Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
21/08/2023, 06:02
Static task
static1
Behavioral task
behavioral1
Sample
8642277427b19c4f6485734e7d1568267a10bf3c8fd87bf2462078c2a9406ea4.dll
Resource
win7-20230712-en
windows7-x64
Behavioral task
behavioral2
Sample
8642277427b19c4f6485734e7d1568267a10bf3c8fd87bf2462078c2a9406ea4.dll
Resource
win10v2004-20230703-en
windows10-2004-x64
General
-
Target
8642277427b19c4f6485734e7d1568267a10bf3c8fd87bf2462078c2a9406ea4.dll
-
Size
179KB
-
MD5
594bbad8be5c0c09479408af307a683c
-
SHA1
9dd3287b65209621c04a1d8e8c0b37ab02bd79aa
-
SHA256
8642277427b19c4f6485734e7d1568267a10bf3c8fd87bf2462078c2a9406ea4
-
SHA512
5785bffb355c336108a8f59d95008c16e97939c4b8fcd9db789b7b2e4279b46cf23756bb8a0b634a92488cf943d2917a0bebb33a4ce602e30015676cb6dd6f41
-
SSDEEP
3072:btoDWPeOBtvlQJ7kfZG8nelEiDgmG6OAg0Fuj0wgf/N1YsIRxm:tztvl87kfZqOtAOKPYsIq
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload 1 IoCs
resource yara_rule behavioral2/memory/316-139-0x0000000002430000-0x000000000245A000-memory.dmp fatalrat -
Blocklisted process makes network request 2 IoCs
flow pid Process 5 316 rundll32.exe 17 316 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 316 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2436 wrote to memory of 316 2436 rundll32.exe 83 PID 2436 wrote to memory of 316 2436 rundll32.exe 83 PID 2436 wrote to memory of 316 2436 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8642277427b19c4f6485734e7d1568267a10bf3c8fd87bf2462078c2a9406ea4.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8642277427b19c4f6485734e7d1568267a10bf3c8fd87bf2462078c2a9406ea4.dll,#12⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:316
-