Analysis
-
max time kernel
142s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
18-09-2023 19:02
General
-
Target
JC_e98cf15289ad0137131d86c506cff333ad1aab013cd50a62489340e100bdb7b1.exe
-
Size
1.1MB
-
MD5
6c67d224cc9b69163ee6ebb135cc9f9a
-
SHA1
aece4bd142d5ad533fac6bf8e0279a93d56b6527
-
SHA256
e98cf15289ad0137131d86c506cff333ad1aab013cd50a62489340e100bdb7b1
-
SHA512
343c671b282e4b75a83d2755323c6e7f78b34a5a5bf8607d1ec478102f3a9cf3a945ae321f4aec29be4edd95ba6366556f4358882f4420a821b758f4206959f8
-
SSDEEP
12288:Xx/etSB4CrDhrsykLlTvxAorztLAGllSZNWWne:sSB4oDKLjG1e
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload 5 IoCs
-
Executes dropped EXE 2 IoCs
-
UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Program Files directory 4 IoCs
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 12 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JC_e98cf15289ad0137131d86c506cff333ad1aab013cd50a62489340e100bdb7b1.exe"C:\Users\Admin\AppData\Local\Temp\JC_e98cf15289ad0137131d86c506cff333ad1aab013cd50a62489340e100bdb7b1.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Svwxya.exe"C:\Program Files (x86)\Svwxya.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Svwxya.exe"C:\Program Files (x86)\Svwxya.exe" Win72⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD56c67d224cc9b69163ee6ebb135cc9f9a
SHA1aece4bd142d5ad533fac6bf8e0279a93d56b6527
SHA256e98cf15289ad0137131d86c506cff333ad1aab013cd50a62489340e100bdb7b1
SHA512343c671b282e4b75a83d2755323c6e7f78b34a5a5bf8607d1ec478102f3a9cf3a945ae321f4aec29be4edd95ba6366556f4358882f4420a821b758f4206959f8
-
Filesize
1.1MB
MD56c67d224cc9b69163ee6ebb135cc9f9a
SHA1aece4bd142d5ad533fac6bf8e0279a93d56b6527
SHA256e98cf15289ad0137131d86c506cff333ad1aab013cd50a62489340e100bdb7b1
SHA512343c671b282e4b75a83d2755323c6e7f78b34a5a5bf8607d1ec478102f3a9cf3a945ae321f4aec29be4edd95ba6366556f4358882f4420a821b758f4206959f8
-
Filesize
1.1MB
MD56c67d224cc9b69163ee6ebb135cc9f9a
SHA1aece4bd142d5ad533fac6bf8e0279a93d56b6527
SHA256e98cf15289ad0137131d86c506cff333ad1aab013cd50a62489340e100bdb7b1
SHA512343c671b282e4b75a83d2755323c6e7f78b34a5a5bf8607d1ec478102f3a9cf3a945ae321f4aec29be4edd95ba6366556f4358882f4420a821b758f4206959f8
-
Filesize
1.1MB
-
Filesize
168KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
168KB
-
Filesize
1.1MB