Analysis
-
max time kernel
143s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20230831-en -
resource tags
-
submitted
08-09-2023 22:57
General
-
Target
99789afb9f3e007fd73e1462974d87dbf97d2121e41577d69b56b45db323f19d.exe
-
Size
2.6MB
-
MD5
cd3be3a9c4ce1d2a2656f57642fbd1f5
-
SHA1
4b26f0a6381049e85cebabf15926a5696ce30974
-
SHA256
99789afb9f3e007fd73e1462974d87dbf97d2121e41577d69b56b45db323f19d
-
SHA512
a6ae5e34fbec50fbcf334853860a24e5aa56db897f32310f52bb9edaff6c3e3f179eb893a3cf8708f80a56fd87de8235b0088e2269fe0c0c02bd953e109bb5c6
-
SSDEEP
49152:lCcxwDfvkKPaYvzqlIxZJ58TDPu2mXMotPmBKE++xVHw1WUdlEr:lCVDfvkKPaYvAEp8TDPu2mXMotezd3w6
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload 2 IoCs
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\99789afb9f3e007fd73e1462974d87dbf97d2121e41577d69b56b45db323f19d.exe"C:\Users\Admin\AppData\Local\Temp\99789afb9f3e007fd73e1462974d87dbf97d2121e41577d69b56b45db323f19d.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16KB
MD599c370ffd954eee6519a11022d601973
SHA191d48d0f81219f118e6869441b0aadabd543245c
SHA256a8db430d6f56b40c3e5f37c01bca4ae6c1ab68af0165f8d5c727eab7a81c0142
SHA5126d94aa0f54b0b8b128b8eb7c0483d49fa3c86f278e3efac36e3888dcfcf3221904bba7052c732b52b55db62dcbf421fa5e6824e5de16b10e16037564eb85cf8b
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
124KB
-
Filesize
128KB