fatalrat | b280f57cc64f24e3feefaecc3746058d393c4d16ca9ab3cdfac1ebfdb3111136

General

Target

b280f57cc64f24e3feefaecc3746058d393c4d16ca9ab3cdfac1ebfdb3111136.exe
Size

376KB
MD5

b8f957e23aa6a2e9bbd44d26618ff1fd
SHA1

4cc450bbba0caa9a78e880446500354d1ce7bb01
SHA256

b280f57cc64f24e3feefaecc3746058d393c4d16ca9ab3cdfac1ebfdb3111136
SHA512

6572d396affa2a3440cf5bb4967368fce743493871a174b3d7be4db48fd0181d61009748b01021be01132d622f245fe08ff0269465675277e4e23c313c1115d7
SSDEEP

6144:AORLKn/ocYlNMeBasmrfc2RrYZWC9sQNwhstAOWf4rE0G/saJ:A6+ANlNMeMx0MrG9fGwAOWf4rt8X

Score

10^/10

fatalrat infostealer rat upx

Malware Config

Signatures

FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
infostealer rat fatalrat

Fatal Rat payload 4 IoCs

rat infostealer

resource	yara_rule
behavioral1/memory/2044-1-0x0000000010000000-0x000000001002A000-memory.dmp	fatalrat
behavioral1/memory/2044-22-0x0000000000400000-0x0000000000517000-memory.dmp	fatalrat
behavioral1/memory/2180-23-0x0000000000400000-0x0000000000517000-memory.dmp	fatalrat
behavioral1/memory/2600-26-0x0000000000400000-0x0000000000517000-memory.dmp	fatalrat

Executes dropped EXE 2 IoCs

pid	Process
2180	Svwxya.exe
2600	Svwxya.exe

Loads dropped DLL 1 IoCs

pid	Process
2180	Svwxya.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2044-0-0x0000000000400000-0x0000000000517000-memory.dmp	upx
behavioral1/files/0x000b000000012021-7.dat	upx
behavioral1/files/0x000b000000012021-13.dat	upx
behavioral1/files/0x000b000000012021-15.dat	upx
behavioral1/files/0x000b000000012021-14.dat	upx
behavioral1/memory/2600-16-0x0000000000400000-0x0000000000517000-memory.dmp	upx
behavioral1/memory/2044-22-0x0000000000400000-0x0000000000517000-memory.dmp	upx
behavioral1/memory/2180-23-0x0000000000400000-0x0000000000517000-memory.dmp	upx
behavioral1/memory/2600-26-0x0000000000400000-0x0000000000517000-memory.dmp	upx

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Svwxya.exe	b280f57cc64f24e3feefaecc3746058d393c4d16ca9ab3cdfac1ebfdb3111136.exe
File opened for modification	C:\Program Files (x86)\Svwxya.exe	b280f57cc64f24e3feefaecc3746058d393c4d16ca9ab3cdfac1ebfdb3111136.exe
File opened for modification	C:\Program Files (x86)\Svwxya.exe	Svwxya.exe
File created	C:\Program Files (x86)\Svwxya.exe	Svwxya.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Svwxya.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Svwxya.exe

Modifies data under HKEY_USERS 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	Svwxya.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum\Version = "7"	Svwxya.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM	Svwxya.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet	Svwxya.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Services\Stuvwx Abcdefgh\Group = "Fatal"	Svwxya.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Services\Stuvwx Abcdefgh\InstallTime = "2023-09-15 22:33"	Svwxya.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum	Svwxya.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	Svwxya.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Services\Stuvwx Abcdefgh	Svwxya.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Services	Svwxya.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	Svwxya.exe

