Analysis
-
max time kernel
25s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
-
submitted
26-02-2023 07:06
General
-
Target
tmp.exe
-
Size
252KB
-
MD5
a7e66f7ac3d38243c67d4356a3a947b0
-
SHA1
f7e1dbe3c3afcd2b41d75d8a8f8a87edd5c068aa
-
SHA256
37d9f76fb51d49ff8f5d8bd9f04e762a944dc4891d98f2c8db1b38b89795163f
-
SHA512
f4f44236cf546b56b4bbb6965d8a730d30960115cab1bfb4cd7778183bfbafd97fdbb11d245fbffc065bb137c4236268236358a4673160598e308286498a1403
-
SSDEEP
6144:0LeGap/H9gStnws1TAq7HqkDiFeUtoyTt6BjHL/F9B0KYo9EjHL/F9B0KYo9:0LeDf+QVL4eUtoyRuTL/Ff0KYyETL/FV
Score
10/10
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload 2 IoCs
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 51 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
312KB
-
Filesize
160KB