Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
22-10-2023 11:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7225a15c6afbbaf5476f3289f6b161fc543c4b981d72997ca182ae830bbde318.exe
Resource
win7-20231020-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
7225a15c6afbbaf5476f3289f6b161fc543c4b981d72997ca182ae830bbde318.exe
Resource
win10v2004-20231020-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
7225a15c6afbbaf5476f3289f6b161fc543c4b981d72997ca182ae830bbde318.exe
-
Size
2.1MB
-
MD5
724c2a51739b5aba9cffb7e1358b5af3
-
SHA1
b9e86b7126279b617d0ce6bd84772033b953ef5f
-
SHA256
7225a15c6afbbaf5476f3289f6b161fc543c4b981d72997ca182ae830bbde318
-
SHA512
f289f2a6b8b72d2a8f2ae03d00793f489b17254dcc9dbb11a59971991f188bcb87467b6b996e56a18f697ae46f326fe953125b42a53176c2581f2b0d453f890d
-
SSDEEP
49152:tVef8NffIPbIQ09ufo9m8QCFwyL5FfJel7x1g82T9NlJbGP/m:tVQUIjo9FWIZJerl2+P/m
Score
10/10
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload 5 IoCs
resource yara_rule behavioral2/memory/3240-13076-0x0000000010000000-0x000000001002A000-memory.dmp fatalrat behavioral2/memory/3240-14791-0x0000000000400000-0x000000000081F000-memory.dmp fatalrat behavioral2/memory/4756-32255-0x0000000000400000-0x000000000081F000-memory.dmp fatalrat behavioral2/memory/2212-39260-0x0000000000400000-0x000000000081F000-memory.dmp fatalrat behavioral2/memory/3240-39266-0x0000000000400000-0x000000000081F000-memory.dmp fatalrat -
Executes dropped EXE 2 IoCs
pid Process 4756 BitBrowser.exe 2212 BitBrowser.exe -
Drops file in System32 directory 13 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\getip[1].htm BitBrowser.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CF14D1855652602540DFCFECD21854DB_BF731B9C0C82CCD069EEBB7C6DE19E59 BitBrowser.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies BitBrowser.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE BitBrowser.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 BitBrowser.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CF14D1855652602540DFCFECD21854DB_BF731B9C0C82CCD069EEBB7C6DE19E59 BitBrowser.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 BitBrowser.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache BitBrowser.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content BitBrowser.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft BitBrowser.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_786387CC77858B88BA3234B304062475 BitBrowser.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_786387CC77858B88BA3234B304062475 BitBrowser.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData BitBrowser.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
pid Process 3240 7225a15c6afbbaf5476f3289f6b161fc543c4b981d72997ca182ae830bbde318.exe 3240 7225a15c6afbbaf5476f3289f6b161fc543c4b981d72997ca182ae830bbde318.exe 3240 7225a15c6afbbaf5476f3289f6b161fc543c4b981d72997ca182ae830bbde318.exe 3240 7225a15c6afbbaf5476f3289f6b161fc543c4b981d72997ca182ae830bbde318.exe 3240 7225a15c6afbbaf5476f3289f6b161fc543c4b981d72997ca182ae830bbde318.exe 4756 BitBrowser.exe 4756 BitBrowser.exe 3240 7225a15c6afbbaf5476f3289f6b161fc543c4b981d72997ca182ae830bbde318.exe 4756 BitBrowser.exe 3240 7225a15c6afbbaf5476f3289f6b161fc543c4b981d72997ca182ae830bbde318.exe 4756 BitBrowser.exe 3240 7225a15c6afbbaf5476f3289f6b161fc543c4b981d72997ca182ae830bbde318.exe 4756 BitBrowser.exe 3240 7225a15c6afbbaf5476f3289f6b161fc543c4b981d72997ca182ae830bbde318.exe 2212 BitBrowser.exe 2212 BitBrowser.exe 4756 BitBrowser.exe 3240 7225a15c6afbbaf5476f3289f6b161fc543c4b981d72997ca182ae830bbde318.exe 2212 BitBrowser.exe 4756 BitBrowser.exe 3240 7225a15c6afbbaf5476f3289f6b161fc543c4b981d72997ca182ae830bbde318.exe 2212 BitBrowser.exe 4756 BitBrowser.exe 3240 7225a15c6afbbaf5476f3289f6b161fc543c4b981d72997ca182ae830bbde318.exe 2212 BitBrowser.exe 4756 BitBrowser.exe 3240 