Analysis
-
max time kernel
76s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
25-02-2023 06:29
Static task
static1
Behavioral task
behavioral1
Sample
fcf4329bec808e95cd7eeb3396060b61.exe
Resource
win7-20230220-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
fcf4329bec808e95cd7eeb3396060b61.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
fcf4329bec808e95cd7eeb3396060b61.exe
-
Size
292KB
-
MD5
fcf4329bec808e95cd7eeb3396060b61
-
SHA1
fea1ed17dd407b7be980d8996a5756a0dbdc3bfc
-
SHA256
c3c655e28a4fc1b268ea9f755c8a4c2418b713f2abc641c30519c4ca641d84b8
-
SHA512
946704e758e1542244f88d8d6d9af49bfac5f894d3aebc1b66b79937078ac401c611ecf385d7a5299c7e28db2c636aac710343c7159dac3c9e2a967393e80a02
-
SSDEEP
3072:Oh0ca1GaQZCklyWJtF5NptfIwID6E9M5Pb6wr90QC6rxdSEM5Hkq1yGe9UEpj4KF:w9ayV7tFJ526Zb6+TCYjMtH1yGI4O
Score
10/10
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload 2 IoCs
resource yara_rule behavioral2/memory/4876-133-0x0000000002360000-0x00000000023AE000-memory.dmp fatalrat behavioral2/memory/4876-134-0x0000000010000000-0x0000000010028000-memory.dmp fatalrat -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 fcf4329bec808e95cd7eeb3396060b61.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz fcf4329bec808e95cd7eeb3396060b61.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4876 fcf4329bec808e95cd7eeb3396060b61.exe 4876 fcf4329bec808e95cd7eeb3396060b61.exe 4876 fcf4329bec808e95cd7eeb3396060b61.exe 4876 fcf4329bec808e95cd7eeb3396060b61.exe 4876 fcf4329bec808e95cd7eeb3396060b61.exe 4876 fcf4329bec808e95cd7eeb3396060b61.exe 4876 fcf4329bec808e95cd7eeb3396060b61.exe 4876 fcf4329bec808e95cd7eeb3396060b61.exe 4876 fcf4329bec808e95cd7eeb3396060b61.exe 4876 fcf4329bec808e95cd7eeb3396060b61.exe 4876 fcf4329bec808e95cd7eeb3396060b61.exe 4876 fcf4329bec808e95cd7eeb3396060b61.exe 4876 fcf4329bec808e95cd7eeb3396060b61.exe 4876 fcf4329bec808e95cd7eeb3396060b61.exe 4876 fcf4329bec808e95cd7eeb3396060b61.exe 4876 fcf4329bec808e95cd7eeb3396060b61.exe 4876 fcf4329bec808e95cd7eeb3396060b61.exe 4876 fcf4329bec808e95cd7eeb3396060b61.exe 4876 fcf4329bec808e95cd7eeb3396060b61.exe 4876 fcf4329bec808e95cd7eeb3396060b61.exe 4876 fcf4329bec808e95cd7eeb3396060b61.exe 4876 fcf4329bec808e95cd7eeb3396060b61.exe 4876 fcf4329bec808e95cd7eeb3396060b61.exe 4876 fcf4329bec808e95cd7eeb3396060b61.exe 4876 fcf4329bec808e95cd7eeb3396060b61.exe 4876 fcf4329bec808e95cd7eeb3396060b61.exe 4876 fcf4329bec808e95cd7eeb3396060b61.exe 4876 fcf4329bec808e95cd7eeb3396060b61.exe 4876 fcf4329bec808e95cd7eeb3396060b61.exe 4876 fcf4329bec808e95cd7eeb3396060b61.exe 4876 fcf4329bec808e95cd7eeb3396060b61.exe 4876 fcf4329bec808e95cd7eeb3396060b61.exe 4876 fcf4329bec808e95cd7eeb3396060b61.exe 4876 fcf4329bec808e95cd7eeb3396060b61.exe 4876 fcf4329bec808e95cd7eeb3396060b61.exe 4876 fcf4329bec808e95cd7eeb3396060b61.exe 4876 fcf4329bec808e95cd7eeb3396060b61.exe 4876 fcf4329bec808e95cd7eeb3396060b61.exe 4876 fcf4329bec808e95cd7eeb3396060b61.exe 4876 fcf4329bec808e95cd7eeb3396060b61.exe 4876 fcf4329bec808e95cd7eeb3396060b61.exe 4876 fcf4329bec808e95cd7eeb3396060b61.exe 4876 fcf4329bec808e95cd7eeb3396060b61.exe 4876 fcf4329bec808e95cd7eeb3396060b61.exe 4876 fcf4329bec808e95cd7eeb3396060b61.exe 4876 fcf4329bec808e95cd7eeb3396060b61.exe 4876 fcf4329bec808e95cd7eeb3396060b61.exe 4876 fcf4329bec808e95cd7eeb3396060b61.exe 4876 fcf4329bec808e95cd7eeb3396060b61.exe 4876 fcf4329bec808e95cd7eeb3396060b61.exe 4876 fcf4329bec808e95cd7eeb3396060b61.exe 4876 fcf4329bec808e95cd7eeb3396060b61.exe 4876 fcf4329bec808e95cd7eeb3396060b61.exe 4876 fcf4329bec808e95cd7eeb3396060b61.exe 4876 fcf4329bec808e95cd7eeb3396060b61.exe 4876 fcf4329bec808e95cd7eeb3396060b61.exe 4876 fcf4329bec808e95cd7eeb3396060b61.exe 4876 fcf4329bec808e95cd7eeb3396060b61.exe 4876 fcf4329bec808e95cd7eeb3396060b61.exe 4876 fcf4329bec808e95cd7eeb3396060b61.exe 4876 fcf4329bec808e95cd7eeb3396060b61.exe 4876 fcf4329bec808e95cd7eeb3396060b61.exe 4876 fcf4329bec808e95cd7eeb3396060b61.exe 4876 fcf4329bec808e95cd7eeb3396060b61.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4876 fcf4329bec808e95cd7eeb3396060b61.exe