Analysis
- max time kernel
141s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20230703-en - resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system - submitted
13/08/2023, 14:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
488cc37920a11c42c5535de635b6bfe121729665e9a5a7a5b9114c33b9493d4a.exe
Resource
win7-20230712-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
488cc37920a11c42c5535de635b6bfe121729665e9a5a7a5b9114c33b9493d4a.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 488cc37920a11c42c5535de635b6bfe121729665e9a5a7a5b9114c33b9493d4a.exe
- Size 7.8MB
- Sample230813-rtht7sda55
- SHA256 488cc37920a11c42c5535de635b6bfe121729665e9a5a7a5b9114c33b9493d4a
- MD5 4778cee989a91ab916338d8d49efc4b3
- SHA1 73bce3f6ec4edbaf3a863c475d6e08a0239b71e9
- SHA512 e385c3d750230e8620c0dd902d9025ed9dc9e8a5cf179c1064e903be2e939725251ba2b79ca72e12dec7a06e7061fee5b2bdba223f6636b915a65f40e91c8c86
- SSDEEP 98304:xWsWpctwN8IxRs8gG/UsQEHxFPZwvIZAUerFooZwXjuPhdTMOgSGF0YJ:WNBR7cszHxTZrerFooZeIhd1GF0
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
- Gh0st RAT payload 1 IoCs
resource yara_rule behavioral2/memory/4636-133-0x0000000010000000-0x0000000010026000-memory.dmp family_gh0strat - Fatal Rat payload 1 IoCs
resource yara_rule behavioral2/memory/4636-133-0x0000000010000000-0x0000000010026000-memory.dmp fatalrat - Executes dropped EXE 1 IoCs
pid Process 3288 WinLong.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3288 WinLong.exe 3288 WinLong.exe 3288 WinLong.exe 3288 WinLong.exe 3288 WinLong.exe 3288 WinLong.exe 3288 WinLong.exe 3288 WinLong.exe 3288 WinLong.exe 3288 WinLong.exe 3288 WinLong.exe 3288 WinLong.exe 3288 WinLong.exe 3288 WinLong.exe 3288 WinLong.exe 3288 WinLong.exe 3288 WinLong.exe 3288 WinLong.exe 3288 WinLong.exe 3288 WinLong.exe 3288 WinLong.exe 3288 WinLong.exe 3288 WinLong.exe 3288 WinLong.exe 3288 WinLong.exe 3288 WinLong.exe 3288 WinLong.exe 3288 WinLong.exe 3288 WinLong.exe 3288 WinLong.exe 3288 WinLong.exe 3288 WinLong.exe 3288 WinLong.exe 3288 WinLong.exe 3288 WinLong.exe 3288 WinLong.exe 3288 WinLong.exe 3288 WinLong.exe 3288 WinLong.exe 3288 WinLong.exe 3288 WinLong.exe 3288 WinLong.exe 3288 WinLong.exe 3288 WinLong.exe 3288 WinLong.exe 3288 WinLong.exe 3288 WinLong.exe 3288 WinLong.exe 3288 WinLong.exe 3288 WinLong.exe 3288 WinLong.exe 3288 WinLong.exe 3288 WinLong.exe 3288 WinLong.exe 3288 WinLong.exe 3288 WinLong.exe 3288 WinLong.exe 3288 WinLong.exe 3288 WinLong.exe 3288 WinLong.exe 3288 WinLong.exe 3288 WinLong.exe 3288 WinLong.exe 3288 WinLong.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4636 488cc37920a11c42c5535de635b6bfe121729665e9a5a7a5b9114c33b9493d4a.exe Token: SeDebugPrivilege 3288 WinLong.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4636 wrote to memory of 3288 4636 488cc37920a11c42c5535de635b6bfe121729665e9a5a7a5b9114c33b9493d4a.exe 82 PID 4636 wrote to memory of 3288 4636 488cc37920a11c42c5535de635b6bfe121729665e9a5a7a5b9114c33b9493d4a.exe 82 PID 4636 wrote to memory of 3288 4636 488cc37920a11c42c5535de635b6bfe121729665e9a5a7a5b9114c33b9493d4a.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\488cc37920a11c42c5535de635b6bfe121729665e9a5a7a5b9114c33b9493d4a.exe"C:\Users\Admin\AppData\Local\Temp\488cc37920a11c42c5535de635b6bfe121729665e9a5a7a5b9114c33b9493d4a.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Users\Public\Downloads\WinLong.exe"C:\Users\Public\Downloads\WinLong.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3288
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Public\Downloads\WinLong.exe
- Size 7.8MB
- SHA256 488cc37920a11c42c5535de635b6bfe121729665e9a5a7a5b9114c33b9493d4a
- MD5 4778cee989a91ab916338d8d49efc4b3
- SHA1 73bce3f6ec4edbaf3a863c475d6e08a0239b71e9
- SHA512 e385c3d750230e8620c0dd902d9025ed9dc9e8a5cf179c1064e903be2e939725251ba2b79ca72e12dec7a06e7061fee5b2bdba223f6636b915a65f40e91c8c86
- SSDEEP 98304:xWsWpctwN8IxRs8gG/UsQEHxFPZwvIZAUerFooZwXjuPhdTMOgSGF0YJ:WNBR7cszHxTZrerFooZeIhd1GF0
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Public\Downloads\WinLong.exe
- Size 7.8MB
- SHA256 488cc37920a11c42c5535de635b6bfe121729665e9a5a7a5b9114c33b9493d4a
- MD5 4778cee989a91ab916338d8d49efc4b3
- SHA1 73bce3f6ec4edbaf3a863c475d6e08a0239b71e9
- SHA512 e385c3d750230e8620c0dd902d9025ed9dc9e8a5cf179c1064e903be2e939725251ba2b79ca72e12dec7a06e7061fee5b2bdba223f6636b915a65f40e91c8c86
- SSDEEP 98304:xWsWpctwN8IxRs8gG/UsQEHxFPZwvIZAUerFooZwXjuPhdTMOgSGF0YJ:WNBR7cszHxTZrerFooZeIhd1GF0
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Public\Downloads\WinLong.exe
- Size 7.8MB
- SHA256 488cc37920a11c42c5535de635b6bfe121729665e9a5a7a5b9114c33b9493d4a
- MD5 4778cee989a91ab916338d8d49efc4b3
- SHA1 73bce3f6ec4edbaf3a863c475d6e08a0239b71e9
- SHA512 e385c3d750230e8620c0dd902d9025ed9dc9e8a5cf179c1064e903be2e939725251ba2b79ca72e12dec7a06e7061fee5b2bdba223f6636b915a65f40e91c8c86
- SSDEEP 98304:xWsWpctwN8IxRs8gG/UsQEHxFPZwvIZAUerFooZwXjuPhdTMOgSGF0YJ:WNBR7cszHxTZrerFooZeIhd1GF0
- MD5 SHA1 SHA512 SSDEEP