7225a15c6afbbaf5476f3289f6b161fc543c4b981d72997ca182ae830bbde318.exe 2212 BitBrowser.exe 4756 BitBrowser.exe 3240 7225a15c6afbbaf5476f3289f6b161fc543c4b981d72997ca182ae830bbde318.exe 2212 BitBrowser.exe 4756 BitBrowser.exe 3240 7225a15c6afbbaf5476f3289f6b161fc543c4b981d72997ca182ae830bbde318.exe 2212 BitBrowser.exe 4756 BitBrowser.exe 3240 7225a15c6afbbaf5476f3289f6b161fc543c4b981d72997ca182ae830bbde318.exe 2212 BitBrowser.exe 4756 BitBrowser.exe 3240 7225a15c6afbbaf5476f3289f6b161fc543c4b981d72997ca182ae830bbde318.exe 2212 BitBrowser.exe 4756 BitBrowser.exe 3240 7225a15c6afbbaf5476f3289f6b161fc543c4b981d72997ca182ae830bbde318.exe 2212 BitBrowser.exe 4756 BitBrowser.exe 3240 7225a15c6afbbaf5476f3289f6b161fc543c4b981d72997ca182ae830bbde318.exe 2212 BitBrowser.exe 4756 BitBrowser.exe 3240 7225a15c6afbbaf5476f3289f6b161fc543c4b981d72997ca182ae830bbde318.exe 2212 BitBrowser.exe 4756 BitBrowser.exe 3240 7225a15c6afbbaf5476f3289f6b161fc543c4b981d72997ca182ae830bbde318.exe 2212 BitBrowser.exe 4756 BitBrowser.exe 3240 7225a15c6afbbaf5476f3289f6b161fc543c4b981d72997ca182ae830bbde318.exe 2212 BitBrowser.exe 4756 BitBrowser.exe 3240 7225a15c6afbbaf5476f3289f6b161fc543c4b981d72997ca182ae830bbde318.exe 2212 BitBrowser.exe 4756 BitBrowser.exe 3240 7225a15c6afbbaf5476f3289f6b161fc543c4b981d72997ca182ae830bbde318.exe 2212 BitBrowser.exe 4756 BitBrowser.exe 3240 7225a15c6afbbaf5476f3289f6b161fc543c4b981d72997ca182ae830bbde318.exe 2212 BitBrowser.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File created C:\Program Files (x86)\BitBrowser.exe 7225a15c6afbbaf5476f3289f6b161fc543c4b981d72997ca182ae830bbde318.exe File opened for modification C:\Program Files (x86)\BitBrowser.exe 7225a15c6afbbaf5476f3289f6b161fc543c4b981d72997ca182ae830bbde318.exe File opened for modification C:\Program Files (x86)\BitBrowser.exe BitBrowser.exe File created C:\Program Files (x86)\BitBrowser.exe BitBrowser.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 BitBrowser.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz BitBrowser.exe -
Modifies data under HKEY_USERS 30 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Services\BitBrowser BitBrowser.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" BitBrowser.exe Key created \REGISTRY\USER\.DEFAULT\Software BitBrowser.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows BitBrowser.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion BitBrowser.exe Set value (str) \REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Services\BitBrowser\Group = "Fatal" BitBrowser.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" BitBrowser.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix BitBrowser.exe Key created \REGISTRY\USER\.DEFAULT\Software BitBrowser.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" BitBrowser.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" BitBrowser.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie BitBrowser.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System BitBrowser.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ BitBrowser.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing BitBrowser.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies BitBrowser.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System BitBrowser.exe Key created \REGISTRY\USER\.DEFAULT\System\CurrentControlSet BitBrowser.exe Key created \REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Services BitBrowser.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableLockWorkstation = "1" BitBrowser.exe Key created \REGISTRY\USER\.DEFAULT\SYSTEM BitBrowser.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" BitBrowser.exe Key created \REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Services\BitBrowser BitBrowser.exe Set value (str) \REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Services\BitBrowser\InstallTime = "2023-10-22 11:44" BitBrowser.