Analysis
-
max time kernel
30s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
14-06-2023 18:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cc33d63b3e7263f4249519311a668867e0c178ca4dc909bedb57d2a505677f46.exe
Resource
win7-20230220-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
cc33d63b3e7263f4249519311a668867e0c178ca4dc909bedb57d2a505677f46.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
cc33d63b3e7263f4249519311a668867e0c178ca4dc909bedb57d2a505677f46.exe
-
Size
2.2MB
-
MD5
2b0b7ce72125b798fa36cf574598d9d5
-
SHA1
4e9bfe51ddd0941448e08719d6357f8ff529544c
-
SHA256
cc33d63b3e7263f4249519311a668867e0c178ca4dc909bedb57d2a505677f46
-
SHA512
6cbfc40a8ab469edd21778ae8ac3da5750225fd659dac37a573aa5de87d7ddb323ba4b8088cad9639d37c9a7ea884f5b5b46baba418229b0bb0b90e3072c1bef
-
SSDEEP
49152:t4RTPxgPQaKUJtoIVumtj7olqYNqcTzCLKjatJQ+zvTqYF+3:MCPQ6tNVumtj7olqUXzCLKjaPQ+zvTqS
Score
10/10
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload 2 IoCs
resource yara_rule behavioral1/memory/920-58-0x0000000010000000-0x0000000010020000-memory.dmp fatalrat behavioral1/memory/920-62-0x0000000000300000-0x000000000031E000-memory.dmp fatalrat -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 cc33d63b3e7263f4249519311a668867e0c178ca4dc909bedb57d2a505677f46.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz cc33d63b3e7263f4249519311a668867e0c178ca4dc909bedb57d2a505677f46.exe -
Suspicious behavior: EnumeratesProcesses 51 IoCs
pid Process 920 cc33d63b3e7263f4249519311a668867e0c178ca4dc909bedb57d2a505677f46.exe 920 cc33d63b3e7263f4249519311a668867e0c178ca4dc909bedb57d2a505677f46.exe 920 cc33d63b3e7263f4249519311a668867e0c178ca4dc909bedb57d2a505677f46.exe 920 cc33d63b3e7263f4249519311a668867e0c178ca4dc909bedb57d2a505677f46.exe 920 cc33d63b3e7263f4249519311a668867e0c178ca4dc909bedb57d2a505677f46.exe 920 cc33d63b3e7263f4249519311a668867e0c178ca4dc909bedb57d2a505677f46.exe 920 cc33d63b3e7263f4249519311a668867e0c178ca4dc909bedb57d2a505677f46.exe 920 cc33d63b3e7263f4249519311a668867e0c178ca4dc909bedb57d2a505677f46.exe 920 cc33d63b3e7263f4249519311a668867e0c178ca4dc909bedb57d2a505677f46.exe 920 cc33d63b3e7263f4249519311a668867e0c178ca4dc909bedb57d2a505677f46.exe 920 cc33d63b3e7263f4249519311a668867e0c178ca4dc909bedb57d2a505677f46.exe 920 cc33d63b3e7263f4249519311a668867e0c178ca4dc909bedb57d2a505677f46.exe 920 cc33d63b3e7263f4249519311a668867e0c178ca4dc909bedb57d2a505677f46.exe 920 cc33d63b3e7263f4249519311a668867e0c178ca4dc909bedb57d2a505677f46.exe 920 cc33d63b3e7263f4249519311a668867e0c178ca4dc909bedb57d2a505677f46.exe 920 cc33d63b3e7263f4249519311a668867e0c178ca4dc909bedb57d2a505677f46.exe 920 cc33d63b3e7263f4249519311a668867e0c178ca4dc909bedb57d2a505677f46.exe 920 cc33d63b3e7263f4249519311a668867e0c178ca4dc909bedb57d2a505677f46.exe 920 cc33d63b3e7263f4249519311a668867e0c178ca4dc909bedb57d2a505677f46.exe 