Overview

overview

10

Static

static

3

b2b8edb831...c4.exe

windows7-x64

10

b2b8edb831...c4.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    90s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230831-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-09-2023 11:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b2b8edb831047a486ad58488be7497f74c262ced7a35e0b1b2e063495bffd6c4.exe

  • Size

    93KB

  • MD5

    074a292b0a1405cf35e5a9d6067f15ca

  • SHA1

    5bcc1e4784d67b3ba0dd7147514cd883b246a80a

  • SHA256

    b2b8edb831047a486ad58488be7497f74c262ced7a35e0b1b2e063495bffd6c4

  • SHA512

    b6ebc5b826e44b5e9c75d167ddefe98cd1aac3d2ea1dc3a96efceba3179f6a49b76239e6aa8504524d3ce02244a96d5f24642b267119fa11d919bd7b5283868f

  • SSDEEP

    1536:1NeXBiSPip4rS8m+mRiSG8rnv2LAczc9Cv6RHSXZnsW/cd5UpmgCQ9pdeFi:1JSzrS8IG8rnv2LAczclIXm5UYgC6veg

Score
10/10
fatalratinfostealerrat

Malware Config

Signatures

  • FatalRat

    FatalRat is a modular infostealer family written in C++ first appearing in June 2021.

    infostealerratfatalrat
  • Fatal Rat payload 2 IoCs
    ratinfostealer
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b2b8edb831047a486ad58488be7497f74c262ced7a35e0b1b2e063495bffd6c4.exe
    "C:\Users\Admin\AppData\Local\Temp\b2b8edb831047a486ad58488be7497f74c262ced7a35e0b1b2e063495bffd6c4.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2644
    • C:\Users\Admin\AppData\Local\b2b8edb831047a486ad58488be7497f74c262ced7a35e0b1b2e063495bffd6c4.exe
      "C:\Users\Admin\AppData\Local\b2b8edb831047a486ad58488be7497f74c262ced7a35e0b1b2e063495bffd6c4.exe"
      2⤵
      • Executes dropped EXE
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1116

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\088D78689371D39E2B183BEA37F7313E
    Filesize

    503B

    MD5

    f0a84e34684536aa28353865eeb1b8eb

    SHA1

    1537e73198ddec46589eff66494481468b4bb8a6

    SHA256

    9c91595df518bba03ad5ab78f794b234d53b5affb088023aad76812375bf9b01

    SHA512

    f14cc3d2c6bf382cabce521a42947ec4fbe600a1a7e718c553a94a9e0381d5eceeb78400a31efc0626ea62935da5aaee132b991ca78e69af9ba2a989a3cf9df1

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
    Filesize

    717B

    MD5

    60fe01df86be2e5331b0cdbe86165686

    SHA1

    2a79f9713c3f192862ff80508062e64e8e0b29bd

    SHA256

    c08ccbc876cd5a7cdfa9670f9637da57f6a1282198a9bc71fc7d7247a6e5b7a8

    SHA512

    ef9f9a4dedcbfe339f4f3d07fb614645596c6f2b15608bdccdad492578b735f7cb075bdaa07178c764582ee345857ec4665f90342694e6a60786bb3d9b3a3d23

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\088D78689371D39E2B183BEA37F7313E
    Filesize

    552B

    MD5

    576b800b248ca6951707e45e43dac7f1

    SHA1

    1eb6d7d1ec350f45eb816c710cfa9fdfd064b609

    SHA256

    919f4ecfb158de03c46d0a46a7614074a266d0bb4d3112f851d34cde67a1c76f

    SHA512

    0879b430acad3a13e9b7cad303e3edf90c589c4a4631c5baf8e4b2af5cf25bef3631dbbc84ae7cb56a0df5068514d5cba324d3f018417c792438489945f8b776

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
    Filesize

    192B

    MD5

    2b02ef635974f1452f0eac7697f4413d

    SHA1

    55171af955694cc72dc38c63dd340a7882645c92

    SHA256

    b9fab7eb4ab1814ecb5c556a9c134d2d589d5e2706f1b4fc9dcbb75343a2ef25

    SHA512

    437775326962761afadb7b949859a1750af4e695338708aef9cd875134cb9d22a573c83b73cbf4d3f16de568a612cfda2f250f98c9b1379f001c5e17c0891d6d

    Download Submit

  • C:\Users\Admin\AppData\Local\b2b8edb831047a486ad58488be7497f74c262ced7a35e0b1b2e063495bffd6c4.exe
    Filesize

    93KB

    MD5

    074a292b0a1405cf35e5a9d6067f15ca

    SHA1

    5bcc1e4784d67b3ba0dd7147514cd883b246a80a

    SHA256

    b2b8edb831047a486ad58488be7497f74c262ced7a35e0b1b2e063495bffd6c4

    SHA512

    b6ebc5b826e44b5e9c75d167ddefe98cd1aac3d2ea1dc3a96efceba3179f6a49b76239e6aa8504524d3ce02244a96d5f24642b267119fa11d919bd7b5283868f

    Download Submit

  • C:\Users\Admin\AppData\Local\b2b8edb831047a486ad58488be7497f74c262ced7a35e0b1b2e063495bffd6c4.exe
    Filesize

    93KB

    MD5

    074a292b0a1405cf35e5a9d6067f15ca

    SHA1

    5bcc1e4784d67b3ba0dd7147514cd883b246a80a

    SHA256

    b2b8edb831047a486ad58488be7497f74c262ced7a35e0b1b2e063495bffd6c4

    SHA512

    b6ebc5b826e44b5e9c75d167ddefe98cd1aac3d2ea1dc3a96efceba3179f6a49b76239e6aa8504524d3ce02244a96d5f24642b267119fa11d919bd7b5283868f

    Download Submit

  • C:\Users\Admin\AppData\Local\b2b8edb831047a486ad58488be7497f74c262ced7a35e0b1b2e063495bffd6c4.exe
    Filesize

    93KB

    MD5

    074a292b0a1405cf35e5a9d6067f15ca

    SHA1

    5bcc1e4784d67b3ba0dd7147514cd883b246a80a

    SHA256

    b2b8edb831047a486ad58488be7497f74c262ced7a35e0b1b2e063495bffd6c4

    SHA512

    b6ebc5b826e44b5e9c75d167ddefe98cd1aac3d2ea1dc3a96efceba3179f6a49b76239e6aa8504524d3ce02244a96d5f24642b267119fa11d919bd7b5283868f

    Download Submit

  • memory/1116-39-0x0000000003600000-0x000000000362A000-memory.dmp

    Filesize

    168KB

    Download

  • memory/2644-9-0x0000000010000000-0x0000000010031000-memory.dmp

    Filesize

    196KB

    Download

  • memory/2644-11-0x0000000003A70000-0x0000000003AA2000-memory.dmp

    Filesize

    200KB

    Download

  • memory/2644-14-0x0000000003AB0000-0x0000000003ADA000-memory.dmp

    Filesize

    168KB

    Download