Analysis
-
max time kernel
144s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
01-10-2023 21:26
General
-
Target
2023-08-26_f5bde7dc4c139488d3dd8434e92a5cc4_mafia_JC.exe
-
Size
96KB
-
MD5
f5bde7dc4c139488d3dd8434e92a5cc4
-
SHA1
7b682d6607e2a11a88d34e4ad141e4135bdde589
-
SHA256
0373e6b54ee6a2016973e3764af817b19b3aa9cb97e77845c86227eb215b4e72
-
SHA512
de8e99335e1459374838baff9d0af4ed3b7a425813de9e4649d613b4165f96d374ebd5db340a3dcadab3bd8a197806146aee26527dc16030534a2c0f4da8dfa0
-
SSDEEP
1536:J0FfM5+DncE24ujIds67Ef+TTd014UQcqYs3sbTP:WFfM4D1/2+W14UQcqYs
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload 1 IoCs
-
Downloads MZ/PE file
-
ACProtect 1.3x - 1.4x DLL software 3 IoCs
Detects file using ACProtect software.
-
ASPack v2.12-2.42 3 IoCs
Detects executables packed with ASPack v2.12-2.42
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2023-08-26_f5bde7dc4c139488d3dd8434e92a5cc4_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\2023-08-26_f5bde7dc4c139488d3dd8434e92a5cc4_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\Documents\Admin558\Adam.exeC:\Users\Public\Documents\Admin558\Adam.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Public\Documents\Admin558\Thun.exeC:\Users\Public\Documents\Admin558\Thun.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
169KB
MD5928969d2a2dbb58479ae2236ac328d22
SHA1e4d9631a343d73b1ee0d7e4db55978ce59dee1d6
SHA256709776daeb0a8aac58b530e9fa0ff61afd4ffad1677c3b46ac7b375ccb1f2c4a
SHA51262a25aa6ac3383142ab3fdc3462c296ec60f8255173b21443a83b87151c2ce931cf0dd2fb6868f783f13fba8ad3c283d53250e61ebc172f80a0ef47bdcbaae9c
-
Filesize
169KB
MD5928969d2a2dbb58479ae2236ac328d22
SHA1e4d9631a343d73b1ee0d7e4db55978ce59dee1d6
SHA256709776daeb0a8aac58b530e9fa0ff61afd4ffad1677c3b46ac7b375ccb1f2c4a
SHA51262a25aa6ac3383142ab3fdc3462c296ec60f8255173b21443a83b87151c2ce931cf0dd2fb6868f783f13fba8ad3c283d53250e61ebc172f80a0ef47bdcbaae9c
-
Filesize
169KB
MD5928969d2a2dbb58479ae2236ac328d22
SHA1e4d9631a343d73b1ee0d7e4db55978ce59dee1d6
SHA256709776daeb0a8aac58b530e9fa0ff61afd4ffad1677c3b46ac7b375ccb1f2c4a
SHA51262a25aa6ac3383142ab3fdc3462c296ec60f8255173b21443a83b87151c2ce931cf0dd2fb6868f783f13fba8ad3c283d53250e61ebc172f80a0ef47bdcbaae9c
-
Filesize
1.1MB
MD57c4bfda1e4dfa3a7c59aaeb7fee08c80
SHA17ac76bcf4a74ab57aeb62aa59531f8aad14c6c77
SHA256781609c3f08ad116aa2c342e277c4899ae760e08e6c1593f95b6aa3cf6f5b109
SHA512bd189c981a1a25c782f4c12dc00a9009a4819a33ee9eacb6c1ba30b1d656965c86099bd0beb66f1ea8cfc0bf5e7a5ddfc370b1a0fd0f69381f216e05d437d68a
-
Filesize
1.1MB
MD57c4bfda1e4dfa3a7c59aaeb7fee08c80
SHA17ac76bcf4a74ab57aeb62aa59531f8aad14c6c77
SHA256781609c3f08ad116aa2c342e277c4899ae760e08e6c1593f95b6aa3cf6f5b109
SHA512bd189c981a1a25c782f4c12dc00a9009a4819a33ee9eacb6c1ba30b1d656965c86099bd0beb66f1ea8cfc0bf5e7a5ddfc370b1a0fd0f69381f216e05d437d68a
-
Filesize
1.1MB
MD57c4bfda1e4dfa3a7c59aaeb7fee08c80
SHA17ac76bcf4a74ab57aeb62aa59531f8aad14c6c77
SHA256781609c3f08ad116aa2c342e277c4899ae760e08e6c1593f95b6aa3cf6f5b109
SHA512bd189c981a1a25c782f4c12dc00a9009a4819a33ee9eacb6c1ba30b1d656965c86099bd0beb66f1ea8cfc0bf5e7a5ddfc370b1a0fd0f69381f216e05d437d68a
-
Filesize
1.1MB
MD561967681c21ab3403d35469c1639d2ca
SHA15c5f5090e2033e03346a50ad0cc2f72670667bbf
SHA2561e4855f383a002839707711cd77b9700074ad3f71037443eb574ffac8af472a2
SHA5121f70aa3bdf398b05f396d748f8dd1e99212e5bfa779753756e4c4f9dfd0547bc24d2606b6a3e9007b12e044946a7468f79cb4599990140b1bfa4d4f045a0d444
-
Filesize
74KB
MD5745f4b12f1eaa9e8e31628ba57a8b024
SHA10da99c3df50aa2f4f89a7a53b985791101a589aa
SHA256c9bd8c6693239dbed5f1aa5f54b1f08f031ce9538a5839c4aa1b0ad28fb695d8
SHA5124297053a57914dfe03bf827039b5c7f88e858717ac4d3a739a45af36d68370ccaba46577e53e35a32ff3550babc4d5ec919661643da5dba82191dc2bbcd5a69c
-
Filesize
74KB
MD5745f4b12f1eaa9e8e31628ba57a8b024
SHA10da99c3df50aa2f4f89a7a53b985791101a589aa
SHA256c9bd8c6693239dbed5f1aa5f54b1f08f031ce9538a5839c4aa1b0ad28fb695d8
SHA5124297053a57914dfe03bf827039b5c7f88e858717ac4d3a739a45af36d68370ccaba46577e53e35a32ff3550babc4d5ec919661643da5dba82191dc2bbcd5a69c
-
Filesize
74KB
MD5745f4b12f1eaa9e8e31628ba57a8b024
SHA10da99c3df50aa2f4f89a7a53b985791101a589aa
SHA256c9bd8c6693239dbed5f1aa5f54b1f08f031ce9538a5839c4aa1b0ad28fb695d8
SHA5124297053a57914dfe03bf827039b5c7f88e858717ac4d3a739a45af36d68370ccaba46577e53e35a32ff3550babc4d5ec919661643da5dba82191dc2bbcd5a69c
-
Filesize
212KB
-
Filesize
124KB
-
Filesize
4KB
-
Filesize
224KB
-
Filesize
196KB
-
Filesize
168KB
-
Filesize
124KB
-
Filesize
212KB
-
Filesize
124KB
-
Filesize
352KB
-
Filesize
352KB
-
Filesize
352KB
-
Filesize
352KB