Analysis
-
max time kernel
146s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
-
submitted
16-08-2023 15:34
General
-
Target
c276f1bdc7e7394ed1e92a510827c6c188ca4a38a77bfd1c4e74ba8b2c25084c.exe
-
Size
54KB
-
MD5
8915fd2dcf25f43d4b753c4ff500cad1
-
SHA1
c86551498d467703d037d3c1d539e563a8600050
-
SHA256
c276f1bdc7e7394ed1e92a510827c6c188ca4a38a77bfd1c4e74ba8b2c25084c
-
SHA512
85270959b72deb3f62c6e42926e4c7b1ffb40b1ccbd4bcde2aec462d0159526cf8dd1909640207acd69eaa7640e4bcde74679b822ecbd394a7772342c988c294
-
SSDEEP
768:V/FSpmCI89ZKcUi7PBHJc+Ead3pZFooAl8f8nrEur8SkbiTW+GVxWbPrMLPGv9:2pmh8mcUyppcli5ZueijzW+loL+v9
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload 2 IoCs
-
ASPack v2.12-2.42 3 IoCs
Detects executables packed with ASPack v2.12-2.42
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c276f1bdc7e7394ed1e92a510827c6c188ca4a38a77bfd1c4e74ba8b2c25084c.exe"C:\Users\Admin\AppData\Local\Temp\c276f1bdc7e7394ed1e92a510827c6c188ca4a38a77bfd1c4e74ba8b2c25084c.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\c276f1bdc7e7394ed1e92a510827c6c188ca4a38a77bfd1c4e74ba8b2c25084c.exe"C:\Users\Admin\AppData\Local\c276f1bdc7e7394ed1e92a510827c6c188ca4a38a77bfd1c4e74ba8b2c25084c.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
54KB
MD58915fd2dcf25f43d4b753c4ff500cad1
SHA1c86551498d467703d037d3c1d539e563a8600050
SHA256c276f1bdc7e7394ed1e92a510827c6c188ca4a38a77bfd1c4e74ba8b2c25084c
SHA51285270959b72deb3f62c6e42926e4c7b1ffb40b1ccbd4bcde2aec462d0159526cf8dd1909640207acd69eaa7640e4bcde74679b822ecbd394a7772342c988c294
-
Filesize
54KB
MD58915fd2dcf25f43d4b753c4ff500cad1
SHA1c86551498d467703d037d3c1d539e563a8600050
SHA256c276f1bdc7e7394ed1e92a510827c6c188ca4a38a77bfd1c4e74ba8b2c25084c
SHA51285270959b72deb3f62c6e42926e4c7b1ffb40b1ccbd4bcde2aec462d0159526cf8dd1909640207acd69eaa7640e4bcde74679b822ecbd394a7772342c988c294
-
Filesize
54KB
MD58915fd2dcf25f43d4b753c4ff500cad1
SHA1c86551498d467703d037d3c1d539e563a8600050
SHA256c276f1bdc7e7394ed1e92a510827c6c188ca4a38a77bfd1c4e74ba8b2c25084c
SHA51285270959b72deb3f62c6e42926e4c7b1ffb40b1ccbd4bcde2aec462d0159526cf8dd1909640207acd69eaa7640e4bcde74679b822ecbd394a7772342c988c294
-
Filesize
196KB
-
Filesize
116KB
-
Filesize
4KB
-
Filesize
224KB
-
Filesize
168KB
-
Filesize
1024KB
-
Filesize
116KB
-
Filesize
116KB
-
Filesize
116KB
-
Filesize
116KB
-
Filesize
116KB
-
Filesize
1024KB
-
Filesize
224KB
-
Filesize
168KB
-
Filesize
116KB
-
Filesize
1024KB