Analysis
-
max time kernel
142s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
20-08-2023 11:51
Static task
static1
Behavioral task
behavioral1
Sample
7aa540096929693d8fb8248f8984f254c6682d0dd558ac2ae34d692fe1ced38a.dll
Resource
win7-20230712-en
windows7-x64
Behavioral task
behavioral2
Sample
7aa540096929693d8fb8248f8984f254c6682d0dd558ac2ae34d692fe1ced38a.dll
Resource
win10v2004-20230703-en
windows10-2004-x64
General
-
Target
7aa540096929693d8fb8248f8984f254c6682d0dd558ac2ae34d692fe1ced38a.dll
-
Size
14KB
-
MD5
e464efcec6db1bad722b33536f124426
-
SHA1
7526f070d142eb787c322dd1a2f0376e0b0def85
-
SHA256
7aa540096929693d8fb8248f8984f254c6682d0dd558ac2ae34d692fe1ced38a
-
SHA512
9e4478c1d6e5ae323538c20e15f654977fae90ff69660433065618343a5e6fa4ceed6566ba1738fb653f6646ee2b10587fdd44b26a0a4f2a1b899452757dab24
-
SSDEEP
192:KJqdPoX+9jua12QWCjOhUK/psrDWosxQ+1yg/3MpFv2cRV:O+1D120jRIpP/AvRRV
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload 1 IoCs
resource yara_rule behavioral2/memory/1848-139-0x0000000002F90000-0x0000000002FBA000-memory.dmp fatalrat -
Blocklisted process makes network request 2 IoCs
flow pid Process 5 1848 rundll32.exe 10 1848 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1848 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3728 wrote to memory of 1848 3728 rundll32.exe 81 PID 3728 wrote to memory of 1848 3728 rundll32.exe 81 PID 3728 wrote to memory of 1848 3728 rundll32.exe 81
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7aa540096929693d8fb8248f8984f254c6682d0dd558ac2ae34d692fe1ced38a.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7aa540096929693d8fb8248f8984f254c6682d0dd558ac2ae34d692fe1ced38a.dll,#12⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1848
-