Analysis
-
max time kernel
31s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
18-02-2023 11:56
General
-
Target
9ca0b6d4b98cd17fd73617442d4fdbd3.exe
-
Size
176KB
-
MD5
9ca0b6d4b98cd17fd73617442d4fdbd3
-
SHA1
0e19d4b8d05b9b4517121157cdca8f31ececc9c3
-
SHA256
84397eb06ac563cfc61c29ca0545e93a03335a289976faa254d63cebb8779687
-
SHA512
8550cf667efa26a74c42ab1e8e8cb646c997a3918246b45720c1bec917c902382856cd952d3adbc6939f8d1d2ada21241e1752f4840bd8331345d4bc99370201
-
SSDEEP
3072:1Qv5Ko2zTp5j7Uj48xtVxePiaI3A6+GP8vzndiRF/rp/6pHtg+fJj38InpPS:1Qv5KLpR8489EPtU7ezdsr2VS
Score
10/10
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload 2 IoCs
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 51 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9ca0b6d4b98cd17fd73617442d4fdbd3.exe"C:\Users\Admin\AppData\Local\Temp\9ca0b6d4b98cd17fd73617442d4fdbd3.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
160KB
-
Filesize
312KB