 Vwxyab.exe 4900 Vwxyab.exe 4900 Vwxyab.exe 4900 Vwxyab.exe 4900 Vwxyab.exe 4900 Vwxyab.exe 4900 Vwxyab.exe 4900 Vwxyab.exe 4900 Vwxyab.exe 4900 Vwxyab.exe 4900 Vwxyab.exe 4900 Vwxyab.exe 4900 Vwxyab.exe 4900 Vwxyab.exe 4900 Vwxyab.exe 4900 Vwxyab.exe 4900 Vwxyab.exe 4900 Vwxyab.exe 4900 Vwxyab.exe 4900 Vwxyab.exe 4900 Vwxyab.exe 4900 Vwxyab.exe 4900 Vwxyab.exe 4900 Vwxyab.exe 4900 Vwxyab.exe 4900 Vwxyab.exe 4900 Vwxyab.exe 4900 Vwxyab.exe 4900 Vwxyab.exe 4900 Vwxyab.exe 4900 Vwxyab.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4428 2d9002135a5b85b3f3962eab45859f1e59d20ded771b94f0e1127c6c162cb0f4.exe Token: SeDebugPrivilege 4836 Vwxyab.exe Token: SeDebugPrivilege 4900 Vwxyab.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4836 wrote to memory of 4900 4836 Vwxyab.exe 76 PID 4836 wrote to memory of 4900 4836 Vwxyab.exe 76 PID 4836 wrote to memory of 4900 4836 Vwxyab.exe 76
Processes
-
C:\Users\Admin\AppData\Local\Temp\2d9002135a5b85b3f3962eab45859f1e59d20ded771b94f0e1127c6c162cb0f4.exe"C:\Users\Admin\AppData\Local\Temp\2d9002135a5b85b3f3962eab45859f1e59d20ded771b94f0e1127c6c162cb0f4.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4428
-
C:\Windows\Vwxyab.exeC:\Windows\Vwxyab.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Windows\Vwxyab.exeC:\Windows\Vwxyab.exe Win72⤵
- Executes dropped EXE
- Drops file in Windows directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4900
-