Analysis
-
max time kernel
140s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
15-05-2023 02:38
General
-
Target
368ef81f1e2fb7b031f05151a66bdcc17aa4953ad9ed706dcb203ebb2f3735db.exe
-
Size
3.9MB
-
MD5
d62edf919a26a936e142b18a1a1b9474
-
SHA1
375dc8ca18af2ccdefae012b3cca79f122a625e9
-
SHA256
368ef81f1e2fb7b031f05151a66bdcc17aa4953ad9ed706dcb203ebb2f3735db
-
SHA512
ece23038984e7e138c3a7924c38e1f73db2ff2018acc8378a88452ec7c511b9613eadd265af28c9aa18b0fdf712e592c7eb1603c1bf7745e158b9357957e92e6
-
SSDEEP
98304:9iEFSokDB4zhAnVL3urhAZOewzkTvQGbGGZNNwySSV4J:xMoU0A9qhAczkT7bd7NwySQ4J
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload 3 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
VMProtect packed file 11 IoCs
Detects executables packed with VMProtect commercial packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\368ef81f1e2fb7b031f05151a66bdcc17aa4953ad9ed706dcb203ebb2f3735db.exe"C:\Users\Admin\AppData\Local\Temp\368ef81f1e2fb7b031f05151a66bdcc17aa4953ad9ed706dcb203ebb2f3735db.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\368ef81f1e2fb7b031f05151a66bdcc17aa4953ad9ed706dcb203ebb2f3735db.exe"C:\Users\Admin\AppData\Local\368ef81f1e2fb7b031f05151a66bdcc17aa4953ad9ed706dcb203ebb2f3735db.exe"2⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.9MB
MD5d62edf919a26a936e142b18a1a1b9474
SHA1375dc8ca18af2ccdefae012b3cca79f122a625e9
SHA256368ef81f1e2fb7b031f05151a66bdcc17aa4953ad9ed706dcb203ebb2f3735db
SHA512ece23038984e7e138c3a7924c38e1f73db2ff2018acc8378a88452ec7c511b9613eadd265af28c9aa18b0fdf712e592c7eb1603c1bf7745e158b9357957e92e6
-
Filesize
3.9MB
MD5d62edf919a26a936e142b18a1a1b9474
SHA1375dc8ca18af2ccdefae012b3cca79f122a625e9
SHA256368ef81f1e2fb7b031f05151a66bdcc17aa4953ad9ed706dcb203ebb2f3735db
SHA512ece23038984e7e138c3a7924c38e1f73db2ff2018acc8378a88452ec7c511b9613eadd265af28c9aa18b0fdf712e592c7eb1603c1bf7745e158b9357957e92e6
-
Filesize
3.9MB
MD5d62edf919a26a936e142b18a1a1b9474
SHA1375dc8ca18af2ccdefae012b3cca79f122a625e9
SHA256368ef81f1e2fb7b031f05151a66bdcc17aa4953ad9ed706dcb203ebb2f3735db
SHA512ece23038984e7e138c3a7924c38e1f73db2ff2018acc8378a88452ec7c511b9613eadd265af28c9aa18b0fdf712e592c7eb1603c1bf7745e158b9357957e92e6
-
Filesize
9.3MB
-
Filesize
9.3MB
-
Filesize
9.3MB
-
Filesize
9.3MB
-
Filesize
9.3MB
-
Filesize
9.3MB
-
Filesize
9.3MB
-
Filesize
168KB
-
Filesize
9.3MB