920 cc33d63b3e7263f4249519311a668867e0c178ca4dc909bedb57d2a505677f46.exe 920 cc33d63b3e7263f4249519311a668867e0c178ca4dc909bedb57d2a505677f46.exe 920 cc33d63b3e7263f4249519311a668867e0c178ca4dc909bedb57d2a505677f46.exe 920 cc33d63b3e7263f4249519311a668867e0c178ca4dc909bedb57d2a505677f46.exe 920 cc33d63b3e7263f4249519311a668867e0c178ca4dc909bedb57d2a505677f46.exe 920 cc33d63b3e7263f4249519311a668867e0c178ca4dc909bedb57d2a505677f46.exe 920 cc33d63b3e7263f4249519311a668867e0c178ca4dc909bedb57d2a505677f46.exe 920 cc33d63b3e7263f4249519311a668867e0c178ca4dc909bedb57d2a505677f46.exe 920 cc33d63b3e7263f4249519311a668867e0c178ca4dc909bedb57d2a505677f46.exe 920 cc33d63b3e7263f4249519311a668867e0c178ca4dc909bedb57d2a505677f46.exe 920 cc33d63b3e7263f4249519311a668867e0c178ca4dc909bedb57d2a505677f46.exe 920 cc33d63b3e7263f4249519311a668867e0c178ca4dc909bedb57d2a505677f46.exe 920 cc33d63b3e7263f4249519311a668867e0c178ca4dc909bedb57d2a505677f46.exe 920 cc33d63b3e7263f4249519311a668867e0c178ca4dc909bedb57d2a505677f46.exe 920 cc33d63b3e7263f4249519311a668867e0c178ca4dc909bedb57d2a505677f46.exe 920 cc33d63b3e7263f4249519311a668867e0c178ca4dc909bedb57d2a505677f46.exe 920 cc33d63b3e7263f4249519311a668867e0c178ca4dc909bedb57d2a505677f46.exe 920 cc33d63b3e7263f4249519311a668867e0c178ca4dc909bedb57d2a505677f46.exe 920 cc33d63b3e7263f4249519311a668867e0c178ca4dc909bedb57d2a505677f46.exe 920 cc33d63b3e7263f4249519311a668867e0c178ca4dc909bedb57d2a505677f46.exe 920 cc33d63b3e7263f4249519311a668867e0c178ca4dc909bedb57d2a505677f46.exe 920 cc33d63b3e7263f4249519311a668867e0c178ca4dc909bedb57d2a505677f46.exe 920 cc33d63b3e7263f4249519311a668867e0c178ca4dc909bedb57d2a505677f46.exe 920 cc33d63b3e7263f4249519311a668867e0c178ca4dc909bedb57d2a505677f46.exe 920 cc33d63b3e7263f4249519311a668867e0c178ca4dc909bedb57d2a505677f46.exe 920 cc33d63b3e7263f4249519311a668867e0c178ca4dc909bedb57d2a505677f46.exe 920 cc33d63b3e7263f4249519311a668867e0c178ca4dc909bedb57d2a505677f46.exe 920 cc33d63b3e7263f4249519311a668867e0c178ca4dc909bedb57d2a505677f46.exe 920 cc33d63b3e7263f4249519311a668867e0c178ca4dc909bedb57d2a505677f46.exe 920 cc33d63b3e7263f4249519311a668867e0c178ca4dc909bedb57d2a505677f46.exe 920 cc33d63b3e7263f4249519311a668867e0c178ca4dc909bedb57d2a505677f46.exe 920 cc33d63b3e7263f4249519311a668867e0c178ca4dc909bedb57d2a505677f46.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 920 cc33d63b3e7263f4249519311a668867e0c178ca4dc909bedb57d2a505677f46.exe 920 cc33d63b3e7263f4249519311a668867e0c178ca4dc909bedb57d2a505677f46.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cc33d63b3e7263f4249519311a668867e0c178ca4dc909bedb57d2a505677f46.exe"C:\Users\Admin\AppData\Local\Temp\cc33d63b3e7263f4249519311a668867e0c178ca4dc909bedb57d2a505677f46.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:920