fatalrat | b280f57cc64f24e3feefaecc3746058d393c4d16ca9ab3cdfac1ebfdb3111136

General

Target

b280f57cc64f24e3feefaecc3746058d393c4d16ca9ab3cdfac1ebfdb3111136.exe
Size

376KB
MD5

b8f957e23aa6a2e9bbd44d26618ff1fd
SHA1

4cc450bbba0caa9a78e880446500354d1ce7bb01
SHA256

b280f57cc64f24e3feefaecc3746058d393c4d16ca9ab3cdfac1ebfdb3111136
SHA512

6572d396affa2a3440cf5bb4967368fce743493871a174b3d7be4db48fd0181d61009748b01021be01132d622f245fe08ff0269465675277e4e23c313c1115d7
SSDEEP

6144:AORLKn/ocYlNMeBasmrfc2RrYZWC9sQNwhstAOWf4rE0G/saJ:A6+ANlNMeMx0MrG9fGwAOWf4rt8X

Score

10^/10

fatalrat infostealer rat upx

Malware Config

Signatures

FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
infostealer rat fatalrat

Fatal Rat payload 4 IoCs

rat infostealer

resource	yara_rule
behavioral1/memory/2480-1-0x0000000010000000-0x000000001002A000-memory.dmp	fatalrat
behavioral1/memory/2480-22-0x0000000000400000-0x0000000000517000-memory.dmp	fatalrat
behavioral1/memory/1300-23-0x0000000000400000-0x0000000000517000-memory.dmp	fatalrat
behavioral1/memory/1520-26-0x0000000000400000-0x0000000000517000-memory.dmp	fatalrat

Executes dropped EXE 2 IoCs

pid	Process
1300	Svwxya.exe
1520	Svwxya.exe

Loads dropped DLL 1 IoCs

pid	Process
1300	Svwxya.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2480-0-0x0000000000400000-0x0000000000517000-memory.dmp	upx
behavioral1/files/0x00060000000120e4-7.dat	upx
behavioral1/memory/1300-8-0x0000000000400000-0x0000000000517000-memory.dmp	upx
behavioral1/files/0x00060000000120e4-14.dat	upx
behavioral1/files/0x00060000000120e4-15.dat	upx
behavioral1/files/0x00060000000120e4-16.dat	upx
behavioral1/memory/2480-22-0x0000000000400000-0x0000000000517000-memory.dmp	upx
behavioral1/memory/1300-23-0x0000000000400000-0x0000000000517000-memory.dmp	upx
behavioral1/memory/1520-26-0x0000000000400000-0x0000000000517000-memory.dmp	upx

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Svwxya.exe	b280f57cc64f24e3feefaecc3746058d393c4d16ca9ab3cdfac1ebfdb3111136.exe
File opened for modification	C:\Program Files (x86)\Svwxya.exe	b280f57cc64f24e3feefaecc3746058d393c4d16ca9ab3cdfac1ebfdb3111136.exe
File opened for modification	C:\Program Files (x86)\Svwxya.exe	Svwxya.exe
File created	C:\Program Files (x86)\Svwxya.exe	Svwxya.exe

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Services\Stuvwx Abcdefgh	Svwxya.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM	Svwxya.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet	Svwxya.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Services	Svwxya.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Services\Stuvwx Abcdefgh\Group = "Fatal"	Svwxya.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Services\Stuvwx Abcdefgh\InstallTime = "2023-10-18 04:27"	Svwxya.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2480	b280f57cc64f24e3feefaecc3746058d393c4d16ca9ab3cdfac1ebfdb3111136.exe
Token: SeDebugPrivilege	1300	Svwxya.exe
Token: SeDebugPrivilege	1520	Svwxya.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1300 wrote to memory of 1520	1300	Svwxya.exe	29
PID 1300 wrote to memory of 1520	1300	Svwxya.exe	29
PID 1300 wrote to memory of 1520	1300	Svwxya.exe	29
PID 1300 wrote to memory of 1520	1300	Svwxya.exe	29

C:\Users\Admin\AppData\Local\Temp\b280f57cc64f24e3feefaecc3746058d393c4d16ca9ab3cdfac1ebfdb3111136.exe
"C:\Users\Admin\AppData\Local\Temp\b280f57cc64f24e3feefaecc3746058d393c4d16ca9ab3cdfac1ebfdb3111136.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2480

C:\Program Files (x86)\Svwxya.exe
"C:\Program Files (x86)\Svwxya.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1300
- C:\Program Files (x86)\Svwxya.exe
  "C:\Program Files (x86)\Svwxya.exe" Win7
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1520

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Svwxya.exe

Filesize
376KB

MD5
b8f957e23aa6a2e9bbd44d26618ff1fd

SHA1
4cc450bbba0caa9a78e880446500354d1ce7bb01

SHA256
b280f57cc64f24e3feefaecc3746058d393c4d16ca9ab3cdfac1ebfdb3111136

SHA512
6572d396affa2a3440cf5bb4967368fce743493871a174b3d7be4db48fd0181d61009748b01021be01132d622f245fe08ff0269465675277e4e23c313c1115d7

Download Submit
C:\Program Files (x86)\Svwxya.exe

Filesize
376KB

MD5
b8f957e23aa6a2e9bbd44d26618ff1fd

SHA1
4cc450bbba0caa9a78e880446500354d1ce7bb01

SHA256
b280f57cc64f24e3feefaecc3746058d393c4d16ca9ab3cdfac1ebfdb3111136

SHA512
6572d396affa2a3440cf5bb4967368fce743493871a174b3d7be4db48fd0181d61009748b01021be01132d622f245fe08ff0269465675277e4e23c313c1115d7

Download Submit
C:\Program Files (x86)\Svwxya.exe

Filesize
376KB

MD5
b8f957e23aa6a2e9bbd44d26618ff1fd

SHA1
4cc450bbba0caa9a78e880446500354d1ce7bb01

SHA256
b280f57cc64f24e3feefaecc3746058d393c4d16ca9ab3cdfac1ebfdb3111136

SHA512
6572d396affa2a3440cf5bb4967368fce743493871a174b3d7be4db48fd0181d61009748b01021be01132d622f245fe08ff0269465675277e4e23c313c1115d7

Download Submit
\Program Files (x86)\Svwxya.exe

Filesize
376KB

MD5
b8f957e23aa6a2e9bbd44d26618ff1fd

SHA1
4cc450bbba0caa9a78e880446500354d1ce7bb01

SHA256
b280f57cc64f24e3feefaecc3746058d393c4d16ca9ab3cdfac1ebfdb3111136

SHA512
6572d396affa2a3440cf5bb4967368fce743493871a174b3d7be4db48fd0181d61009748b01021be01132d622f245fe08ff0269465675277e4e23c313c1115d7

Download Submit
memory/1300-8-0x0000000000400000-0x0000000000517000-memory.dmp

Filesize
1.1MB

Download
memory/1300-23-0x0000000000400000-0x0000000000517000-memory.dmp

Filesize
1.1MB

Download
memory/1300-24-0x00000000025B0000-0x00000000026C7000-memory.dmp

Filesize
1.1MB

Download
memory/1520-26-0x0000000000400000-0x0000000000517000-memory.dmp

Filesize
1.1MB

Download
memory/2480-0-0x0000000000400000-0x0000000000517000-memory.dmp

Filesize
1.1MB

Download
memory/2480-1-0x0000000010000000-0x000000001002A000-memory.dmp

Filesize
168KB

Download
memory/2480-22-0x0000000000400000-0x0000000000517000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing