Analysis
-
max time kernel
81s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
26-02-2023 15:31
Static task
static1
Behavioral task
behavioral1
Sample
Updaater.exe
Resource
win7-20230220-en
windows7-x64
Behavioral task
behavioral2
Sample
Updaater.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
General
-
Target
Updaater.exe
-
Size
252KB
-
MD5
b949b9721369cc5df9c3b08fb61d792e
-
SHA1
be93b44d4d015c0924225c0b1cf149c3b7fcb903
-
SHA256
ade0377f44f8f24f26e62e4879751436f99e298c2ba7d0f9fd575659a0f9f54d
-
SHA512
6cb4720309b09bdad386509b49c67ab643ed97d16551b1c3b88715ee82bb44c40298bae50f161bee0a33b8e6233848073eb5484482d64dacb921e8c8655986d7
-
SSDEEP
6144:0LeGap/H9gStnws1TAq7HqkDiFeUtoyTtSBjHL/F9B0KYo9EjHL/F9B0KYo9:0LeDf+QVL4eUtoyRWTL/Ff0KYyETL/FV
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload 2 IoCs
resource yara_rule behavioral2/memory/2120-133-0x0000000002470000-0x00000000024BE000-memory.dmp fatalrat behavioral2/memory/2120-134-0x0000000010000000-0x0000000010028000-memory.dmp fatalrat -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Updaater.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Updaater.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2120 Updaater.exe 2120 Updaater.exe 2120 Updaater.exe 2120 Updaater.exe 2120 Updaater.exe 2120 Updaater.exe 2120 Updaater.exe 2120 Updaater.exe 2120 Updaater.exe 2120 Updaater.exe 2120 Updaater.exe 2120 Updaater.exe 2120 Updaater.exe 2120 Updaater.exe 2120 Updaater.exe 2120 Updaater.exe 2120 Updaater.exe 2120 Updaater.exe 2120 Updaater.exe 2120 Updaater.exe 2120 Updaater.exe 2120 Updaater.exe 2120 Updaater.exe 2120 Updaater.exe 2120 Updaater.exe 2120 Updaater.exe 2120 Updaater.exe 2120 Updaater.exe 2120 Updaater.exe 2120 Updaater.exe 2120 Updaater.exe 2120 Updaater.exe 2120 Updaater.exe 2120 Updaater.exe 2120 Updaater.exe 2120 Updaater.exe 2120 Updaater.exe 2120 Updaater.exe 2120 Updaater.exe 2120 Updaater.exe 2120 Updaater.exe 2120 Updaater.exe 2120 Updaater.exe 2120 Updaater.exe 2120 Updaater.exe 2120 Updaater.exe 2120 Updaater.exe 2120 Updaater.exe 2120 Updaater.exe 2120 Updaater.exe 2120 Updaater.exe 2120 Updaater.exe 2120 Updaater.exe 2120 Updaater.exe 2120 Updaater.exe 2120 Updaater.exe 2120 Updaater.exe 2120 Updaater.exe 2120 Updaater.exe 2120 Updaater.exe 2120 Updaater.exe 2120 Updaater.exe 2120 Updaater.exe 2120 Updaater.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2120 Updaater.exe