Analysis
-
max time kernel
11s -
max time network
141s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
01-07-2021 14:19
General
-
Target
2d9002135a5b85b3f3962eab45859f1e59d20ded771b94f0e1127c6c162cb0f4.exe
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat Payload 2 IoCs
-
Executes dropped EXE 2 IoCs
-
Drops file in Windows directory 4 IoCs
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 21 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2d9002135a5b85b3f3962eab45859f1e59d20ded771b94f0e1127c6c162cb0f4.exe"C:\Users\Admin\AppData\Local\Temp\2d9002135a5b85b3f3962eab45859f1e59d20ded771b94f0e1127c6c162cb0f4.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Vwxyab.exeC:\Windows\Vwxyab.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Vwxyab.exeC:\Windows\Vwxyab.exe Win72⤵
- Executes dropped EXE
- Drops file in Windows directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
2da0d1842cce00414ad22f38c85cb111
SHA199853f6a8378220427b6a05bedb34e8f4e45645f
SHA256cd70bde1d7eabbe12efd0bb2ed414dc6fe6645f7dabb0f3a39d7b70c6259bace
SHA5125457d25270dfd0d2df3b54743c0d5a43b0b17a318045f7aaa0058ec1d47d5e0e8e51a260a57408969e8080e92a475caddbc77d617c35d02f5dc67623ed6e7888
-
MD5
d96987f5e2f64b880cfb3a7de05ff0ef
SHA1edd15437be63392c7cd332919c332029a2240dd0
SHA2562d9002135a5b85b3f3962eab45859f1e59d20ded771b94f0e1127c6c162cb0f4
SHA512226329ad4d9684a0ef0cfdb80450f9006a9d0f88007b3f31d4bfa6f258c94fdc06262f560327511acb49847729875ee9e80f327f32f9b23a75ec0eb1ffa6090b
-
MD5
d96987f5e2f64b880cfb3a7de05ff0ef
SHA1edd15437be63392c7cd332919c332029a2240dd0
SHA2562d9002135a5b85b3f3962eab45859f1e59d20ded771b94f0e1127c6c162cb0f4
SHA512226329ad4d9684a0ef0cfdb80450f9006a9d0f88007b3f31d4bfa6f258c94fdc06262f560327511acb49847729875ee9e80f327f32f9b23a75ec0eb1ffa6090b
-
MD5
d96987f5e2f64b880cfb3a7de05ff0ef
SHA1edd15437be63392c7cd332919c332029a2240dd0
SHA2562d9002135a5b85b3f3962eab45859f1e59d20ded771b94f0e1127c6c162cb0f4
SHA512226329ad4d9684a0ef0cfdb80450f9006a9d0f88007b3f31d4bfa6f258c94fdc06262f560327511acb49847729875ee9e80f327f32f9b23a75ec0eb1ffa6090b
-
Filesize
168KB
-
Filesize
168KB
-
