Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
03/08/2023, 09:16
Static task
static1
Behavioral task
behavioral1
Sample
ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe
Resource
win7-20230712-en
windows7-x64
Behavioral task
behavioral2
Sample
ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
General
-
Target
ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe
-
Size
101KB
-
MD5
c24b15ddcf5f38b957e29cbb770513b6
-
SHA1
776d4d0ebaaa3ad42ca0bea26e55efe032d64922
-
SHA256
ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c
-
SHA512
7dc315b2981d7b9bb61967541119c76a6ffec913c20093a2a0f94dcb52d7b49f087afe406549254ab969ec451bfa66158ce38ce16b33076d8fe0aba3d447b6b8
-
SSDEEP
1536:gt1DlqVQsb7O+qgC23pG8XIXNe6Mv5io63RG8jpkcF6YPxMsJPxj:ggrO+qh2pXye6MBN63RpjpZFBxMExj
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload 2 IoCs
resource yara_rule behavioral2/memory/1792-142-0x0000000010000000-0x000000001002A000-memory.dmp fatalrat behavioral2/memory/1792-151-0x0000000000400000-0x00000000005A4000-memory.dmp fatalrat -
Blocklisted process makes network request 1 IoCs
flow pid Process 40 1792 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 3372 Vwxyab.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\cmd.exe cmd.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3196 set thread context of 1792 3196 ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe 97 -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Vwxyab.exe cmd.exe File opened for modification C:\Windows\Vwxyab.exe cmd.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 3204 3196 WerFault.exe 82 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe 1792 cmd.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1792 cmd.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3196 ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3196 wrote to memory of 1792 3196 ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe 97 PID 3196 wrote to memory of 1792 3196 ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe 97 PID 3196 wrote to memory of 1792 3196 ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe 97 PID 3196 wrote to memory of 1792 3196 ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe 97 PID 3196 wrote to memory of 1792 3196 ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe 97 PID 3196 wrote to memory of 1792 3196 ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe 97 PID 3196 wrote to memory of 1792 3196 ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe 97 PID 3196 wrote to memory of 1792 3196 ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe 97 PID 3196 wrote to memory of 1792 3196 ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe"C:\Users\Admin\AppData\Local\Temp\ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"2⤵
- Blocklisted process makes network request
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1792
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 12962⤵
- Program crash
PID:3204
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 3196 -ip 31961⤵PID:2852
-
C:\Windows\Vwxyab.exeC:\Windows\Vwxyab.exe1⤵
- Executes dropped EXE
PID:3372
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
231KB
MD5d0fce3afa6aa1d58ce9fa336cc2b675b
SHA14048488de6ba4bfef9edf103755519f1f762668f
SHA2564d89fc34d5f0f9babd022271c585a9477bf41e834e46b991deaa0530fdb25e22
SHA51280e127ef81752cd50f9ea2d662dc4d3bf8db8d29680e75fa5fc406ca22cafa5c4d89ef2eac65b486413d3cdd57a2c12a1cb75f65d1e312a717d262265736d1c2