Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
15/05/2023, 06:35
Static task
static1
Behavioral task
behavioral1
Sample
4d47519be2d16e63207ce56bd0500706b49150ec068bcc35f6e439aa99a60d68.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
4d47519be2d16e63207ce56bd0500706b49150ec068bcc35f6e439aa99a60d68.exe
Resource
win10v2004-20230220-en
General
-
Target
4d47519be2d16e63207ce56bd0500706b49150ec068bcc35f6e439aa99a60d68.exe
-
Size
140KB
-
MD5
6a0194e75f93836b7bb1bf35b3f97bec
-
SHA1
a5e9084913409fc26723b0fc6f85163831a5ec3d
-
SHA256
4d47519be2d16e63207ce56bd0500706b49150ec068bcc35f6e439aa99a60d68
-
SHA512
fad213549b0cf045c475a0f101922b0d87ba9615141cef19168b135f3afa50725e88b77c629ba55f78a79033e79fc73db7971d7c05097bd0fd147b5d7a8d0641
-
SSDEEP
1536:Vua+BTv3tIO8MtM+/6jRVGIk1MgHjsPGYYwOda2CqqZOIgQJb0lfjtO+vbWL8xJb:Vn+htWMtf+7GZYGVA2QJgi8xJLDoU
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload 1 IoCs
resource yara_rule behavioral2/memory/1260-133-0x0000000010000000-0x000000001001C000-memory.dmp fatalrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation 4d47519be2d16e63207ce56bd0500706b49150ec068bcc35f6e439aa99a60d68.exe -
Executes dropped EXE 1 IoCs
pid Process 1768 4d47519be2d16e63207ce56bd0500706b49150ec068bcc35f6e439aa99a60d68.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Windows\CurrentVersion\Run 4d47519be2d16e63207ce56bd0500706b49150ec068bcc35f6e439aa99a60d68.exe Set value (str) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SVP7 = "C:\\Users\\Admin\\AppData\\Local\\4d47519be2d16e63207ce56bd0500706b49150ec068bcc35f6e439aa99a60d68.exe" 4d47519be2d16e63207ce56bd0500706b49150ec068bcc35f6e439aa99a60d68.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1260 4d47519be2d16e63207ce56bd0500706b49150ec068bcc35f6e439aa99a60d68.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1260 4d47519be2d16e63207ce56bd0500706b49150ec068bcc35f6e439aa99a60d68.exe Token: SeDebugPrivilege 1768 4d47519be2d16e63207ce56bd0500706b49150ec068bcc35f6e439aa99a60d68.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1260 wrote to memory of 1768 1260 4d47519be2d16e63207ce56bd0500706b49150ec068bcc35f6e439aa99a60d68.exe 85 PID 1260 wrote to memory of 1768 1260 4d47519be2d16e63207ce56bd0500706b49150ec068bcc35f6e439aa99a60d68.exe 85 PID 1260 wrote to memory of 1768 1260 4d47519be2d16e63207ce56bd0500706b49150ec068bcc35f6e439aa99a60d68.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\4d47519be2d16e63207ce56bd0500706b49150ec068bcc35f6e439aa99a60d68.exe"C:\Users\Admin\AppData\Local\Temp\4d47519be2d16e63207ce56bd0500706b49150ec068bcc35f6e439aa99a60d68.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Users\Admin\AppData\Local\4d47519be2d16e63207ce56bd0500706b49150ec068bcc35f6e439aa99a60d68.exe"C:\Users\Admin\AppData\Local\4d47519be2d16e63207ce56bd0500706b49150ec068bcc35f6e439aa99a60d68.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1768
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
140KB
MD56a0194e75f93836b7bb1bf35b3f97bec
SHA1a5e9084913409fc26723b0fc6f85163831a5ec3d
SHA2564d47519be2d16e63207ce56bd0500706b49150ec068bcc35f6e439aa99a60d68
SHA512fad213549b0cf045c475a0f101922b0d87ba9615141cef19168b135f3afa50725e88b77c629ba55f78a79033e79fc73db7971d7c05097bd0fd147b5d7a8d0641
-
Filesize
140KB
MD56a0194e75f93836b7bb1bf35b3f97bec
SHA1a5e9084913409fc26723b0fc6f85163831a5ec3d
SHA2564d47519be2d16e63207ce56bd0500706b49150ec068bcc35f6e439aa99a60d68
SHA512fad213549b0cf045c475a0f101922b0d87ba9615141cef19168b135f3afa50725e88b77c629ba55f78a79033e79fc73db7971d7c05097bd0fd147b5d7a8d0641
-
Filesize
140KB
MD56a0194e75f93836b7bb1bf35b3f97bec
SHA1a5e9084913409fc26723b0fc6f85163831a5ec3d
SHA2564d47519be2d16e63207ce56bd0500706b49150ec068bcc35f6e439aa99a60d68
SHA512fad213549b0cf045c475a0f101922b0d87ba9615141cef19168b135f3afa50725e88b77c629ba55f78a79033e79fc73db7971d7c05097bd0fd147b5d7a8d0641