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" BitBrowser.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft BitBrowser.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableLockWorkstation = "1" BitBrowser.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum BitBrowser.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft BitBrowser.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum\Version = "7" BitBrowser.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2212 BitBrowser.exe 2212 BitBrowser.exe 2212 BitBrowser.exe 2212 BitBrowser.exe 2212 BitBrowser.exe 2212 BitBrowser.exe 2212 BitBrowser.exe 2212 BitBrowser.exe 2212 BitBrowser.exe 2212 BitBrowser.exe 2212 BitBrowser.exe 2212 BitBrowser.exe 2212 BitBrowser.exe 2212 BitBrowser.exe 2212 BitBrowser.exe 2212 BitBrowser.exe 2212 BitBrowser.exe 2212 BitBrowser.exe 2212 BitBrowser.exe 2212 BitBrowser.exe 2212 BitBrowser.exe 2212 BitBrowser.exe 2212 BitBrowser.exe 2212 BitBrowser.exe 2212 BitBrowser.exe 2212 BitBrowser.exe 2212 BitBrowser.exe 2212 BitBrowser.exe 2212 BitBrowser.exe 2212 BitBrowser.exe 2212 BitBrowser.exe 2212 BitBrowser.exe 2212 BitBrowser.exe 2212 BitBrowser.exe 2212 BitBrowser.exe 2212 BitBrowser.exe 2212 BitBrowser.exe 2212 BitBrowser.exe 2212 BitBrowser.exe 2212 BitBrowser.exe 2212 BitBrowser.exe 2212 BitBrowser.exe 2212 BitBrowser.exe 2212 BitBrowser.exe 2212 BitBrowser.exe 2212 BitBrowser.exe 2212 BitBrowser.exe 2212 BitBrowser.exe 2212 BitBrowser.exe 2212 BitBrowser.exe 2212 BitBrowser.exe 2212 BitBrowser.exe 2212 BitBrowser.exe 2212 BitBrowser.exe 2212 BitBrowser.exe 2212 BitBrowser.exe 2212 BitBrowser.exe 2212 BitBrowser.exe 2212 BitBrowser.exe 2212 BitBrowser.exe 2212 BitBrowser.exe 2212 BitBrowser.exe 2212 BitBrowser.exe 2212 BitBrowser.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 3240 7225a15c6afbbaf5476f3289f6b161fc543c4b981d72997ca182ae830bbde318.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 3240 7225a15c6afbbaf5476f3289f6b161fc543c4b981d72997ca182ae830bbde318.exe Token: SeDebugPrivilege 4756 BitBrowser.exe Token: SeDebugPrivilege 2212 BitBrowser.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4756 wrote to memory of 2212 4756 BitBrowser.exe 93 PID 4756 wrote to memory of 2212 4756 BitBrowser.exe 93 PID 4756 wrote to memory of 2212 4756 BitBrowser.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\7225a15c6afbbaf5476f3289f6b161fc543c4b981d72997ca182ae830bbde318.exe"C:\Users\Admin\AppData\Local\Temp\7225a15c6afbbaf5476f3289f6b161fc543c4b981d72997ca182ae830bbde318.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:3240
-
C:\Program Files (x86)\BitBrowser.exe"C:\Program Files (x86)\BitBrowser.exe"1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Program Files (x86)\BitBrowser.exe"C:\Program Files (x86)\BitBrowser.exe" Win72⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2212
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5724c2a51739b5aba9cffb7e1358b5af3
SHA1b9e86b7126279b617d0ce6bd84772033b953ef5f
SHA2567225a15c6afbbaf5476f3289f6b161fc543c4b981d72997ca182ae830bbde318
SHA512f289f2a6b8b72d2a8f2ae03d00793f489b17254dcc9dbb11a59971991f188bcb87467b6b996e56a18f697ae46f326fe953125b42a53176c2581f2b0d453f890d
-
Filesize
2.1MB
MD5724c2a51739b5aba9cffb7e1358b5af3
SHA1b9e86b7126279b617d0ce6bd84772033b953ef5f
SHA2567225a15c6afbbaf5476f3289f6b161fc543c4b981d72997ca182ae830bbde318
SHA512f289f2a6b8b72d2a8f2ae03d00793f489b17254dcc9dbb11a59971991f188bcb87467b6b996e56a18f697ae46f326fe953125b42a53176c2581f2b0d453f890d
-
Filesize
2.1MB
MD5724c2a51739b5aba9cffb7e1358b5af3
SHA1b9e86b7126279b617d0ce6bd84772033b953ef5f
SHA2567225a15c6afbbaf5476f3289f6b161fc543c4b981d72997ca182ae830bbde318
SHA512f289f2a6b8b72d2a8f2ae03d00793f489b17254dcc9dbb11a59971991f188bcb87467b6b996e56a18f697ae46f326fe953125b42a53176c2581f2b0d453f890d