Analysis
-
max time kernel
123s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
02-03-2023 08:47
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20230220-en
windows7-x64
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
General
-
Target
tmp.exe
-
Size
176KB
-
MD5
4e905829943b0a05ce886abbf98a0e76
-
SHA1
8d7242ab82611636172b81f2002afb308b56bb9e
-
SHA256
109cab9ee671fe549867a339d90758f3e032eba3f45abd98493a3096eef6721f
-
SHA512
7d2422d7f17639af697bd4e08859733b2eba34fcd6f5e6925769623ed093411d341c11ad6d748e2ac5820354bd84a57672c0cbe360fcc4593d35e56933e0b58f
-
SSDEEP
3072:1Qv5Ko2zTp5j7Uj48xtVxePiaI3A6+GP8vzndiRF/rp/6pHtg+fJj33InpPS:1Qv5KLpR8489EPtU7ezdsr2VN
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload 2 IoCs
resource yara_rule behavioral2/memory/4172-133-0x0000000004D90000-0x0000000004DDE000-memory.dmp fatalrat behavioral2/memory/4172-134-0x0000000002F90000-0x0000000002FB8000-memory.dmp fatalrat -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 tmp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz tmp.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4172 tmp.exe 4172 tmp.exe 4172 tmp.exe 4172 tmp.exe 4172 tmp.exe 4172 tmp.exe 4172 tmp.exe 4172 tmp.exe 4172 tmp.exe 4172 tmp.exe 4172 tmp.exe 4172 tmp.exe 4172 tmp.exe 4172 tmp.exe 4172 tmp.exe 4172 tmp.exe 4172 tmp.exe 4172 tmp.exe 4172 tmp.exe 4172 tmp.exe 4172 tmp.exe 4172 tmp.exe 4172 tmp.exe 4172 tmp.exe 4172 tmp.exe 4172 tmp.exe 4172 tmp.exe 4172 tmp.exe 4172 tmp.exe 4172 tmp.exe 4172 tmp.exe 4172 tmp.exe 4172 tmp.exe 4172 tmp.exe 4172 tmp.exe 4172 tmp.exe 4172 tmp.exe 4172 tmp.exe 4172 tmp.exe 4172 tmp.exe 4172 tmp.exe 4172 tmp.exe 4172 tmp.exe 4172 tmp.exe 4172 tmp.exe 4172 tmp.exe 4172 tmp.exe 4172 tmp.exe 4172 tmp.exe 4172 tmp.exe 4172 tmp.exe 4172 tmp.exe 4172 tmp.exe 4172 tmp.exe 4172 tmp.exe 4172 tmp.exe 4172 tmp.exe 4172 tmp.exe 4172 tmp.exe 4172 tmp.exe 4172 tmp.exe 4172 tmp.exe 4172 tmp.exe 4172 tmp.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4172 tmp.exe