Analysis
-
max time kernel
150s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
26-10-2023 14:09
Static task
static1
Behavioral task
behavioral1
Sample
583bab667b93dd222594d5d49b3ece7a629927cfeff44b1820f77c0f09dc3303.exe
Resource
win7-20231020-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
583bab667b93dd222594d5d49b3ece7a629927cfeff44b1820f77c0f09dc3303.exe
Resource
win10v2004-20231023-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
583bab667b93dd222594d5d49b3ece7a629927cfeff44b1820f77c0f09dc3303.exe
-
Size
2.0MB
-
MD5
603a8b54656cb1e32727bdc9a6afa82a
-
SHA1
1020b8bbb67d41e765080d326b4e770ad68fb7fc
-
SHA256
583bab667b93dd222594d5d49b3ece7a629927cfeff44b1820f77c0f09dc3303
-
SHA512
9a3d12d0909aef21cc8556e6ab5c5a847fbfa726a3535fa0bba0a0355a3ce76ff8ff8d8118baf92500c4e256adf9230db87ed6081bcb1290a919e5ee415db8ca
-
SSDEEP
49152:MoxVO1wKM5P1kk/Xn47jFQSVWCiwMlU/5:MCVO1a168X4vFvcS/5
Score
10/10
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload 5 IoCs
resource yara_rule behavioral2/memory/312-13077-0x0000000010000000-0x000000001002A000-memory.dmp fatalrat behavioral2/memory/312-17425-0x0000000000400000-0x0000000000806000-memory.dmp fatalrat behavioral2/memory/312-27564-0x0000000000400000-0x0000000000806000-memory.dmp fatalrat behavioral2/memory/1932-29713-0x0000000000400000-0x0000000000806000-memory.dmp fatalrat behavioral2/memory/2044-39268-0x0000000000400000-0x0000000000806000-memory.dmp fatalrat -
Executes dropped EXE 2 IoCs
pid Process 1932 bitbrowser.exe 2044 bitbrowser.exe -
Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_786387CC77858B88BA3234B304062475 bitbrowser.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content bitbrowser.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CF14D1855652602540DFCFECD21854DB_BF731B9C0C82CCD069EEBB7C6DE19E59 bitbrowser.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE bitbrowser.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData bitbrowser.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 bitbrowser.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CF14D1855652602540DFCFECD21854DB_BF731B9C0C82CCD069EEBB7C6DE19E59 bitbrowser.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache bitbrowser.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies bitbrowser.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\getip[1].htm bitbrowser.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_786387CC77858B88BA3234B304062475 bitbrowser.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 bitbrowser.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft bitbrowser.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
pid Process 312 583bab667b93dd222594d5d49b3ece7a629927cfeff44b1820f77c0f09dc3303.exe 312 583bab667b93dd222594d5d49b3ece7a629927cfeff44b1820f77c0f09dc3303.exe 312 583bab667b93dd222594d5d49b3ece7a629927cfeff44b1820f77c0f09dc3303.exe 312 583bab667b93dd222594d5d49b3ece7a629927cfeff44b1820f77c0f09dc3303.exe 312 583bab667b93dd222594d5d49b3ece7a629927cfeff44b1820f77c0f09dc3303.exe 312 583bab667b93dd222594d5d49b3ece7a629927cfeff44b1820f77c0f09dc3303.exe 312 583bab667b93dd222594d5d49b3ece7a629927cfeff44b1820f77c0f09dc3303.exe 1932 bitbrowser.exe 1932 bitbrowser.exe 312 583bab667b93dd222594d5d49b3ece7a629927cfeff44b1820f77c0f09dc3303.exe 1932 bitbrowser.exe 312 583bab667b93dd222594d5d49b3ece7a629927cfeff44b1820f77c0f09dc3303.exe 1932 bitbrowser.exe 312 583bab667b93dd222594d5d49b3ece7a629927cfeff44b1820f77c0f09dc3303.exe 1932 bitbrowser.exe 312 583bab667b93dd222594d5d49b3ece7a629927cfeff44b1820f77c0f09dc3303.exe 1932 bitbrowser.exe 312 583bab667b93dd222594d5d49b3ece7a629927cfeff44b1820f77c0f09dc3303.exe 1932 bitbrowser.exe 312 583bab667b93dd222594d5d49b3ece7a629927cfeff44b1820f77c0f09dc3303.exe 2044 bitbrowser.exe 2044 bitbrowser.exe 1932 bitbrowser.exe 312 