Analysis
-
max time kernel
146s -
max time network
159s -
platform
windows7_x64 -
resource
win7-20231025-en -
resource tags
-
submitted
16-11-2023 08:16
General
-
Target
3.exe
-
Size
140KB
-
MD5
71d6ba66466828dfe5c7d8cadfd44c79
-
SHA1
b79ba0d33150e22e8afa5a9360e9a0dbc2df7e2d
-
SHA256
012d5c38bb315e316b4e53101f7bf44dc55b6b2301e626f13a8a5cad8fac0ba9
-
SHA512
3c7a1eb705e2188f9b0e355ec853a98529083a67051a567aa22f94770ae15c9105746fb1059ad6b840fc14f5fc680034c47be004c5ba28b907fab137a9ebb699
-
SSDEEP
1536:Vua+BTv3tIO8MtM+/6jRVGIk1MgHjsPGYYwOda2CqqZOIgQJb0lfjtO+vbWL8xJb:Vn+htWMtf+7GZYGVA2QJgi8xJLDoU
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload 1 IoCs
-
Executes dropped EXE 2 IoCs
-
Drops file in Windows directory 4 IoCs
-
Modifies data under HKEY_USERS 6 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3.exe"C:\Users\Admin\AppData\Local\Temp\3.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\3.exeC:\Windows\3.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\3.exeC:\Windows\3.exe Win72⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
140KB
MD571d6ba66466828dfe5c7d8cadfd44c79
SHA1b79ba0d33150e22e8afa5a9360e9a0dbc2df7e2d
SHA256012d5c38bb315e316b4e53101f7bf44dc55b6b2301e626f13a8a5cad8fac0ba9
SHA5123c7a1eb705e2188f9b0e355ec853a98529083a67051a567aa22f94770ae15c9105746fb1059ad6b840fc14f5fc680034c47be004c5ba28b907fab137a9ebb699
-
Filesize
140KB
MD571d6ba66466828dfe5c7d8cadfd44c79
SHA1b79ba0d33150e22e8afa5a9360e9a0dbc2df7e2d
SHA256012d5c38bb315e316b4e53101f7bf44dc55b6b2301e626f13a8a5cad8fac0ba9
SHA5123c7a1eb705e2188f9b0e355ec853a98529083a67051a567aa22f94770ae15c9105746fb1059ad6b840fc14f5fc680034c47be004c5ba28b907fab137a9ebb699
-
Filesize
140KB
MD571d6ba66466828dfe5c7d8cadfd44c79
SHA1b79ba0d33150e22e8afa5a9360e9a0dbc2df7e2d
SHA256012d5c38bb315e316b4e53101f7bf44dc55b6b2301e626f13a8a5cad8fac0ba9
SHA5123c7a1eb705e2188f9b0e355ec853a98529083a67051a567aa22f94770ae15c9105746fb1059ad6b840fc14f5fc680034c47be004c5ba28b907fab137a9ebb699
-
Filesize
112KB