Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
138s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
09/06/2023, 14:03
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20230220-en
General
-
Target
tmp.exe
-
Size
8.8MB
-
MD5
9068a3d8251716410e5baa7c95db8755
-
SHA1
d92d985a74a27591718ea4fe50eee965823b0ea1
-
SHA256
64b2695097ec03c0c7538389dc46641e0db93cf91f8cc6055dcc8d76637e28e5
-
SHA512
5d56f33340b2ee7bbb39be857d5d4c51e1e0baa460c3941406ec67b473e7556d81fd79ea0730db8abe267a74361a74c84945a8ff6ab891bab20084144167dc80
-
SSDEEP
196608:rZt3tP7+if+Bvcm2JCQ5+PiTwq+iB/3ZvTXjcLcB2AS9YeBtOIcIvNTB:hlf+vloZA23ZvTog2FpyI
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Gh0st RAT payload 2 IoCs
resource yara_rule behavioral2/memory/4564-145-0x0000000005250000-0x000000000539D000-memory.dmp family_gh0strat behavioral2/memory/4564-146-0x0000000005250000-0x000000000539D000-memory.dmp family_gh0strat -
Fatal Rat payload 2 IoCs
resource yara_rule behavioral2/memory/4564-137-0x0000000010000000-0x0000000010020000-memory.dmp fatalrat behavioral2/memory/4564-141-0x0000000004D90000-0x0000000004DAE000-memory.dmp fatalrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation tmp.exe -
resource yara_rule behavioral2/memory/4564-142-0x0000000005250000-0x000000000539D000-memory.dmp upx behavioral2/memory/4564-145-0x0000000005250000-0x000000000539D000-memory.dmp upx behavioral2/memory/4564-146-0x0000000005250000-0x000000000539D000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 tmp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz tmp.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4564 tmp.exe 4564 tmp.exe 4564 tmp.exe 4564 tmp.exe 4564 tmp.exe 4564 tmp.exe 4564 tmp.exe 4564 tmp.exe 4564 tmp.exe 4564 tmp.exe 4564 tmp.exe 4564 tmp.exe 4564 tmp.exe 4564 tmp.exe 4564 tmp.exe 4564 tmp.exe 4564 tmp.exe 4564 tmp.exe 4564 tmp.exe 4564 tmp.exe 4564 tmp.exe 4564 tmp.exe 4564 tmp.exe 4564 tmp.exe 4564 tmp.exe 4564 tmp.exe 4564 tmp.exe 4564 tmp.exe 4564 tmp.exe 4564 tmp.exe 4564 tmp.exe 4564 tmp.exe 4564 tmp.exe 4564 tmp.exe 4564 tmp.exe 4564 tmp.exe 4564 tmp.exe 4564 tmp.exe 4564 tmp.exe 4564 tmp.exe 4564 tmp.exe 4564 tmp.exe 4564 tmp.exe 4564 tmp.exe 4564 tmp.exe 4564 tmp.exe 4564 tmp.exe 4564 tmp.exe 4564 tmp.exe 4564 tmp.exe 4564 tmp.exe 4564 tmp.exe 4564 tmp.exe 4564 tmp.exe 4564 tmp.exe 4564 tmp.exe 4564 tmp.exe 4564 tmp.exe 4564 tmp.exe 4564 tmp.exe 4564 tmp.exe 4564 tmp.exe 4564 tmp.exe 4564 tmp.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 4564 tmp.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4564 tmp.exe 4564 tmp.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4564 wrote to memory of 1768 4564 tmp.exe 84 PID 4564 wrote to memory of 1768 4564 tmp.exe 84 PID 4564 wrote to memory of 1768 4564 tmp.exe 84 PID 4564 wrote to memory of 1072 4564 tmp.exe 91 PID 4564 wrote to memory of 1072 4564 tmp.exe 91 PID 4564 wrote to memory of 1072 4564 tmp.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Checks computer location settings
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\tmp.exeC:\Users\Admin\AppData\Local\Temp\tmp.exe2⤵PID:1768
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c del /q C:\Users\Admin\AppData\Local\Temp\tmp.exe2⤵PID:1072
-