Analysis
-
max time kernel
144s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
-
submitted
12-08-2023 20:46
General
-
Target
ae8b0e57f441be4c3bd36928b5d886d51b68f50331d3d0e7ba8503f0fc5374d8.exe
-
Size
62KB
-
MD5
9eb3217ac274ced01d826fc87f35f11d
-
SHA1
6cd757027771caaf6f22f741e9b9158a3c6f9e6b
-
SHA256
ae8b0e57f441be4c3bd36928b5d886d51b68f50331d3d0e7ba8503f0fc5374d8
-
SHA512
49382a278924414518657558e0129cd4ddc67f0e8fff81f55006ca28d7e2169babe8ce48d5ad33de950b35158c4cb72a94b08217dbcee810d8f5a733fc306268
-
SSDEEP
1536:Hpmh8mcUyppcli5xsLPFldzW+loL+v98vwpY9:HO5cUyppoiILDdlOL+3y9
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload 2 IoCs
-
ASPack v2.12-2.42 3 IoCs
Detects executables packed with ASPack v2.12-2.42
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ae8b0e57f441be4c3bd36928b5d886d51b68f50331d3d0e7ba8503f0fc5374d8.exe"C:\Users\Admin\AppData\Local\Temp\ae8b0e57f441be4c3bd36928b5d886d51b68f50331d3d0e7ba8503f0fc5374d8.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\ae8b0e57f441be4c3bd36928b5d886d51b68f50331d3d0e7ba8503f0fc5374d8.exe"C:\Users\Admin\AppData\Local\ae8b0e57f441be4c3bd36928b5d886d51b68f50331d3d0e7ba8503f0fc5374d8.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
62KB
MD59eb3217ac274ced01d826fc87f35f11d
SHA16cd757027771caaf6f22f741e9b9158a3c6f9e6b
SHA256ae8b0e57f441be4c3bd36928b5d886d51b68f50331d3d0e7ba8503f0fc5374d8
SHA51249382a278924414518657558e0129cd4ddc67f0e8fff81f55006ca28d7e2169babe8ce48d5ad33de950b35158c4cb72a94b08217dbcee810d8f5a733fc306268
-
Filesize
62KB
MD59eb3217ac274ced01d826fc87f35f11d
SHA16cd757027771caaf6f22f741e9b9158a3c6f9e6b
SHA256ae8b0e57f441be4c3bd36928b5d886d51b68f50331d3d0e7ba8503f0fc5374d8
SHA51249382a278924414518657558e0129cd4ddc67f0e8fff81f55006ca28d7e2169babe8ce48d5ad33de950b35158c4cb72a94b08217dbcee810d8f5a733fc306268
-
Filesize
62KB
MD59eb3217ac274ced01d826fc87f35f11d
SHA16cd757027771caaf6f22f741e9b9158a3c6f9e6b
SHA256ae8b0e57f441be4c3bd36928b5d886d51b68f50331d3d0e7ba8503f0fc5374d8
SHA51249382a278924414518657558e0129cd4ddc67f0e8fff81f55006ca28d7e2169babe8ce48d5ad33de950b35158c4cb72a94b08217dbcee810d8f5a733fc306268
-
Filesize
1024KB
-
Filesize
224KB
-
Filesize
116KB
-
Filesize
1024KB
-
Filesize
168KB
-
Filesize
116KB
-
Filesize
116KB
-
Filesize
116KB
-
Filesize
116KB
-
Filesize
116KB
-
Filesize
1024KB
-
Filesize
116KB
-
Filesize
116KB
-
Filesize
4KB
-
Filesize
168KB
-
Filesize
196KB
-
Filesize
224KB