Overview

overview

10

Static

static

1

d5cabd5eeb...b9.exe

windows7-x64

10

d5cabd5eeb...b9.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    140s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230831-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-09-2023 04:47

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d5cabd5eeb95c5522cb66be8d13fd991f6de4743e77e5c60782736f0d04e46b9.exe

  • Size

    73KB

  • MD5

    55a64ee555cce3158a72009b8c2b0cff

  • SHA1

    386232ca3818ec7e3a19f1e54e3970036ee2c682

  • SHA256

    d5cabd5eeb95c5522cb66be8d13fd991f6de4743e77e5c60782736f0d04e46b9

  • SHA512

    303c2cfb82a444d2f957accb3d3f7c2155945f978d715bd66826665901f1eb258bbc173ab1257c9a669ed31e8c71e9c27d387b9864c66def87560489f4a000b7

  • SSDEEP

    1536:7TJneYp48xQdTEprIvLk3FL5QyjtPZA9oioQ+/:nE89J5fjtPm9oN

Score
10/10
fatalratinfostealerrat

Malware Config

Signatures

  • FatalRat

    FatalRat is a modular infostealer family written in C++ first appearing in June 2021.

    infostealerratfatalrat
  • Fatal Rat payload 2 IoCs
    ratinfostealer
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d5cabd5eeb95c5522cb66be8d13fd991f6de4743e77e5c60782736f0d04e46b9.exe
    "C:\Users\Admin\AppData\Local\Temp\d5cabd5eeb95c5522cb66be8d13fd991f6de4743e77e5c60782736f0d04e46b9.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5068
    • C:\Users\Admin\AppData\Local\d5cabd5eeb95c5522cb66be8d13fd991f6de4743e77e5c60782736f0d04e46b9.exe
      "C:\Users\Admin\AppData\Local\d5cabd5eeb95c5522cb66be8d13fd991f6de4743e77e5c60782736f0d04e46b9.exe"
      2⤵
      • Executes dropped EXE
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2936

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\088D78689371D39E2B183BEA37F7313E
    Filesize

    503B

    MD5

    f0a84e34684536aa28353865eeb1b8eb

    SHA1

    1537e73198ddec46589eff66494481468b4bb8a6

    SHA256

    9c91595df518bba03ad5ab78f794b234d53b5affb088023aad76812375bf9b01

    SHA512

    f14cc3d2c6bf382cabce521a42947ec4fbe600a1a7e718c553a94a9e0381d5eceeb78400a31efc0626ea62935da5aaee132b991ca78e69af9ba2a989a3cf9df1

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
    Filesize

    717B

    MD5

    60fe01df86be2e5331b0cdbe86165686

    SHA1

    2a79f9713c3f192862ff80508062e64e8e0b29bd

    SHA256

    c08ccbc876cd5a7cdfa9670f9637da57f6a1282198a9bc71fc7d7247a6e5b7a8

    SHA512

    ef9f9a4dedcbfe339f4f3d07fb614645596c6f2b15608bdccdad492578b735f7cb075bdaa07178c764582ee345857ec4665f90342694e6a60786bb3d9b3a3d23

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\088D78689371D39E2B183BEA37F7313E
    Filesize

    552B

    MD5

    2597cbb605aab5c2e15d6c9a7a3efd74

    SHA1

    92d446695e5dea1534a2dbd3c094345e03355176

    SHA256

    028edd79ec483ff0fc7ed570787189efa2d0205cc98c2b0a66d64105b7b0fc89

    SHA512

    9472f7a0927c2715e945536d8351f654712ac719ac398fa8bac36e4eb1ee1a66abea843f5ea41f030d27c9de665bca2c0b44fda61f15f3cedf85cc5c1aa9ab1c

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
    Filesize

    192B

    MD5

    676abde9a916af1d922e2d1c395528dd

    SHA1

    2f23f9c36f4e68817ac1689ea36fcc4b698140f8

    SHA256

    375a960fab9c8ceeea2d182f28ac58d8d149bc652889e847f23ff26d064fd5c6

    SHA512

    0251cbf7386e396097458e2bc04d12eaa3e39b98a194b55c1d192bc4dd113560c2734d263bf9eb9e3e629775f29b230b55fc55c637f9d29f4213e6fe13e20699

    Download Submit

  • C:\Users\Admin\AppData\Local\d5cabd5eeb95c5522cb66be8d13fd991f6de4743e77e5c60782736f0d04e46b9.exe
    Filesize

    73KB

    MD5

    55a64ee555cce3158a72009b8c2b0cff

    SHA1

    386232ca3818ec7e3a19f1e54e3970036ee2c682

    SHA256

    d5cabd5eeb95c5522cb66be8d13fd991f6de4743e77e5c60782736f0d04e46b9

    SHA512

    303c2cfb82a444d2f957accb3d3f7c2155945f978d715bd66826665901f1eb258bbc173ab1257c9a669ed31e8c71e9c27d387b9864c66def87560489f4a000b7

    Download Submit

  • C:\Users\Admin\AppData\Local\d5cabd5eeb95c5522cb66be8d13fd991f6de4743e77e5c60782736f0d04e46b9.exe
    Filesize

    73KB

    MD5

    55a64ee555cce3158a72009b8c2b0cff

    SHA1

    386232ca3818ec7e3a19f1e54e3970036ee2c682

    SHA256

    d5cabd5eeb95c5522cb66be8d13fd991f6de4743e77e5c60782736f0d04e46b9

    SHA512

    303c2cfb82a444d2f957accb3d3f7c2155945f978d715bd66826665901f1eb258bbc173ab1257c9a669ed31e8c71e9c27d387b9864c66def87560489f4a000b7

    Download Submit

  • C:\Users\Admin\AppData\Local\d5cabd5eeb95c5522cb66be8d13fd991f6de4743e77e5c60782736f0d04e46b9.exe
    Filesize

    73KB

    MD5

    55a64ee555cce3158a72009b8c2b0cff

    SHA1

    386232ca3818ec7e3a19f1e54e3970036ee2c682

    SHA256

    d5cabd5eeb95c5522cb66be8d13fd991f6de4743e77e5c60782736f0d04e46b9

    SHA512

    303c2cfb82a444d2f957accb3d3f7c2155945f978d715bd66826665901f1eb258bbc173ab1257c9a669ed31e8c71e9c27d387b9864c66def87560489f4a000b7

    Download Submit

  • memory/2936-35-0x00000000030C0000-0x00000000030EA000-memory.dmp

    Filesize

    168KB

    Download

  • memory/5068-6-0x0000000010000000-0x0000000010031000-memory.dmp

    Filesize

    196KB

    Download

  • memory/5068-10-0x0000000002EC0000-0x0000000002EEA000-memory.dmp

    Filesize

    168KB

    Download