fatalrat | ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c

General

Target

ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe
Size

101KB
MD5

c24b15ddcf5f38b957e29cbb770513b6
SHA1

776d4d0ebaaa3ad42ca0bea26e55efe032d64922
SHA256

ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c
SHA512

7dc315b2981d7b9bb61967541119c76a6ffec913c20093a2a0f94dcb52d7b49f087afe406549254ab969ec451bfa66158ce38ce16b33076d8fe0aba3d447b6b8
SSDEEP

1536:gt1DlqVQsb7O+qgC23pG8XIXNe6Mv5io63RG8jpkcF6YPxMsJPxj:ggrO+qh2pXye6MBN63RpjpZFBxMExj

Score

10^/10

fatalrat infostealer rat

Malware Config

Signatures

FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
infostealer rat fatalrat

Fatal Rat payload 2 IoCs

rat infostealer

resource	yara_rule
behavioral1/memory/2684-72-0x0000000010000000-0x000000001002A000-memory.dmp	fatalrat
behavioral1/memory/2684-81-0x0000000000400000-0x00000000005A4000-memory.dmp	fatalrat

Blocklisted process makes network request 1 IoCs

flow	pid	Process
5	2684	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2936	Vwxyab.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\cmd.exe	cmd.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2244 set thread context of 2684	2244	ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe	31

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Vwxyab.exe	cmd.exe
File opened for modification	C:\Windows\Vwxyab.exe	cmd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2052	2244	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 51 IoCs

pid	Process
2684	cmd.exe
2684	cmd.exe
2684	cmd.exe
2684	cmd.exe
2684	cmd.exe
2684	cmd.exe
2684	cmd.exe
2684	cmd.exe
2684	cmd.exe
2684	cmd.exe
2684	cmd.exe
2684	cmd.exe
2684	cmd.exe
2684	cmd.exe
2684	cmd.exe
2684	cmd.exe
2684	cmd.exe
2684	cmd.exe
2684	cmd.exe
2684	cmd.exe
2684	cmd.exe
2684	cmd.exe
2684	cmd.exe
2684	cmd.exe
2684	cmd.exe
2684	cmd.exe
2684	cmd.exe
2684	cmd.exe
2684	cmd.exe
2684	cmd.exe
2684	cmd.exe
2684	cmd.exe
2684	cmd.exe
2684	cmd.exe
2684	cmd.exe
2684	cmd.exe
2684	cmd.exe
2684	cmd.exe
2684	cmd.exe
2684	cmd.exe
2684	cmd.exe
2684	cmd.exe
2684	cmd.exe
2684	cmd.exe
2684	cmd.exe
2684	cmd.exe
2684	cmd.exe
2684	cmd.exe
2684	cmd.exe
2684	cmd.exe
2684	cmd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2684	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2244	ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 2684	2244	ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe	31
PID 2244 wrote to memory of 2684	2244	ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe	31
PID 2244 wrote to memory of 2684	2244	ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe	31
PID 2244 wrote to memory of 2684	2244	ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe	31
PID 2244 wrote to memory of 2684	2244	ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe	31
PID 2244 wrote to memory of 2684	2244	ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe	31
PID 2244 wrote to memory of 2684	2244	ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe	31
PID 2244 wrote to memory of 2684	2244	ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe	31
PID 2244 wrote to memory of 2684	2244	ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe	31
PID 2244 wrote to memory of 2684	2244	ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe	31
PID 2244 wrote to memory of 2052	2244	ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe	32
PID 2244 wrote to memory of 2052	2244	ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe	32
PID 2244 wrote to memory of 2052	2244	ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe	32
PID 2244 wrote to memory of 2052	2244	ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe	32

C:\Users\Admin\AppData\Local\Temp\ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe
"C:\Users\Admin\AppData\Local\Temp\ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  - Blocklisted process makes network request
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2684
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2244 -s 808
  2⤵
  - Program crash
  PID:2052

C:\Windows\Vwxyab.exe
C:\Windows\Vwxyab.exe
1⤵
- Executes dropped EXE
PID:2936

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Vwxyab.exe

Filesize
295KB

MD5
ad7b9c14083b52bc532fba5948342b98

SHA1
ee8cbf12d87c4d388f09b4f69bed2e91682920b5

SHA256
17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae

SHA512
e12aad20c824187b39edb3c7943709290b5ddbf1b4032988db46f2e86da3cf7e7783f78c82e4dc5da232f666b8f9799a260a1f8e2694eb4d0cdaf78da710fde1

Download Submit
memory/2244-57-0x0000000003470000-0x0000000003614000-memory.dmp

Filesize
1.6MB

Download
memory/2244-80-0x0000000003470000-0x0000000003614000-memory.dmp

Filesize
1.6MB

Download
memory/2684-66-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2684-60-0x0000000000400000-0x00000000005A4000-memory.dmp

Filesize
1.6MB

Download
memory/2684-64-0x0000000000400000-0x00000000005A4000-memory.dmp

Filesize
1.6MB

Download
memory/2684-62-0x0000000000400000-0x00000000005A4000-memory.dmp

Filesize
1.6MB

Download
memory/2684-68-0x0000000000400000-0x00000000005A4000-memory.dmp

Filesize
1.6MB

Download
memory/2684-70-0x0000000000400000-0x00000000005A4000-memory.dmp

Filesize
1.6MB

Download
memory/2684-71-0x0000000000400000-0x00000000005A4000-memory.dmp

Filesize
1.6MB

Download
memory/2684-72-0x0000000010000000-0x000000001002A000-memory.dmp

Filesize
168KB

Download
memory/2684-59-0x0000000000400000-0x00000000005A4000-memory.dmp

Filesize
1.6MB

Download
memory/2684-58-0x0000000000400000-0x00000000005A4000-memory.dmp

Filesize
1.6MB

Download
memory/2684-81-0x0000000000400000-0x00000000005A4000-memory.dmp

Filesize
1.6MB

Download

Analysis

Sharing