Analysis
-
max time kernel
137s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
12/11/2023, 13:09
Static task
static1
Behavioral task
behavioral1
Sample
c4d250f1e9e6e3e9e399823fc96979dfaf5e80775bfe2a71bfef4c4230f189d7.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
c4d250f1e9e6e3e9e399823fc96979dfaf5e80775bfe2a71bfef4c4230f189d7.exe
Resource
win10v2004-20231023-en
General
-
Target
c4d250f1e9e6e3e9e399823fc96979dfaf5e80775bfe2a71bfef4c4230f189d7.exe
-
Size
4.4MB
-
MD5
fc679381ba73c458363c8d8cbb26bebd
-
SHA1
09fd9e139ffac86e3997018b4d555458ed32611a
-
SHA256
c4d250f1e9e6e3e9e399823fc96979dfaf5e80775bfe2a71bfef4c4230f189d7
-
SHA512
53854a8354d8619279514f98c292b5c4d40900f7056df109af808327d1c88edd4b643a89b1bdf3d48f8409095d9e687f07ff53631461c4898d6395da2a9777bb
-
SSDEEP
98304:yJqz0LA4ESEtt8X5SbWf+YFCWuqHOEJBAUZL:yJq94rdQaf+Hl2JV
Malware Config
Signatures
-
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Fatnerd\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\Fatnerd.sys" c4d250f1e9e6e3e9e399823fc96979dfaf5e80775bfe2a71bfef4c4230f189d7.exe -
resource yara_rule behavioral2/memory/4672-1-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4672-2-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4672-0-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4672-3-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4672-8-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4672-7-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4672-10-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4672-13-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4672-16-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4672-19-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4672-21-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4672-24-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4672-26-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4672-29-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4672-31-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4672-33-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4672-35-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4672-37-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4672-39-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4672-41-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4672-43-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4672-45-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4672-47-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4672-49-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4672-50-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4672-51-0x0000000010000000-0x000000001003E000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4672 c4d250f1e9e6e3e9e399823fc96979dfaf5e80775bfe2a71bfef4c4230f189d7.exe 4672 c4d250f1e9e6e3e9e399823fc96979dfaf5e80775bfe2a71bfef4c4230f189d7.exe 4672 c4d250f1e9e6e3e9e399823fc96979dfaf5e80775bfe2a71bfef4c4230f189d7.exe 4672 c4d250f1e9e6e3e9e399823fc96979dfaf5e80775bfe2a71bfef4c4230f189d7.exe -
Suspicious behavior: LoadsDriver 10 IoCs
pid Process 664 Process not Found 664 Process not Found 664 Process not Found 664 Process not Found 664 Process not Found 664 Process not Found 664 Process not Found 664 Process not Found 664 Process not Found 664 Process not Found -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4672 c4d250f1e9e6e3e9e399823fc96979dfaf5e80775bfe2a71bfef4c4230f189d7.exe 4672 c4d250f1e9e6e3e9e399823fc96979dfaf5e80775bfe2a71bfef4c4230f189d7.exe 4672 c4d250f1e9e6e3e9e399823fc96979dfaf5e80775bfe2a71bfef4c4230f189d7.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c4d250f1e9e6e3e9e399823fc96979dfaf5e80775bfe2a71bfef4c4230f189d7.exe"C:\Users\Admin\AppData\Local\Temp\c4d250f1e9e6e3e9e399823fc96979dfaf5e80775bfe2a71bfef4c4230f189d7.exe"1⤵
- Sets service image path in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4672
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
38KB
MD50a4a21a4c3ed1b1fd2c30765ebb59920
SHA1271409e023b98513d67bda4bc195f1b0c8adc68c
SHA2564697d13517c5c348b534e68053c360bad8612b2cabe6abc84fd1dd5bc450c656
SHA51263ad20fadc40af444f2fc58f38508eef3eee5daa89bcb622f59a2dbd343af72c916ad0152bd77670b86ba2936e4418593c9fca9b296135a0b2ba5920e31fd8f2