Suspicious behavior: EnumeratesProcesses 51 IoCs

pid	Process
2600	Svwxya.exe
2600	Svwxya.exe
2600	Svwxya.exe
2600	Svwxya.exe
2600	Svwxya.exe
2600	Svwxya.exe
2600	Svwxya.exe
2600	Svwxya.exe
2600	Svwxya.exe
2600	Svwxya.exe
2600	Svwxya.exe
2600	Svwxya.exe
2600	Svwxya.exe
2600	Svwxya.exe
2600	Svwxya.exe
2600	Svwxya.exe
2600	Svwxya.exe
2600	Svwxya.exe
2600	Svwxya.exe
2600	Svwxya.exe
2600	Svwxya.exe
2600	Svwxya.exe
2600	Svwxya.exe
2600	Svwxya.exe
2600	Svwxya.exe
2600	Svwxya.exe
2600	Svwxya.exe
2600	Svwxya.exe
2600	Svwxya.exe
2600	Svwxya.exe
2600	Svwxya.exe
2600	Svwxya.exe
2600	Svwxya.exe
2600	Svwxya.exe
2600	Svwxya.exe
2600	Svwxya.exe
2600	Svwxya.exe
2600	Svwxya.exe
2600	Svwxya.exe
2600	Svwxya.exe
2600	Svwxya.exe
2600	Svwxya.exe
2600	Svwxya.exe
2600	Svwxya.exe
2600	Svwxya.exe
2600	Svwxya.exe
2600	Svwxya.exe
2600	Svwxya.exe
2600	Svwxya.exe
2600	Svwxya.exe
2600	Svwxya.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2044	b280f57cc64f24e3feefaecc3746058d393c4d16ca9ab3cdfac1ebfdb3111136.exe
Token: SeDebugPrivilege	2180	Svwxya.exe
Token: SeDebugPrivilege	2600	Svwxya.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2600	2180	Svwxya.exe	29
PID 2180 wrote to memory of 2600	2180	Svwxya.exe	29
PID 2180 wrote to memory of 2600	2180	Svwxya.exe	29
PID 2180 wrote to memory of 2600	2180	Svwxya.exe	29

C:\Users\Admin\AppData\Local\Temp\b280f57cc64f24e3feefaecc3746058d393c4d16ca9ab3cdfac1ebfdb3111136.exe
"C:\Users\Admin\AppData\Local\Temp\b280f57cc64f24e3feefaecc3746058d393c4d16ca9ab3cdfac1ebfdb3111136.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2044

C:\Program Files (x86)\Svwxya.exe
"C:\Program Files (x86)\Svwxya.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Program Files (x86)\Svwxya.exe
  "C:\Program Files (x86)\Svwxya.exe" Win7
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Svwxya.exe

Filesize
376KB

MD5
b8f957e23aa6a2e9bbd44d26618ff1fd

SHA1
4cc450bbba0caa9a78e880446500354d1ce7bb01

SHA256
b280f57cc64f24e3feefaecc3746058d393c4d16ca9ab3cdfac1ebfdb3111136

SHA512
6572d396affa2a3440cf5bb4967368fce743493871a174b3d7be4db48fd0181d61009748b01021be01132d622f245fe08ff0269465675277e4e23c313c1115d7

Download Submit
C:\Program Files (x86)\Svwxya.exe

Filesize
376KB

MD5
b8f957e23aa6a2e9bbd44d26618ff1fd

SHA1
4cc450bbba0caa9a78e880446500354d1ce7bb01

SHA256
b280f57cc64f24e3feefaecc3746058d393c4d16ca9ab3cdfac1ebfdb3111136

SHA512
6572d396affa2a3440cf5bb4967368fce743493871a174b3d7be4db48fd0181d61009748b01021be01132d622f245fe08ff0269465675277e4e23c313c1115d7

Download Submit
C:\Program Files (x86)\Svwxya.exe

Filesize
376KB

MD5
b8f957e23aa6a2e9bbd44d26618ff1fd

SHA1
4cc450bbba0caa9a78e880446500354d1ce7bb01

SHA256
b280f57cc64f24e3feefaecc3746058d393c4d16ca9ab3cdfac1ebfdb3111136

SHA512
6572d396affa2a3440cf5bb4967368fce743493871a174b3d7be4db48fd0181d61009748b01021be01132d622f245fe08ff0269465675277e4e23c313c1115d7

Download Submit
\Program Files (x86)\Svwxya.exe

Filesize
376KB

MD5
b8f957e23aa6a2e9bbd44d26618ff1fd

SHA1
4cc450bbba0caa9a78e880446500354d1ce7bb01

SHA256
b280f57cc64f24e3feefaecc3746058d393c4d16ca9ab3cdfac1ebfdb3111136

SHA512
6572d396affa2a3440cf5bb4967368fce743493871a174b3d7be4db48fd0181d61009748b01021be01132d622f245fe08ff0269465675277e4e23c313c1115d7

Download Submit
memory/2044-0-0x0000000000400000-0x0000000000517000-memory.dmp

Filesize
1.1MB

Download
memory/2044-1-0x0000000010000000-0x000000001002A000-memory.dmp

Filesize
168KB

Download
memory/2044-22-0x0000000000400000-0x0000000000517000-memory.dmp

Filesize
1.1MB

Download
memory/2180-23-0x0000000000400000-0x0000000000517000-memory.dmp

Filesize
1.1MB

Download
memory/2180-24-0x00000000026C0000-0x00000000027D7000-memory.dmp

Filesize
1.1MB

Download
memory/2600-16-0x0000000000400000-0x0000000000517000-memory.dmp

Filesize
1.1MB

Download
memory/2600-26-0x0000000000400000-0x0000000000517000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing