Analysis
-
max time kernel
594s -
max time network
589s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
25-03-2023 05:59
Static task
static1
Behavioral task
behavioral1
Sample
1.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1.exe
Resource
win10v2004-20230220-en
General
-
Target
1.exe
-
Size
4.5MB
-
MD5
e13305b34dca2550e9cf16d102b9fd69
-
SHA1
f79684a15bec40a154585caa83c7a030043ea570
-
SHA256
ba3c0e098d9f3007c8ac221344fcc2c2499eeb4e954392a853290b532dc75f81
-
SHA512
7bec907099012a4561e0ccd61b38caf4e68953b5d453948a1d9548e19029051ac5489a92a3915e520fd14e6bb5764e378aae3026d35f4ae14ba183f17d1ceade
-
SSDEEP
98304:8ms2Ppr55vJvBh/xpnNQAfbU9I285Uf4yfJrDjdn+B8by:HsMprp7xhNQAfbU9I2AUf4aDjJ+b
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/832-57-0x0000000010000000-0x000000001002A000-memory.dmp fatalrat behavioral1/memory/2012-78-0x0000000010000000-0x000000001002A000-memory.dmp fatalrat -
Executes dropped EXE 1 IoCs
Processes:
1.exepid process 2012 1.exe -
Loads dropped DLL 1 IoCs
Processes:
1.exepid process 832 1.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 41 IoCs
Processes:
1.exe1.exepid process 832 1.exe 832 1.exe 832 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe -
Drops file in Program Files directory 3 IoCs
Processes:
1.exe1.exedescription ioc process File created C:\Program Files\MSXML 6.18\Lospensdkm.exe 1.exe File opened for modification C:\Program Files\MSXML 6.18\Lospensdkm.exe 1.exe File opened for modification C:\Program Files\MSXML 6.18\Lospensdkm.exe 1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
1.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 1.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz 1.exe -
Suspicious behavior: EnumeratesProcesses 53 IoCs
Processes:
1.exe1.exepid process 832 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe 2012 1.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
1.exe1.exedescription pid process Token: SeDebugPrivilege 832 1.exe Token: SeDebugPrivilege 2012 1.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
1.exe1.exepid process 832 1.exe 832 1.exe 2012 1.exe 2012 1.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
1.exedescription pid process target process PID 832 wrote to memory of 2012 832 1.exe 1.exe PID 832 wrote to memory of 2012 832 1.exe 1.exe PID 832 wrote to memory of 2012 832 1.exe 1.exe PID 832 wrote to memory of 2012 832 1.exe 1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\1.exe"C:\Users\Admin\AppData\Local\1.exe"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\MSXML 6.18\Lospensdkm.exeFilesize
4.5MB
MD5e13305b34dca2550e9cf16d102b9fd69
SHA1f79684a15bec40a154585caa83c7a030043ea570
SHA256ba3c0e098d9f3007c8ac221344fcc2c2499eeb4e954392a853290b532dc75f81
SHA5127bec907099012a4561e0ccd61b38caf4e68953b5d453948a1d9548e19029051ac5489a92a3915e520fd14e6bb5764e378aae3026d35f4ae14ba183f17d1ceade
-
C:\Users\Admin\AppData\Local\1.exeFilesize
4.5MB
MD5e13305b34dca2550e9cf16d102b9fd69
SHA1f79684a15bec40a154585caa83c7a030043ea570
SHA256ba3c0e098d9f3007c8ac221344fcc2c2499eeb4e954392a853290b532dc75f81
SHA5127bec907099012a4561e0ccd61b38caf4e68953b5d453948a1d9548e19029051ac5489a92a3915e520fd14e6bb5764e378aae3026d35f4ae14ba183f17d1ceade
-
C:\Users\Admin\AppData\Local\1.exeFilesize
4.5MB
MD5e13305b34dca2550e9cf16d102b9fd69
SHA1f79684a15bec40a154585caa83c7a030043ea570
SHA256ba3c0e098d9f3007c8ac221344fcc2c2499eeb4e954392a853290b532dc75f81
SHA5127bec907099012a4561e0ccd61b38caf4e68953b5d453948a1d9548e19029051ac5489a92a3915e520fd14e6bb5764e378aae3026d35f4ae14ba183f17d1ceade
-
\??\c:\users\admin\appdata\local\1.exeFilesize
4.5MB
MD5e13305b34dca2550e9cf16d102b9fd69
SHA1f79684a15bec40a154585caa83c7a030043ea570
SHA256ba3c0e098d9f3007c8ac221344fcc2c2499eeb4e954392a853290b532dc75f81
SHA5127bec907099012a4561e0ccd61b38caf4e68953b5d453948a1d9548e19029051ac5489a92a3915e520fd14e6bb5764e378aae3026d35f4ae14ba183f17d1ceade
-
\Users\Admin\AppData\Local\1.exeFilesize
4.5MB
MD5e13305b34dca2550e9cf16d102b9fd69
SHA1f79684a15bec40a154585caa83c7a030043ea570
SHA256ba3c0e098d9f3007c8ac221344fcc2c2499eeb4e954392a853290b532dc75f81
SHA5127bec907099012a4561e0ccd61b38caf4e68953b5d453948a1d9548e19029051ac5489a92a3915e520fd14e6bb5764e378aae3026d35f4ae14ba183f17d1ceade
-
memory/832-55-0x0000000000400000-0x00000000018B1000-memory.dmpFilesize
20.7MB
-
memory/832-56-0x000000007EBD0000-0x000000007EFA1000-memory.dmpFilesize
3.8MB
-
memory/832-57-0x0000000010000000-0x000000001002A000-memory.dmpFilesize
168KB
-
memory/832-62-0x0000000000400000-0x00000000018B1000-memory.dmpFilesize
20.7MB
-
memory/832-63-0x0000000000400000-0x00000000018B1000-memory.dmpFilesize
20.7MB
-
memory/832-71-0x0000000000400000-0x00000000018B1000-memory.dmpFilesize
20.7MB
-
memory/2012-105-0x0000000000400000-0x00000000018B1000-memory.dmpFilesize
20.7MB
-
memory/2012-111-0x0000000000400000-0x00000000018B1000-memory.dmpFilesize
20.7MB
-
memory/2012-78-0x0000000010000000-0x000000001002A000-memory.dmpFilesize
168KB
-
memory/2012-83-0x0000000000400000-0x00000000018B1000-memory.dmpFilesize
20.7MB
-
memory/2012-84-0x000000007EBD0000-0x000000007EFA1000-memory.dmpFilesize
3.8MB
-
memory/2012-85-0x0000000000400000-0x00000000018B1000-memory.dmpFilesize
20.7MB
-
memory/2012-86-0x0000000000400000-0x00000000018B1000-memory.dmpFilesize
20.7MB
-
memory/2012-87-0x0000000000400000-0x00000000018B1000-memory.dmpFilesize
20.7MB
-
memory/2012-88-0x0000000000400000-0x00000000018B1000-memory.dmpFilesize
20.7MB
-
memory/2012-89-0x0000000000400000-0x00000000018B1000-memory.dmpFilesize
20.7MB
-
memory/2012-90-0x0000000000400000-0x00000000018B1000-memory.dmpFilesize
20.7MB
-
memory/2012-91-0x0000000000400000-0x00000000018B1000-memory.dmpFilesize
20.7MB
-
memory/2012-92-0x0000000000400000-0x00000000018B1000-memory.dmpFilesize
20.7MB
-
memory/2012-93-0x0000000000400000-0x00000000018B1000-memory.dmpFilesize
20.7MB
-
memory/2012-94-0x0000000000400000-0x00000000018B1000-memory.dmpFilesize
20.7MB
-
memory/2012-95-0x0000000000400000-0x00000000018B1000-memory.dmpFilesize
20.7MB
-
memory/2012-96-0x0000000000400000-0x00000000018B1000-memory.dmpFilesize
20.7MB
-
memory/2012-97-0x0000000000400000-0x00000000018B1000-memory.dmpFilesize
20.7MB
-
memory/2012-98-0x0000000000400000-0x00000000018B1000-memory.dmpFilesize
20.7MB
-
memory/2012-99-0x0000000000400000-0x00000000018B1000-memory.dmpFilesize
20.7MB
-
memory/2012-100-0x0000000000400000-0x00000000018B1000-memory.dmpFilesize
20.7MB
-
memory/2012-101-0x0000000000400000-0x00000000018B1000-memory.dmpFilesize
20.7MB
-
memory/2012-102-0x0000000000400000-0x00000000018B1000-memory.dmpFilesize
20.7MB
-
memory/2012-103-0x0000000000400000-0x00000000018B1000-memory.dmpFilesize
20.7MB
-
memory/2012-104-0x0000000000400000-0x00000000018B1000-memory.dmpFilesize
20.7MB
-
memory/2012-74-0x000000007EBD0000-0x000000007EFA1000-memory.dmpFilesize
3.8MB
-
memory/2012-106-0x0000000000400000-0x00000000018B1000-memory.dmpFilesize
20.7MB
-
memory/2012-107-0x0000000000400000-0x00000000018B1000-memory.dmpFilesize
20.7MB
-
memory/2012-108-0x0000000000400000-0x00000000018B1000-memory.dmpFilesize
20.7MB
-
memory/2012-109-0x0000000000400000-0x00000000018B1000-memory.dmpFilesize
20.7MB
-
memory/2012-110-0x0000000000400000-0x00000000018B1000-memory.dmpFilesize
20.7MB
-
memory/2012-75-0x0000000000400000-0x00000000018B1000-memory.dmpFilesize
20.7MB
-
memory/2012-112-0x0000000000400000-0x00000000018B1000-memory.dmpFilesize
20.7MB
-
memory/2012-113-0x0000000000400000-0x00000000018B1000-memory.dmpFilesize
20.7MB
-
memory/2012-114-0x0000000000400000-0x00000000018B1000-memory.dmpFilesize
20.7MB
-
memory/2012-115-0x0000000000400000-0x00000000018B1000-memory.dmpFilesize
20.7MB
-
memory/2012-116-0x0000000000400000-0x00000000018B1000-memory.dmpFilesize
20.7MB
-
memory/2012-117-0x0000000000400000-0x00000000018B1000-memory.dmpFilesize
20.7MB
-
memory/2012-118-0x0000000000400000-0x00000000018B1000-memory.dmpFilesize
20.7MB
-
memory/2012-119-0x0000000000400000-0x00000000018B1000-memory.dmpFilesize
20.7MB
-
memory/2012-120-0x0000000000400000-0x00000000018B1000-memory.dmpFilesize
20.7MB
-
memory/2012-121-0x0000000000400000-0x00000000018B1000-memory.dmpFilesize
20.7MB
-
memory/2012-122-0x0000000000400000-0x00000000018B1000-memory.dmpFilesize
20.7MB
-
memory/2012-123-0x0000000000400000-0x00000000018B1000-memory.dmpFilesize
20.7MB
-
memory/2012-124-0x0000000000400000-0x00000000018B1000-memory.dmpFilesize
20.7MB
-
memory/2012-125-0x0000000000400000-0x00000000018B1000-memory.dmpFilesize
20.7MB
-
memory/2012-126-0x0000000000400000-0x00000000018B1000-memory.dmpFilesize
20.7MB
-
memory/2012-127-0x0000000000400000-0x00000000018B1000-memory.dmpFilesize
20.7MB
-
memory/2012-128-0x0000000000400000-0x00000000018B1000-memory.dmpFilesize
20.7MB
-
memory/2012-129-0x0000000000400000-0x00000000018B1000-memory.dmpFilesize
20.7MB
-
memory/2012-130-0x0000000000400000-0x00000000018B1000-memory.dmpFilesize
20.7MB
-
memory/2012-131-0x0000000000400000-0x00000000018B1000-memory.dmpFilesize
20.7MB
-
memory/2012-132-0x0000000000400000-0x00000000018B1000-memory.dmpFilesize
20.7MB
-
memory/2012-133-0x0000000000400000-0x00000000018B1000-memory.dmpFilesize
20.7MB
-
memory/2012-134-0x0000000000400000-0x00000000018B1000-memory.dmpFilesize
20.7MB
-
memory/2012-135-0x0000000000400000-0x00000000018B1000-memory.dmpFilesize
20.7MB
-
memory/2012-136-0x0000000000400000-0x00000000018B1000-memory.dmpFilesize
20.7MB
-
memory/2012-137-0x0000000000400000-0x00000000018B1000-memory.dmpFilesize
20.7MB
-
memory/2012-138-0x0000000000400000-0x00000000018B1000-memory.dmpFilesize
20.7MB
-
memory/2012-139-0x0000000000400000-0x00000000018B1000-memory.dmpFilesize
20.7MB
-
memory/2012-140-0x0000000000400000-0x00000000018B1000-memory.dmpFilesize
20.7MB