fatalrat | b280f57cc64f24e3feefaecc3746058d393c4d16ca9ab3cdfac1ebfdb3111136

General

Target

b280f57cc64f24e3feefaecc3746058d393c4d16ca9ab3cdfac1ebfdb3111136.exe
Size

376KB
MD5

b8f957e23aa6a2e9bbd44d26618ff1fd
SHA1

4cc450bbba0caa9a78e880446500354d1ce7bb01
SHA256

b280f57cc64f24e3feefaecc3746058d393c4d16ca9ab3cdfac1ebfdb3111136
SHA512

6572d396affa2a3440cf5bb4967368fce743493871a174b3d7be4db48fd0181d61009748b01021be01132d622f245fe08ff0269465675277e4e23c313c1115d7
SSDEEP

6144:AORLKn/ocYlNMeBasmrfc2RrYZWC9sQNwhstAOWf4rE0G/saJ:A6+ANlNMeMx0MrG9fGwAOWf4rt8X

Score

10^/10

fatalrat infostealer rat upx

Malware Config

Signatures

FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
infostealer rat fatalrat

Fatal Rat payload 5 IoCs

rat infostealer

resource	yara_rule
behavioral2/memory/4688-1-0x0000000010000000-0x000000001002A000-memory.dmp	fatalrat
behavioral2/memory/840-9-0x0000000010000000-0x000000001002A000-memory.dmp	fatalrat
behavioral2/memory/4688-20-0x0000000000400000-0x0000000000517000-memory.dmp	fatalrat
behavioral2/memory/840-21-0x0000000000400000-0x0000000000517000-memory.dmp	fatalrat
behavioral2/memory/2712-23-0x0000000000400000-0x0000000000517000-memory.dmp	fatalrat

Executes dropped EXE 2 IoCs

pid	Process
840	Svwxya.exe
2712	Svwxya.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4688-0-0x0000000000400000-0x0000000000517000-memory.dmp	upx
behavioral2/files/0x000800000002320e-7.dat	upx
behavioral2/files/0x000800000002320e-8.dat	upx
behavioral2/files/0x000800000002320e-14.dat	upx
behavioral2/memory/4688-20-0x0000000000400000-0x0000000000517000-memory.dmp	upx
behavioral2/memory/840-21-0x0000000000400000-0x0000000000517000-memory.dmp	upx
behavioral2/memory/2712-23-0x0000000000400000-0x0000000000517000-memory.dmp	upx

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Svwxya.exe	b280f57cc64f24e3feefaecc3746058d393c4d16ca9ab3cdfac1ebfdb3111136.exe
File opened for modification	C:\Program Files (x86)\Svwxya.exe	b280f57cc64f24e3feefaecc3746058d393c4d16ca9ab3cdfac1ebfdb3111136.exe
File opened for modification	C:\Program Files (x86)\Svwxya.exe	Svwxya.exe
File created	C:\Program Files (x86)\Svwxya.exe	Svwxya.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet	Svwxya.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Services	Svwxya.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Services\Stuvwx Abcdefgh	Svwxya.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Services\Stuvwx Abcdefgh\Group = "Fatal"	Svwxya.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Services\Stuvwx Abcdefgh\InstallTime = "2023-10-18 04:28"	Svwxya.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Services\Stuvwx Abcdefgh	Svwxya.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM	Svwxya.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4688	b280f57cc64f24e3feefaecc3746058d393c4d16ca9ab3cdfac1ebfdb3111136.exe
Token: SeDebugPrivilege	840	Svwxya.exe
Token: SeDebugPrivilege	2712	Svwxya.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 840 wrote to memory of 2712	840	Svwxya.exe	84
PID 840 wrote to memory of 2712	840	Svwxya.exe	84
PID 840 wrote to memory of 2712	840	Svwxya.exe	84

C:\Users\Admin\AppData\Local\Temp\b280f57cc64f24e3feefaecc3746058d393c4d16ca9ab3cdfac1ebfdb3111136.exe
"C:\Users\Admin\AppData\Local\Temp\b280f57cc64f24e3feefaecc3746058d393c4d16ca9ab3cdfac1ebfdb3111136.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4688

C:\Program Files (x86)\Svwxya.exe
"C:\Program Files (x86)\Svwxya.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:840
- C:\Program Files (x86)\Svwxya.exe
  "C:\Program Files (x86)\Svwxya.exe" Win7
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2712

Network

DNS

2.136.104.51.in-addr.arpa

Remote address:

