Analysis
-
max time kernel
77s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
26-02-2023 02:10
Static task
static1
Behavioral task
behavioral1
Sample
ade0377f44f8f24f26e62e4879751436f99e298c2ba7d0f9fd575659a0f9f54d.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
ade0377f44f8f24f26e62e4879751436f99e298c2ba7d0f9fd575659a0f9f54d.exe
-
Size
252KB
-
MD5
b949b9721369cc5df9c3b08fb61d792e
-
SHA1
be93b44d4d015c0924225c0b1cf149c3b7fcb903
-
SHA256
ade0377f44f8f24f26e62e4879751436f99e298c2ba7d0f9fd575659a0f9f54d
-
SHA512
6cb4720309b09bdad386509b49c67ab643ed97d16551b1c3b88715ee82bb44c40298bae50f161bee0a33b8e6233848073eb5484482d64dacb921e8c8655986d7
-
SSDEEP
6144:0LeGap/H9gStnws1TAq7HqkDiFeUtoyTtSBjHL/F9B0KYo9EjHL/F9B0KYo9:0LeDf+QVL4eUtoyRWTL/Ff0KYyETL/FV
Score
10/10
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload 2 IoCs
resource yara_rule behavioral1/memory/2124-133-0x0000000002360000-0x00000000023AE000-memory.dmp fatalrat behavioral1/memory/2124-134-0x0000000010000000-0x0000000010028000-memory.dmp fatalrat -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ade0377f44f8f24f26e62e4879751436f99e298c2ba7d0f9fd575659a0f9f54d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ade0377f44f8f24f26e62e4879751436f99e298c2ba7d0f9fd575659a0f9f54d.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2124 ade0377f44f8f24f26e62e4879751436f99e298c2ba7d0f9fd575659a0f9f54d.exe 2124 ade0377f44f8f24f26e62e4879751436f99e298c2ba7d0f9fd575659a0f9f54d.exe 2124 ade0377f44f8f24f26e62e4879751436f99e298c2ba7d0f9fd575659a0f9f54d.exe 2124 ade0377f44f8f24f26e62e4879751436f99e298c2ba7d0f9fd575659a0f9f54d.exe 2124 ade0377f44f8f24f26e62e4879751436f99e298c2ba7d0f9fd575659a0f9f54d.exe 2124 ade0377f44f8f24f26e62e4879751436f99e298c2ba7d0f9fd575659a0f9f54d.exe 2124 ade0377f44f8f24f26e62e4879751436f99e298c2ba7d0f9fd575659a0f9f54d.exe 2124 ade0377f44f8f24f26e62e4879751436f99e298c2ba7d0f9fd575659a0f9f54d.exe 2124 ade0377f44f8f24f26e62e4879751436f99e298c2ba7d0f9fd575659a0f9f54d.exe 2124 ade0377f44f8f24f26e62e4879751436f99e298c2ba7d0f9fd575659a0f9f54d.exe 2124 ade0377f44f8f24f26e62e4879751436f99e298c2ba7d0f9fd575659a0f9f54d.exe 2124 ade0377f44f8f24f26e62e4879751436f99e298c2ba7d0f9fd575659a0f9f54d.exe 2124 ade0377f44f8f24f26e62e4879751436f99e298c2ba7d0f9fd575659a0f9f54d.exe 2124 ade0377f44f8f24f26e62e4879751436f99e298c2ba7d0f9fd575659a0f9f54d.exe 2124 ade0377f44f8f24f26e62e4879751436f99e298c2ba7d0f9fd575659a0f9f54d.exe 2124 ade0377f44f8f24f26e62e4879751436f99e298c2ba7d0f9fd575659a0f9f54d.exe 2124 ade0377f44f8f24f26e62e4879751436f99e298c2ba7d0f9fd575659a0f9f54d.exe 2124 ade0377f44f8f24f26e62e4879751436f99e298c2ba7d0f9fd575659a0f9f54d.exe 2124 ade0377f44f8f24f26e62e4879751436f99e298c2ba7d0f9fd575659a0f9f54d.exe 2124 ade0377f44f8f24f26e62e4879751436f99e298c2ba7d0f9fd575659a0f9f54d.exe 2124 ade0377f44f8f24f26e62e4879751436f99e298c2ba7d0f9fd575659a0f9f54d.exe 2124 ade0377f44f8f24f26e62e4879751436f99e298c2ba7d0f9fd575659a0f9f54d.exe 2124 ade0377f44f8f24f26e62e4879751436f99e298c2ba7d0f9fd575659a0f9f54d.exe 2124 ade0377f44f8f24f26e62e4879751436f99e298c2ba7d0f9fd575659a0f9f54d.exe 2124 ade0377f44f8f24f26e62e4879751436f99e298c2ba7d0f9fd575659a0f9f54d.exe 2124 ade0377f44f8f24f26e62e4879751436f99e298c2ba7d0f9fd575659a0f9f54d.exe 