Analysis
-
max time kernel
142s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 14:57
Static task
static1
Behavioral task
behavioral1
Sample
Perl510.dll
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Perl510.dll
Resource
win10v2004-20220414-en
General
-
Target
Perl510.dll
-
Size
924KB
-
MD5
dbf8b9ab8ae650d5b452240c0e9c90df
-
SHA1
1215872c6f7306d6ba14133eb706483f04445885
-
SHA256
9c7feb98fb5804f1f80dd03db1f84a06b68ea6043d2d34ab53edce82b83827b2
-
SHA512
f9ab16d7946f4dfab4abbe368d6863dbaa1e0c49b6b051ff44eecdf0053ee0d1204272b08ffc925d76335874ca1099ebebc84ba80be3aa9c9bd5e5007a62d3a9
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
suricata: ET MALWARE FatalRAT CnC Activity
suricata: ET MALWARE FatalRAT CnC Activity
-
Fatal Rat Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1992-4613-0x0000000010000000-0x00000000100E7000-memory.dmp fatalrat -
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 2 1992 rundll32.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
rundll32.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Windows\\SysWOW64\\rundll32.exe" rundll32.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
rundll32.exepid process 1992 rundll32.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz rundll32.exe -
Suspicious behavior: EnumeratesProcesses 51 IoCs
Processes:
rundll32.exepid process 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe 1992 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
rundll32.exedescription pid process Token: SeDebugPrivilege 1992 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 872 wrote to memory of 1992 872 rundll32.exe rundll32.exe PID 872 wrote to memory of 1992 872 rundll32.exe rundll32.exe PID 872 wrote to memory of 1992 872 rundll32.exe rundll32.exe PID 872 wrote to memory of 1992 872 rundll32.exe rundll32.exe PID 872 wrote to memory of 1992 872 rundll32.exe rundll32.exe PID 872 wrote to memory of 1992 872 rundll32.exe rundll32.exe PID 872 wrote to memory of 1992 872 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Perl510.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Perl510.dll,#12⤵
- Blocklisted process makes network request
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1992-54-0x0000000000000000-mapping.dmp
-
memory/1992-55-0x00000000768D1000-0x00000000768D3000-memory.dmpFilesize
8KB
-
memory/1992-57-0x0000000075710000-0x0000000075757000-memory.dmpFilesize
284KB
-
memory/1992-464-0x0000000002410000-0x0000000002521000-memory.dmpFilesize
1.1MB
-
memory/1992-465-0x0000000002410000-0x0000000002521000-memory.dmpFilesize
1.1MB
-
memory/1992-466-0x0000000002410000-0x0000000002521000-memory.dmpFilesize
1.1MB
-
memory/1992-463-0x0000000002410000-0x0000000002521000-memory.dmpFilesize
1.1MB
-
memory/1992-467-0x0000000002410000-0x0000000002521000-memory.dmpFilesize
1.1MB
-
memory/1992-468-0x0000000002410000-0x0000000002521000-memory.dmpFilesize
1.1MB
-
memory/1992-471-0x0000000002410000-0x0000000002521000-memory.dmpFilesize
1.1MB
-
memory/1992-469-0x0000000002410000-0x0000000002521000-memory.dmpFilesize
1.1MB
-
memory/1992-472-0x0000000002410000-0x0000000002521000-memory.dmpFilesize
1.1MB
-
memory/1992-470-0x0000000002410000-0x0000000002521000-memory.dmpFilesize
1.1MB
-
memory/1992-474-0x0000000002410000-0x0000000002521000-memory.dmpFilesize
1.1MB
-
memory/1992-475-0x0000000002410000-0x0000000002521000-memory.dmpFilesize
1.1MB
-
memory/1992-473-0x0000000002410000-0x0000000002521000-memory.dmpFilesize
1.1MB
-
memory/1992-478-0x0000000002410000-0x0000000002521000-memory.dmpFilesize
1.1MB
-
memory/1992-476-0x0000000002410000-0x0000000002521000-memory.dmpFilesize
1.1MB
-
memory/1992-477-0x0000000002410000-0x0000000002521000-memory.dmpFilesize
1.1MB
-
memory/1992-479-0x0000000002410000-0x0000000002521000-memory.dmpFilesize
