Analysis
-
max time kernel
140s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
-
submitted
16-11-2023 08:25
General
-
Target
4.exe
-
Size
140KB
-
MD5
ab7d836418eba6d6fe1361a0fa2d5fe9
-
SHA1
f06a883211c35eff04dbb7a514dfa894f18930df
-
SHA256
5905f3df4ecaa755007297122337daf72f91c8b6b302e23ec1ea685f28cdaa60
-
SHA512
eaa566c0107e43acce58230382b903dde21b59b5430ad8d332bc5e5aea52658168a97c0b6339e576a2c815df39707883d07d7e02c70420bc226c8359d8c3ecfc
-
SSDEEP
1536:Vua+BTv3tIO8MtM+/6jRVGIk1MgHjsPGYYwOda2CqqZOIgQJb0lfjtO+vbWL8xJb:Vn+htWMtf+7GZYGVA2QJgi8xJLDoU
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload 2 IoCs
-
Executes dropped EXE 2 IoCs
-
Drops file in Windows directory 4 IoCs
-
Modifies data under HKEY_USERS 7 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4.exe"C:\Users\Admin\AppData\Local\Temp\4.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\4.exeC:\Windows\4.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\4.exeC:\Windows\4.exe Win72⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
140KB
MD5ab7d836418eba6d6fe1361a0fa2d5fe9
SHA1f06a883211c35eff04dbb7a514dfa894f18930df
SHA2565905f3df4ecaa755007297122337daf72f91c8b6b302e23ec1ea685f28cdaa60
SHA512eaa566c0107e43acce58230382b903dde21b59b5430ad8d332bc5e5aea52658168a97c0b6339e576a2c815df39707883d07d7e02c70420bc226c8359d8c3ecfc
-
Filesize
140KB
MD5ab7d836418eba6d6fe1361a0fa2d5fe9
SHA1f06a883211c35eff04dbb7a514dfa894f18930df
SHA2565905f3df4ecaa755007297122337daf72f91c8b6b302e23ec1ea685f28cdaa60
SHA512eaa566c0107e43acce58230382b903dde21b59b5430ad8d332bc5e5aea52658168a97c0b6339e576a2c815df39707883d07d7e02c70420bc226c8359d8c3ecfc
-
Filesize
140KB
MD5ab7d836418eba6d6fe1361a0fa2d5fe9
SHA1f06a883211c35eff04dbb7a514dfa894f18930df
SHA2565905f3df4ecaa755007297122337daf72f91c8b6b302e23ec1ea685f28cdaa60
SHA512eaa566c0107e43acce58230382b903dde21b59b5430ad8d332bc5e5aea52658168a97c0b6339e576a2c815df39707883d07d7e02c70420bc226c8359d8c3ecfc
-
Filesize
112KB
-
Filesize
112KB