583bab667b93dd222594d5d49b3ece7a629927cfeff44b1820f77c0f09dc3303.exe 2044 bitbrowser.exe 1932 bitbrowser.exe 312 583bab667b93dd222594d5d49b3ece7a629927cfeff44b1820f77c0f09dc3303.exe 2044 bitbrowser.exe 1932 bitbrowser.exe 312 583bab667b93dd222594d5d49b3ece7a629927cfeff44b1820f77c0f09dc3303.exe 2044 bitbrowser.exe 1932 bitbrowser.exe 312 583bab667b93dd222594d5d49b3ece7a629927cfeff44b1820f77c0f09dc3303.exe 2044 bitbrowser.exe 1932 bitbrowser.exe 312 583bab667b93dd222594d5d49b3ece7a629927cfeff44b1820f77c0f09dc3303.exe 2044 bitbrowser.exe 1932 bitbrowser.exe 312 583bab667b93dd222594d5d49b3ece7a629927cfeff44b1820f77c0f09dc3303.exe 2044 bitbrowser.exe 1932 bitbrowser.exe 312 583bab667b93dd222594d5d49b3ece7a629927cfeff44b1820f77c0f09dc3303.exe 2044 bitbrowser.exe 1932 bitbrowser.exe 312 583bab667b93dd222594d5d49b3ece7a629927cfeff44b1820f77c0f09dc3303.exe 2044 bitbrowser.exe 1932 bitbrowser.exe 312 583bab667b93dd222594d5d49b3ece7a629927cfeff44b1820f77c0f09dc3303.exe 2044 bitbrowser.exe 1932 bitbrowser.exe 312 583bab667b93dd222594d5d49b3ece7a629927cfeff44b1820f77c0f09dc3303.exe 2044 bitbrowser.exe 1932 bitbrowser.exe 312 583bab667b93dd222594d5d49b3ece7a629927cfeff44b1820f77c0f09dc3303.exe 2044 bitbrowser.exe 1932 bitbrowser.exe 312 583bab667b93dd222594d5d49b3ece7a629927cfeff44b1820f77c0f09dc3303.exe 2044 bitbrowser.exe 1932 bitbrowser.exe 312 583bab667b93dd222594d5d49b3ece7a629927cfeff44b1820f77c0f09dc3303.exe 2044 bitbrowser.exe 1932 bitbrowser.exe 312 583bab667b93dd222594d5d49b3ece7a629927cfeff44b1820f77c0f09dc3303.exe 2044 bitbrowser.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File created C:\Program Files (x86)\bitbrowser.exe 583bab667b93dd222594d5d49b3ece7a629927cfeff44b1820f77c0f09dc3303.exe File opened for modification C:\Program Files (x86)\bitbrowser.exe 583bab667b93dd222594d5d49b3ece7a629927cfeff44b1820f77c0f09dc3303.exe File opened for modification C:\Program Files (x86)\bitbrowser.exe bitbrowser.exe File created C:\Program Files (x86)\bitbrowser.exe bitbrowser.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 bitbrowser.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz bitbrowser.exe -
Modifies data under HKEY_USERS 30 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software bitbrowser.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableLockWorkstation = "1" bitbrowser.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableLockWorkstation = "1" bitbrowser.exe Key created \REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Services bitbrowser.exe Key created \REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Services\bitbrowser bitbrowser.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix bitbrowser.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies bitbrowser.exe Key created \REGISTRY\USER\.DEFAULT\SYSTEM bitbrowser.exe Set value (str) \REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Services\bitbrowser\InstallTime = "2023-10-26 14:10" bitbrowser.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" bitbrowser.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" bitbrowser.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum bitbrowser.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft bitbrowser.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ bitbrowser.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" bitbrowser.exe Key created \REGISTRY\USER\.DEFAULT\Software bitbrowser.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System bitbrowser.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion bitbrowser.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" bitbrowser.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing bitbrowser.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum\Version = "7" bitbrowser.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows bitbrowser.exe Key created \REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Services\bitbrowser bitbrowser.