1.1MB
-
memory/1992-480-0x0000000002410000-0x0000000002521000-memory.dmpFilesize
1.1MB
-
memory/1992-481-0x0000000002410000-0x0000000002521000-memory.dmpFilesize
1.1MB
-
memory/1992-482-0x0000000002410000-0x0000000002521000-memory.dmpFilesize
1.1MB
-
memory/1992-483-0x0000000002410000-0x0000000002521000-memory.dmpFilesize
1.1MB
-
memory/1992-485-0x0000000002410000-0x0000000002521000-memory.dmpFilesize
1.1MB
-
memory/1992-484-0x0000000002410000-0x0000000002521000-memory.dmpFilesize
1.1MB
-
memory/1992-486-0x0000000002410000-0x0000000002521000-memory.dmpFilesize
1.1MB
-
memory/1992-488-0x0000000002410000-0x0000000002521000-memory.dmpFilesize
1.1MB
-
memory/1992-489-0x0000000002410000-0x0000000002521000-memory.dmpFilesize
1.1MB
-
memory/1992-487-0x0000000002410000-0x0000000002521000-memory.dmpFilesize
1.1MB
-
memory/1992-490-0x0000000002410000-0x0000000002521000-memory.dmpFilesize
1.1MB
-
memory/1992-492-0x0000000002410000-0x0000000002521000-memory.dmpFilesize
1.1MB
-
memory/1992-491-0x0000000002410000-0x0000000002521000-memory.dmpFilesize
1.1MB
-
memory/1992-494-0x0000000002410000-0x0000000002521000-memory.dmpFilesize
1.1MB
-
memory/1992-493-0x0000000002410000-0x0000000002521000-memory.dmpFilesize
1.1MB
-
memory/1992-496-0x0000000002410000-0x0000000002521000-memory.dmpFilesize
1.1MB
-
memory/1992-495-0x0000000002410000-0x0000000002521000-memory.dmpFilesize
1.1MB
-
memory/1992-498-0x0000000002410000-0x0000000002521000-memory.dmpFilesize
1.1MB
-
memory/1992-497-0x0000000002410000-0x0000000002521000-memory.dmpFilesize
1.1MB
-
memory/1992-499-0x0000000002410000-0x0000000002521000-memory.dmpFilesize
1.1MB
-
memory/1992-500-0x0000000002410000-0x0000000002521000-memory.dmpFilesize
1.1MB
-
memory/1992-501-0x0000000002410000-0x0000000002521000-memory.dmpFilesize
1.1MB
-
memory/1992-504-0x0000000002410000-0x0000000002521000-memory.dmpFilesize
1.1MB
-
memory/1992-502-0x0000000002410000-0x0000000002521000-memory.dmpFilesize
1.1MB
-
memory/1992-505-0x0000000002410000-0x0000000002521000-memory.dmpFilesize
1.1MB
-
memory/1992-503-0x0000000002410000-0x0000000002521000-memory.dmpFilesize
1.1MB
-
memory/1992-506-0x0000000002410000-0x0000000002521000-memory.dmpFilesize
1.1MB
-
memory/1992-508-0x0000000002410000-0x0000000002521000-memory.dmpFilesize
1.1MB
-
memory/1992-507-0x0000000002410000-0x0000000002521000-memory.dmpFilesize
1.1MB
-
memory/1992-509-0x0000000002410000-0x0000000002521000-memory.dmpFilesize
1.1MB
-
memory/1992-510-0x0000000002410000-0x0000000002521000-memory.dmpFilesize
1.1MB
-
memory/1992-511-0x0000000002410000-0x0000000002521000-memory.dmpFilesize
1.1MB
-
memory/1992-512-0x0000000002410000-0x0000000002521000-memory.dmpFilesize
1.1MB
-
memory/1992-513-0x0000000002410000-0x0000000002521000-memory.dmpFilesize
1.1MB
-
memory/1992-515-0x0000000002410000-0x0000000002521000-memory.dmpFilesize
1.1MB
-
memory/1992-514-0x0000000002410000-0x0000000002521000-memory.dmpFilesize
1.1MB
-
memory/1992-516-0x0000000002410000-0x0000000002521000-memory.dmpFilesize
1.1MB
-
memory/1992-518-0x0000000002410000-0x0000000002521000-memory.dmpFilesize
1.1MB
-
memory/1992-517-0x0000000002410000-0x0000000002521000-memory.dmpFilesize
1.1MB
-
memory/1992-520-0x0000000002410000-0x0000000002521000-memory.dmpFilesize
1.1MB
-
memory/1992-519-0x0000000002410000-0x0000000002521000-memory.dmpFilesize
1.1MB
-
memory/1992-522-0x0000000002410000-0x0000000002521000-memory.dmpFilesize
1.1MB
-
memory/1992-521-0x0000000002410000-0x0000000002521000-memory.dmpFilesize
1.1MB
-
memory/1992-523-0x0000000002410000-0x0000000002521000-memory.dmpFilesize
1.1MB
-
memory/1992-524-0x0000000002410000-0x0000000002521000-memory.dmpFilesize
1.1MB
-
memory/1992-4613-0x0000000010000000-0x00000000100E7000-memory.dmpFilesize
924KB