2124 ade0377f44f8f24f26e62e4879751436f99e298c2ba7d0f9fd575659a0f9f54d.exe 2124 ade0377f44f8f24f26e62e4879751436f99e298c2ba7d0f9fd575659a0f9f54d.exe 2124 ade0377f44f8f24f26e62e4879751436f99e298c2ba7d0f9fd575659a0f9f54d.exe 2124 ade0377f44f8f24f26e62e4879751436f99e298c2ba7d0f9fd575659a0f9f54d.exe 2124 ade0377f44f8f24f26e62e4879751436f99e298c2ba7d0f9fd575659a0f9f54d.exe 2124 ade0377f44f8f24f26e62e4879751436f99e298c2ba7d0f9fd575659a0f9f54d.exe 2124 ade0377f44f8f24f26e62e4879751436f99e298c2ba7d0f9fd575659a0f9f54d.exe 2124 ade0377f44f8f24f26e62e4879751436f99e298c2ba7d0f9fd575659a0f9f54d.exe 2124 ade0377f44f8f24f26e62e4879751436f99e298c2ba7d0f9fd575659a0f9f54d.exe 2124 ade0377f44f8f24f26e62e4879751436f99e298c2ba7d0f9fd575659a0f9f54d.exe 2124 ade0377f44f8f24f26e62e4879751436f99e298c2ba7d0f9fd575659a0f9f54d.exe 2124 ade0377f44f8f24f26e62e4879751436f99e298c2ba7d0f9fd575659a0f9f54d.exe 2124 ade0377f44f8f24f26e62e4879751436f99e298c2ba7d0f9fd575659a0f9f54d.exe 2124 ade0377f44f8f24f26e62e4879751436f99e298c2ba7d0f9fd575659a0f9f54d.exe 2124 ade0377f44f8f24f26e62e4879751436f99e298c2ba7d0f9fd575659a0f9f54d.exe 2124 ade0377f44f8f24f26e62e4879751436f99e298c2ba7d0f9fd575659a0f9f54d.exe 2124 ade0377f44f8f24f26e62e4879751436f99e298c2ba7d0f9fd575659a0f9f54d.exe 2124 ade0377f44f8f24f26e62e4879751436f99e298c2ba7d0f9fd575659a0f9f54d.exe 2124 ade0377f44f8f24f26e62e4879751436f99e298c2ba7d0f9fd575659a0f9f54d.exe 2124 ade0377f44f8f24f26e62e4879751436f99e298c2ba7d0f9fd575659a0f9f54d.exe 2124 ade0377f44f8f24f26e62e4879751436f99e298c2ba7d0f9fd575659a0f9f54d.exe 2124 ade0377f44f8f24f26e62e4879751436f99e298c2ba7d0f9fd575659a0f9f54d.exe 2124 ade0377f44f8f24f26e62e4879751436f99e298c2ba7d0f9fd575659a0f9f54d.exe 2124 ade0377f44f8f24f26e62e4879751436f99e298c2ba7d0f9fd575659a0f9f54d.exe 2124 ade0377f44f8f24f26e62e4879751436f99e298c2ba7d0f9fd575659a0f9f54d.exe 2124 ade0377f44f8f24f26e62e4879751436f99e298c2ba7d0f9fd575659a0f9f54d.exe 2124 ade0377f44f8f24f26e62e4879751436f99e298c2ba7d0f9fd575659a0f9f54d.exe 2124 ade0377f44f8f24f26e62e4879751436f99e298c2ba7d0f9fd575659a0f9f54d.exe 2124 ade0377f44f8f24f26e62e4879751436f99e298c2ba7d0f9fd575659a0f9f54d.exe 2124 ade0377f44f8f24f26e62e4879751436f99e298c2ba7d0f9fd575659a0f9f54d.exe 2124 ade0377f44f8f24f26e62e4879751436f99e298c2ba7d0f9fd575659a0f9f54d.exe 2124 ade0377f44f8f24f26e62e4879751436f99e298c2ba7d0f9fd575659a0f9f54d.exe 2124 ade0377f44f8f24f26e62e4879751436f99e298c2ba7d0f9fd575659a0f9f54d.exe 2124 ade0377f44f8f24f26e62e4879751436f99e298c2ba7d0f9fd575659a0f9f54d.exe 2124 ade0377f44f8f24f26e62e4879751436f99e298c2ba7d0f9fd575659a0f9f54d.exe 2124 ade0377f44f8f24f26e62e4879751436f99e298c2ba7d0f9fd575659a0f9f54d.exe 2124 ade0377f44f8f24f26e62e4879751436f99e298c2ba7d0f9fd575659a0f9f54d.exe 2124 ade0377f44f8f24f26e62e4879751436f99e298c2ba7d0f9fd575659a0f9f54d.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2124 ade0377f44f8f24f26e62e4879751436f99e298c2ba7d0f9fd575659a0f9f54d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ade0377f44f8f24f26e62e4879751436f99e298c2ba7d0f9fd575659a0f9f54d.exe"C:\Users\Admin\AppData\Local\Temp\ade0377f44f8f24f26e62e4879751436f99e298c2ba7d0f9fd575659a0f9f54d.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2124