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" bitbrowser.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft bitbrowser.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System bitbrowser.exe Set value (str) \REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Services\bitbrowser\Group = "Fatal" bitbrowser.exe Key created \REGISTRY\USER\.DEFAULT\System\CurrentControlSet bitbrowser.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" bitbrowser.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie bitbrowser.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2044 bitbrowser.exe 2044 bitbrowser.exe 2044 bitbrowser.exe 2044 bitbrowser.exe 2044 bitbrowser.exe 2044 bitbrowser.exe 2044 bitbrowser.exe 2044 bitbrowser.exe 2044 bitbrowser.exe 2044 bitbrowser.exe 2044 bitbrowser.exe 2044 bitbrowser.exe 2044 bitbrowser.exe 2044 bitbrowser.exe 2044 bitbrowser.exe 2044 bitbrowser.exe 2044 bitbrowser.exe 2044 bitbrowser.exe 2044 bitbrowser.exe 2044 bitbrowser.exe 2044 bitbrowser.exe 2044 bitbrowser.exe 2044 bitbrowser.exe 2044 bitbrowser.exe 2044 bitbrowser.exe 2044 bitbrowser.exe 2044 bitbrowser.exe 2044 bitbrowser.exe 2044 bitbrowser.exe 2044 bitbrowser.exe 2044 bitbrowser.exe 2044 bitbrowser.exe 2044 bitbrowser.exe 2044 bitbrowser.exe 2044 bitbrowser.exe 2044 bitbrowser.exe 2044 bitbrowser.exe 2044 bitbrowser.exe 2044 bitbrowser.exe 2044 bitbrowser.exe 2044 bitbrowser.exe 2044 bitbrowser.exe 2044 bitbrowser.exe 2044 bitbrowser.exe 2044 bitbrowser.exe 2044 bitbrowser.exe 2044 bitbrowser.exe 2044 bitbrowser.exe 2044 bitbrowser.exe 2044 bitbrowser.exe 2044 bitbrowser.exe 2044 bitbrowser.exe 2044 bitbrowser.exe 2044 bitbrowser.exe 2044 bitbrowser.exe 2044 bitbrowser.exe 2044 bitbrowser.exe 2044 bitbrowser.exe 2044 bitbrowser.exe 2044 bitbrowser.exe 2044 bitbrowser.exe 2044 bitbrowser.exe 2044 bitbrowser.exe 2044 bitbrowser.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 312 583bab667b93dd222594d5d49b3ece7a629927cfeff44b1820f77c0f09dc3303.exe Token: SeDebugPrivilege 1932 bitbrowser.exe Token: SeDebugPrivilege 2044 bitbrowser.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1932 wrote to memory of 2044 1932 bitbrowser.exe 91 PID 1932 wrote to memory of 2044 1932 bitbrowser.exe 91 PID 1932 wrote to memory of 2044 1932 bitbrowser.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\583bab667b93dd222594d5d49b3ece7a629927cfeff44b1820f77c0f09dc3303.exe"C:\Users\Admin\AppData\Local\Temp\583bab667b93dd222594d5d49b3ece7a629927cfeff44b1820f77c0f09dc3303.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:312
-
C:\Program Files (x86)\bitbrowser.exe"C:\Program Files (x86)\bitbrowser.exe"1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Program Files (x86)\bitbrowser.exe"C:\Program Files (x86)\bitbrowser.exe" Win72⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2044
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.0MB
MD5603a8b54656cb1e32727bdc9a6afa82a
SHA11020b8bbb67d41e765080d326b4e770ad68fb7fc
SHA256583bab667b93dd222594d5d49b3ece7a629927cfeff44b1820f77c0f09dc3303
SHA5129a3d12d0909aef21cc8556e6ab5c5a847fbfa726a3535fa0bba0a0355a3ce76ff8ff8d8118baf92500c4e256adf9230db87ed6081bcb1290a919e5ee415db8ca
-
Filesize
2.0MB
MD5603a8b54656cb1e32727bdc9a6afa82a
SHA11020b8bbb67d41e765080d326b4e770ad68fb7fc
SHA256583bab667b93dd222594d5d49b3ece7a629927cfeff44b1820f77c0f09dc3303
SHA5129a3d12d0909aef21cc8556e6ab5c5a847fbfa726a3535fa0bba0a0355a3ce76ff8ff8d8118baf92500c4e256adf9230db87ed6081bcb1290a919e5ee415db8ca
-
Filesize
2.0MB
MD5603a8b54656cb1e32727bdc9a6afa82a
SHA11020b8bbb67d41e765080d326b4e770ad68fb7fc
SHA256583bab667b93dd222594d5d49b3ece7a629927cfeff44b1820f77c0f09dc3303
SHA5129a3d12d0909aef21cc8556e6ab5c5a847fbfa726a3535fa0bba0a0355a3ce76ff8ff8d8118baf92500c4e256adf9230db87ed6081bcb1290a919e5ee415db8ca