fatalrat | 3c4fed4d32c4a23562e70d8408140a0706342682e7769a89bb49a2d84f5482e1

General

Target

3c4fed4d32c4a23562e70d8408140a0706342682e7769a89bb49a2d84f5482e1.exe
Size

250KB
MD5

2acae995c467fa7dcca1824fe0b7cc51
SHA1

68f5813e3e77e43a56755906bf021a319b06c945
SHA256

3c4fed4d32c4a23562e70d8408140a0706342682e7769a89bb49a2d84f5482e1
SHA512

f8ad29436f85015ee6b9db655c8d341b587fae088352a2707f0289e0f6667161753a2a5ba24483eb5618aa9a7732c95b2114bcdc6a308beae8d3f4cb5a171e15
SSDEEP

6144:0F5fd4mw5FFUSd+pIR6byxMGPxF/WAV54XQ:0FpCmwJUtpIEbyGGPxuXQ

Score

10^/10

fatalrat infostealer rat upx

Malware Config

Signatures

FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
infostealer rat fatalrat

Fatal Rat payload 4 IoCs

rat infostealer

resource	yara_rule
behavioral1/memory/1412-1-0x0000000010000000-0x000000001002A000-memory.dmp	fatalrat
behavioral1/memory/1412-23-0x0000000000400000-0x00000000004A8000-memory.dmp	fatalrat
behavioral1/memory/1684-24-0x0000000000400000-0x00000000004A8000-memory.dmp	fatalrat
behavioral1/memory/3052-26-0x0000000000400000-0x00000000004A8000-memory.dmp	fatalrat

Executes dropped EXE 2 IoCs

pid	Process
1684	Jklmno.exe
3052	Jklmno.exe

Loads dropped DLL 1 IoCs

pid	Process
1684	Jklmno.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1412-0-0x0000000000400000-0x00000000004A8000-memory.dmp	upx
behavioral1/files/0x00060000000120e6-7.dat	upx
behavioral1/files/0x00060000000120e6-14.dat	upx
behavioral1/memory/3052-17-0x0000000000400000-0x00000000004A8000-memory.dmp	upx
behavioral1/files/0x00060000000120e6-16.dat	upx
behavioral1/files/0x00060000000120e6-13.dat	upx
behavioral1/memory/1412-23-0x0000000000400000-0x00000000004A8000-memory.dmp	upx
behavioral1/memory/1684-24-0x0000000000400000-0x00000000004A8000-memory.dmp	upx
behavioral1/memory/3052-26-0x0000000000400000-0x00000000004A8000-memory.dmp	upx

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Jklmno.exe	3c4fed4d32c4a23562e70d8408140a0706342682e7769a89bb49a2d84f5482e1.exe
File opened for modification	C:\Windows\SysWOW64\Jklmno.exe	Jklmno.exe
File created	C:\Windows\SysWOW64\Jklmno.exe	Jklmno.exe
File created	C:\Windows\SysWOW64\Jklmno.exe	3c4fed4d32c4a23562e70d8408140a0706342682e7769a89bb49a2d84f5482e1.exe

Modifies data under HKEY_USERS 16 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System	Jklmno.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Services\Jklmno Qrstuvwx	Jklmno.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM	Jklmno.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Services	Jklmno.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Services\Jklmno Qrstuvwx\Group = "Fatal"	Jklmno.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	Jklmno.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies	Jklmno.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Services\Jklmno Qrstuvwx\InstallTime = "2023-10-26 10:22"	Jklmno.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion	Jklmno.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet	Jklmno.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableLockWorkstation = "1"	Jklmno.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System	Jklmno.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows	Jklmno.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableLockWorkstation = "1"	Jklmno.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	Jklmno.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	Jklmno.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1412	3c4fed4d32c4a23562e70d8408140a0706342682e7769a89bb49a2d84f5482e1.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1412	3c4fed4d32c4a23562e70d8408140a0706342682e7769a89bb49a2d84f5482e1.exe
Token: SeDebugPrivilege	1684	Jklmno.exe
Token: SeDebugPrivilege	3052	Jklmno.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 3052	1684	Jklmno.exe	29
PID 1684 wrote to memory of 3052	1684	Jklmno.exe	29
PID 1684 wrote to memory of 3052	1684	Jklmno.exe	29
PID 1684 wrote to memory of 3052	1684	Jklmno.exe	29

C:\Users\Admin\AppData\Local\Temp\3c4fed4d32c4a23562e70d8408140a0706342682e7769a89bb49a2d84f5482e1.exe
"C:\Users\Admin\AppData\Local\Temp\3c4fed4d32c4a23562e70d8408140a0706342682e7769a89bb49a2d84f5482e1.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:1412

C:\Windows\SysWOW64\Jklmno.exe
C:\Windows\SysWOW64\Jklmno.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\SysWOW64\Jklmno.exe
  C:\Windows\SysWOW64\Jklmno.exe Win7
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3052

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Jklmno.exe

Filesize
250KB

MD5
2acae995c467fa7dcca1824fe0b7cc51

SHA1
68f5813e3e77e43a56755906bf021a319b06c945

SHA256
3c4fed4d32c4a23562e70d8408140a0706342682e7769a89bb49a2d84f5482e1

SHA512
f8ad29436f85015ee6b9db655c8d341b587fae088352a2707f0289e0f6667161753a2a5ba24483eb5618aa9a7732c95b2114bcdc6a308beae8d3f4cb5a171e15

Download Submit
C:\Windows\SysWOW64\Jklmno.exe

Filesize
250KB

MD5
2acae995c467fa7dcca1824fe0b7cc51

SHA1
68f5813e3e77e43a56755906bf021a319b06c945

SHA256
3c4fed4d32c4a23562e70d8408140a0706342682e7769a89bb49a2d84f5482e1

SHA512
f8ad29436f85015ee6b9db655c8d341b587fae088352a2707f0289e0f6667161753a2a5ba24483eb5618aa9a7732c95b2114bcdc6a308beae8d3f4cb5a171e15

Download Submit
C:\Windows\SysWOW64\Jklmno.exe

Filesize
250KB

MD5
2acae995c467fa7dcca1824fe0b7cc51

SHA1
68f5813e3e77e43a56755906bf021a319b06c945

SHA256
3c4fed4d32c4a23562e70d8408140a0706342682e7769a89bb49a2d84f5482e1

SHA512
f8ad29436f85015ee6b9db655c8d341b587fae088352a2707f0289e0f6667161753a2a5ba24483eb5618aa9a7732c95b2114bcdc6a308beae8d3f4cb5a171e15

Download Submit
\Windows\SysWOW64\Jklmno.exe

Filesize
250KB

MD5
2acae995c467fa7dcca1824fe0b7cc51

SHA1
68f5813e3e77e43a56755906bf021a319b06c945

SHA256
3c4fed4d32c4a23562e70d8408140a0706342682e7769a89bb49a2d84f5482e1

SHA512
f8ad29436f85015ee6b9db655c8d341b587fae088352a2707f0289e0f6667161753a2a5ba24483eb5618aa9a7732c95b2114bcdc6a308beae8d3f4cb5a171e15

Download Submit
memory/1412-0-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/1412-1-0x0000000010000000-0x000000001002A000-memory.dmp

Filesize
168KB

Download
memory/1412-23-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/1684-15-0x0000000002A10000-0x0000000002AB8000-memory.dmp

Filesize
672KB

Download
memory/1684-24-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/3052-17-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/3052-26-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download

Analysis

Sharing