Analysis
-
max time kernel
120s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
20-08-2023 11:51
Static task
static1
Behavioral task
behavioral1
Sample
7aa540096929693d8fb8248f8984f254c6682d0dd558ac2ae34d692fe1ced38a.dll
Resource
win7-20230712-en
windows7-x64
Behavioral task
behavioral2
Sample
7aa540096929693d8fb8248f8984f254c6682d0dd558ac2ae34d692fe1ced38a.dll
Resource
win10v2004-20230703-en
windows10-2004-x64
General
-
Target
7aa540096929693d8fb8248f8984f254c6682d0dd558ac2ae34d692fe1ced38a.dll
-
Size
14KB
-
MD5
e464efcec6db1bad722b33536f124426
-
SHA1
7526f070d142eb787c322dd1a2f0376e0b0def85
-
SHA256
7aa540096929693d8fb8248f8984f254c6682d0dd558ac2ae34d692fe1ced38a
-
SHA512
9e4478c1d6e5ae323538c20e15f654977fae90ff69660433065618343a5e6fa4ceed6566ba1738fb653f6646ee2b10587fdd44b26a0a4f2a1b899452757dab24
-
SSDEEP
192:KJqdPoX+9jua12QWCjOhUK/psrDWosxQ+1yg/3MpFv2cRV:O+1D120jRIpP/AvRRV
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload 1 IoCs
resource yara_rule behavioral1/memory/1232-60-0x0000000000180000-0x00000000001AA000-memory.dmp fatalrat -
Blocklisted process makes network request 2 IoCs
flow pid Process 2 1232 rundll32.exe 3 1232 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 51 IoCs
pid Process 1232 rundll32.exe 1232 rundll32.exe 1232 rundll32.exe 1232 rundll32.exe 1232 rundll32.exe 1232 rundll32.exe 1232 rundll32.exe 1232 rundll32.exe 1232 rundll32.exe 1232 rundll32.exe 1232 rundll32.exe 1232 rundll32.exe 1232 rundll32.exe 1232 rundll32.exe 1232 rundll32.exe 1232 rundll32.exe 1232 rundll32.exe 1232 rundll32.exe 1232 rundll32.exe 1232 rundll32.exe 1232 rundll32.exe 1232 rundll32.exe 1232 rundll32.exe 1232 rundll32.exe 1232 rundll32.exe 1232 rundll32.exe 1232 rundll32.exe 1232 rundll32.exe 1232 rundll32.exe 1232 rundll32.exe 1232 rundll32.exe 1232 rundll32.exe 1232 rundll32.exe 1232 rundll32.exe 1232 rundll32.exe 1232 rundll32.exe 1232 rundll32.exe 1232 rundll32.exe 1232 rundll32.exe 1232 rundll32.exe 1232 rundll32.exe 1232 rundll32.exe 1232 rundll32.exe 1232 rundll32.exe 1232 rundll32.exe 1232 rundll32.exe 1232 rundll32.exe 1232 rundll32.exe 1232 rundll32.exe 1232 rundll32.exe 1232 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1232 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1732 wrote to memory of 1232 1732 rundll32.exe 28 PID 1732 wrote to memory of 1232 1732 rundll32.exe 28 PID 1732 wrote to memory of 1232 1732 rundll32.exe 28 PID 1732 wrote to memory of 1232 1732 rundll32.exe 28 PID 1732 wrote to memory of 1232 1732 rundll32.exe 28 PID 1732 wrote to memory of 1232 1732 rundll32.exe 28 PID 1732 wrote to memory of 1232 1732 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7aa540096929693d8fb8248f8984f254c6682d0dd558ac2ae34d692fe1ced38a.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7aa540096929693d8fb8248f8984f254c6682d0dd558ac2ae34d692fe1ced38a.dll,#12⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1232
-