Analysis
-
max time kernel
134s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
-
submitted
10-08-2023 14:52
General
-
Target
Rat/2345Capture.exe
-
Size
236KB
-
MD5
bebcd675fed7940179932dd5aa63b61c
-
SHA1
bace66cdc1a67a7b32bd7fdd882f2781b9dac672
-
SHA256
c04e31d99459edf3a093e49d163f2f650ba789a1b3c6c7c98f26af14909615b2
-
SHA512
d50ece5d75d0aefe741c35874817972a73bc642d33a5a4074a07ab57bbcbaf76a0c3d2e42be2ae0f3ddf59957197019619bf61746818473eb26f22757d8a434d
-
SSDEEP
6144:pGgyduw1wqkQ5Qc3yHnFjBq0EAkYIkRHXkYIkRH:p4jZkQCieFpzxHXxH
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload 2 IoCs
-
Downloads MZ/PE file
-
ASPack v2.12-2.42 3 IoCs
Detects executables packed with ASPack v2.12-2.42
-
Executes dropped EXE 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Rat\2345Capture.exe"C:\Users\Admin\AppData\Local\Temp\Rat\2345Capture.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\Documents\Admin558\Adam.exeC:\Users\Public\Documents\Admin558\Adam.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Public\Documents\Admin558\Taskmg.exeC:\Users\Public\Documents\Admin558\Taskmg.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Taskmg.exe"C:\Users\Admin\AppData\Local\Taskmg.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.0MB
MD5a341b3a7990a811f0666bc0bedefb1dd
SHA1647b053c5308b18b9202c6133b9c85c72b611760
SHA256e09a30a80a3dfc9ec7357358a61227815ef7cc3ae2bd07f7587cec0dc52d8ab1
SHA5129860c5bc63097c3cbfd52eb26528750eb7925488218781c55cb4244fe4a426c5c05c193b16a5ac2624dd708cfe2265d84ef864e47a3fa1c9682139b5e011da73
-
Filesize
2.0MB
MD5a341b3a7990a811f0666bc0bedefb1dd
SHA1647b053c5308b18b9202c6133b9c85c72b611760
SHA256e09a30a80a3dfc9ec7357358a61227815ef7cc3ae2bd07f7587cec0dc52d8ab1
SHA5129860c5bc63097c3cbfd52eb26528750eb7925488218781c55cb4244fe4a426c5c05c193b16a5ac2624dd708cfe2265d84ef864e47a3fa1c9682139b5e011da73
-
Filesize
2.0MB
MD5a341b3a7990a811f0666bc0bedefb1dd
SHA1647b053c5308b18b9202c6133b9c85c72b611760
SHA256e09a30a80a3dfc9ec7357358a61227815ef7cc3ae2bd07f7587cec0dc52d8ab1
SHA5129860c5bc63097c3cbfd52eb26528750eb7925488218781c55cb4244fe4a426c5c05c193b16a5ac2624dd708cfe2265d84ef864e47a3fa1c9682139b5e011da73
-
Filesize
48KB
MD52cca2c467cfafb31500b0f5fae518372
SHA1823a897d3ac313c2c28d9e7276ef8beb0f6ad8d1
SHA2568071edb914b488e5e693b750f99e25eaaf74d6e587fce4eb5ddcd36ade9a07f2
SHA512d66f97dd68b15795eccace13e92eebd3d1330637c052e0a0c9e2ef87b5ddc62d4676de74ec9b56aa8084406502a6ab5d547ce6a727427e5f15e53b8e272d7592
-
Filesize
48KB
MD52cca2c467cfafb31500b0f5fae518372
SHA1823a897d3ac313c2c28d9e7276ef8beb0f6ad8d1
SHA2568071edb914b488e5e693b750f99e25eaaf74d6e587fce4eb5ddcd36ade9a07f2
SHA512d66f97dd68b15795eccace13e92eebd3d1330637c052e0a0c9e2ef87b5ddc62d4676de74ec9b56aa8084406502a6ab5d547ce6a727427e5f15e53b8e272d7592
-
Filesize
48KB
MD52cca2c467cfafb31500b0f5fae518372
SHA1823a897d3ac313c2c28d9e7276ef8beb0f6ad8d1
SHA2568071edb914b488e5e693b750f99e25eaaf74d6e587fce4eb5ddcd36ade9a07f2
SHA512d66f97dd68b15795eccace13e92eebd3d1330637c052e0a0c9e2ef87b5ddc62d4676de74ec9b56aa8084406502a6ab5d547ce6a727427e5f15e53b8e272d7592
-
Filesize
94KB
MD5e376fc393659c59a3af365c0f918d28e
SHA14288795e1680c8bba231d37c3f6e217ce7444a72
SHA256d95bde6f4984ad35a0113da3850f55e40b801c7716fe2c7130a350389877d065
SHA5122771a44cb46242333eaf2d64b9e87077b429c54089c120e65b097f139271547441e98d75886ac69687ede26ff0447df482ade7cd49a48f9e2ba7bb117845f010
-
Filesize
94KB
MD5e376fc393659c59a3af365c0f918d28e
SHA14288795e1680c8bba231d37c3f6e217ce7444a72
SHA256d95bde6f4984ad35a0113da3850f55e40b801c7716fe2c7130a350389877d065
SHA5122771a44cb46242333eaf2d64b9e87077b429c54089c120e65b097f139271547441e98d75886ac69687ede26ff0447df482ade7cd49a48f9e2ba7bb117845f010
-
Filesize
94KB
MD5e376fc393659c59a3af365c0f918d28e
SHA14288795e1680c8bba231d37c3f6e217ce7444a72
SHA256d95bde6f4984ad35a0113da3850f55e40b801c7716fe2c7130a350389877d065
SHA5122771a44cb46242333eaf2d64b9e87077b429c54089c120e65b097f139271547441e98d75886ac69687ede26ff0447df482ade7cd49a48f9e2ba7bb117845f010
-
Filesize
932KB
MD57dd16a3c5ee05579e756b34c23ea1c6e
SHA1f9df773ebd835addadfea97b353c4b6a11922380
SHA256387058c609bf7ba4a60b30677c03778ab1a80c3eaa38b0b3e8ca3f354dde1fb0
SHA512543d51fcf6c5bda5b37497815ab1f1a3e43e31824fb7b14fd63f978a6514bc07eea3bf50b1a5ce58e8a7dd46b87eb78988b6a665bc08931e503c2ad0a55bdbe1
-
Filesize
6KB
MD5bb2a1deee1190183d91b8bdbf535498f
SHA13369b9324f8ae1c3cde6c779c6eb810516cd8d90
SHA25657db4cc481facc6feeb350a85856efb2f05cbb724b84332d283e0a8133e4a51b
SHA5129b86fc3c81f7a99926d869e053e79a4833bbe4c0d185c5d26b5208a054097ceda79fe710ad42d0758dea0f001a8b5cc057c02a85dae49d91dfdef5835ec0a407
-
Filesize
224KB
-
Filesize
168KB
-
Filesize
4KB
-
Filesize
196KB
-
Filesize
1024KB
-
Filesize
484KB
-
Filesize
484KB
-
Filesize
484KB
-
Filesize
484KB
-
Filesize
484KB
-
Filesize
112KB
-
Filesize
112KB
-
Filesize
112KB
-
Filesize
1024KB
-
Filesize
224KB
-
Filesize
168KB
-
Filesize
1024KB