8.8.8.8:53

Request

2.136.104.51.in-addr.arpa

IN PTR

Response
DNS

67.31.126.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

67.31.126.40.in-addr.arpa

IN PTR

Response
DNS

108.211.229.192.in-addr.arpa

Remote address:

8.8.8.8:53

Request

108.211.229.192.in-addr.arpa

IN PTR

Response
DNS

59.128.231.4.in-addr.arpa

Remote address:

8.8.8.8:53

Request

59.128.231.4.in-addr.arpa

IN PTR

Response
DNS

50.23.12.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

50.23.12.20.in-addr.arpa

IN PTR

Response
DNS

15.164.165.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

15.164.165.52.in-addr.arpa

IN PTR

Response
DNS

126.24.238.8.in-addr.arpa

Remote address:

8.8.8.8:53

Request

126.24.238.8.in-addr.arpa

IN PTR

Response
DNS

25.73.42.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

25.73.42.20.in-addr.arpa

IN PTR

Response

202.95.14.6:8081

Svwxya.exe

260 B
5
202.95.14.6:8081

Svwxya.exe

260 B
5
202.95.14.6:8081

Svwxya.exe

260 B
5
202.95.14.6:8081

Svwxya.exe

260 B
5
202.95.14.6:8081

Svwxya.exe

208 B
4

8.8.8.8:53

2.136.104.51.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

2.136.104.51.in-addr.arpa
8.8.8.8:53

67.31.126.40.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

67.31.126.40.in-addr.arpa
8.8.8.8:53

108.211.229.192.in-addr.arpa

dns

74 B
145 B
1
1

DNS Request

108.211.229.192.in-addr.arpa
8.8.8.8:53

59.128.231.4.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

59.128.231.4.in-addr.arpa
8.8.8.8:53

50.23.12.20.in-addr.arpa

dns

70 B
156 B
1
1

DNS Request

50.23.12.20.in-addr.arpa
8.8.8.8:53

15.164.165.52.in-addr.arpa

dns

72 B
146 B
1
1

DNS Request

15.164.165.52.in-addr.arpa
8.8.8.8:53

126.24.238.8.in-addr.arpa

dns

71 B
125 B
1
1

DNS Request

126.24.238.8.in-addr.arpa
8.8.8.8:53

25.73.42.20.in-addr.arpa

dns

70 B
156 B
1
1

DNS Request

25.73.42.20.in-addr.arpa

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Svwxya.exe

Filesize
376KB

MD5
b8f957e23aa6a2e9bbd44d26618ff1fd

SHA1
4cc450bbba0caa9a78e880446500354d1ce7bb01

SHA256
b280f57cc64f24e3feefaecc3746058d393c4d16ca9ab3cdfac1ebfdb3111136

SHA512
6572d396affa2a3440cf5bb4967368fce743493871a174b3d7be4db48fd0181d61009748b01021be01132d622f245fe08ff0269465675277e4e23c313c1115d7

Download Submit
C:\Program Files (x86)\Svwxya.exe

Filesize
376KB

MD5
b8f957e23aa6a2e9bbd44d26618ff1fd

SHA1
4cc450bbba0caa9a78e880446500354d1ce7bb01

SHA256
b280f57cc64f24e3feefaecc3746058d393c4d16ca9ab3cdfac1ebfdb3111136

SHA512
6572d396affa2a3440cf5bb4967368fce743493871a174b3d7be4db48fd0181d61009748b01021be01132d622f245fe08ff0269465675277e4e23c313c1115d7

Download Submit
C:\Program Files (x86)\Svwxya.exe

Filesize
376KB

MD5
b8f957e23aa6a2e9bbd44d26618ff1fd

SHA1
4cc450bbba0caa9a78e880446500354d1ce7bb01

SHA256
b280f57cc64f24e3feefaecc3746058d393c4d16ca9ab3cdfac1ebfdb3111136

SHA512
6572d396affa2a3440cf5bb4967368fce743493871a174b3d7be4db48fd0181d61009748b01021be01132d622f245fe08ff0269465675277e4e23c313c1115d7

Download Submit
memory/840-9-0x0000000010000000-0x000000001002A000-memory.dmp

Filesize
168KB

Download
memory/840-21-0x0000000000400000-0x0000000000517000-memory.dmp

Filesize
1.1MB

Download
memory/2712-23-0x0000000000400000-0x0000000000517000-memory.dmp

Filesize
1.1MB

Download
memory/4688-0-0x0000000000400000-0x0000000000517000-memory.dmp

Filesize
1.1MB

Download
memory/4688-1-0x0000000010000000-0x000000001002A000-memory.dmp

Filesize
168KB

Download
memory/4688-20-0x0000000000400000-0x0000000000517000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.