Analysis
-
max time kernel
142s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2023 15:03
Static task
static1
Behavioral task
behavioral1
Sample
c1d0301453553dc1cba5155dbc16a1b4a2e1890a93f35171f516605e72081afb.exe
Resource
win7-20231023-en
windows7-x64
Behavioral task
behavioral2
Sample
c1d0301453553dc1cba5155dbc16a1b4a2e1890a93f35171f516605e72081afb.exe
Resource
win10v2004-20231023-en
windows10-2004-x64
General
-
Target
c1d0301453553dc1cba5155dbc16a1b4a2e1890a93f35171f516605e72081afb.exe
-
Size
716KB
-
MD5
0c9b21dc850a12745679ba35b88cd8b4
-
SHA1
ff60c5e36db537d512ef260a04c555a33af09079
-
SHA256
c1d0301453553dc1cba5155dbc16a1b4a2e1890a93f35171f516605e72081afb
-
SHA512
decc2b4c5bda313ba3e15b3e9118c1f4441957cf8441e4de98667a7be1eca5888d869b69e5cbfe5e2e7e6bdbd356733e1a62285fa43983fb6d3775843bc0c099
-
SSDEEP
12288:imx1hJi5FwJvHg1LeWbCvsgFBVAykLlnvxFnB9/x/QH:Tx1FA1LdbCvlV8v//a
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload 2 IoCs
resource yara_rule behavioral2/memory/328-0-0x0000000010000000-0x000000001002A000-memory.dmp fatalrat behavioral2/memory/1000-9-0x0000000010000000-0x000000001002A000-memory.dmp fatalrat -
Executes dropped EXE 2 IoCs
pid Process 1000 Svwxya.exe 2200 Svwxya.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\AppPatch\Svwxya.exe c1d0301453553dc1cba5155dbc16a1b4a2e1890a93f35171f516605e72081afb.exe File opened for modification C:\Program Files (x86)\AppPatch\Svwxya.exe Svwxya.exe File created C:\Program Files (x86)\AppPatch\Svwxya.exe Svwxya.exe File created C:\Program Files (x86)\AppPatch\Svwxya.exe c1d0301453553dc1cba5155dbc16a1b4a2e1890a93f35171f516605e72081afb.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Svwxya.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Svwxya.exe -
Modifies data under HKEY_USERS 21 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Svwxya.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion Svwxya.exe Key created \REGISTRY\USER\.DEFAULT\System\CurrentControlSet Svwxya.exe Set value (str) \REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Services\Stuvwx Abcdefgh\InstallTime = "2023-11-23 15:03" Svwxya.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System Svwxya.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies Svwxya.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableLockWorkstation = "1" Svwxya.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableLockWorkstation = "1" Svwxya.exe Key created \REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Services\Stuvwx Abcdefgh Svwxya.exe Key created \REGISTRY\USER\.DEFAULT\Software Svwxya.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft Svwxya.exe Key created \REGISTRY\USER\.DEFAULT\Software Svwxya.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System Svwxya.exe Key created \REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Services\Stuvwx Abcdefgh Svwxya.exe Key created \REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Services Svwxya.exe Set value (str) \REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Services\Stuvwx Abcdefgh\Group = "Fatal" Svwxya.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft Svwxya.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum Svwxya.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie Svwxya.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum\Version = "7" Svwxya.exe Key created \REGISTRY\USER\.DEFAULT\SYSTEM Svwxya.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2200 Svwxya.exe 2200 Svwxya.exe 2200 Svwxya.exe 2200 Svwxya.exe 2200 Svwxya.exe 2200 Svwxya.exe 2200 Svwxya.exe 2200 Svwxya.exe 2200 Svwxya.exe 2200 Svwxya.exe 2200 Svwxya.exe 2200 Svwxya.exe 2200 Svwxya.exe 2200 Svwxya.exe 2200 Svwxya.exe 2200 Svwxya.exe 2200 Svwxya.exe 2200 Svwxya.exe 2200 Svwxya.exe 2200 Svwxya.exe 2200 Svwxya.exe 2200 Svwxya.exe 2200 Svwxya.exe 2200 Svwxya.exe 2200 Svwxya.exe 2200 Svwxya.exe 2200 Svwxya.exe 2200 Svwxya.exe 2200 Svwxya.exe 2200 Svwxya.exe 2200 Svwxya.exe 2200 Svwxya.exe 2200 Svwxya.exe 2200 Svwxya.exe 2200 Svwxya.exe 2200 Svwxya.exe 2200 Svwxya.exe 2200 Svwxya.exe 2200 Svwxya.exe 2200 Svwxya.exe 2200 Svwxya.exe 2200 Svwxya.exe 2200 Svwxya.exe 2200 Svwxya.exe 2200 Svwxya.exe 2200 Svwxya.exe 2200 Svwxya.exe 2200 Svwxya.exe 2200 Svwxya.exe 2200 Svwxya.exe 2200 Svwxya.exe 2200 Svwxya.exe 2200 Svwxya.exe 2200 Svwxya.exe 2200 Svwxya.exe 2200 Svwxya.exe 2200 Svwxya.exe 2200 Svwxya.exe 2200 Svwxya.exe 2200 Svwxya.exe 2200 Svwxya.exe 2200 Svwxya.exe 2200 Svwxya.exe 2200 Svwxya.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 328 c1d0301453553dc1cba5155dbc16a1b4a2e1890a93f35171f516605e72081afb.exe Token: SeDebugPrivilege 1000 Svwxya.exe Token: SeDebugPrivilege 2200 Svwxya.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1000 wrote to memory of 2200 1000 Svwxya.exe 85 PID 1000 wrote to memory of 2200 1000 Svwxya.exe 85 PID 1000 wrote to memory of 2200 1000 Svwxya.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\c1d0301453553dc1cba5155dbc16a1b4a2e1890a93f35171f516605e72081afb.exe"C:\Users\Admin\AppData\Local\Temp\c1d0301453553dc1cba5155dbc16a1b4a2e1890a93f35171f516605e72081afb.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:328
-
C:\Program Files (x86)\AppPatch\Svwxya.exe"C:\Program Files (x86)\AppPatch\Svwxya.exe"1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Program Files (x86)\AppPatch\Svwxya.exe"C:\Program Files (x86)\AppPatch\Svwxya.exe" Win72⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2200
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
716KB
MD50c9b21dc850a12745679ba35b88cd8b4
SHA1ff60c5e36db537d512ef260a04c555a33af09079
SHA256c1d0301453553dc1cba5155dbc16a1b4a2e1890a93f35171f516605e72081afb
SHA512decc2b4c5bda313ba3e15b3e9118c1f4441957cf8441e4de98667a7be1eca5888d869b69e5cbfe5e2e7e6bdbd356733e1a62285fa43983fb6d3775843bc0c099
-
Filesize
716KB
MD50c9b21dc850a12745679ba35b88cd8b4
SHA1ff60c5e36db537d512ef260a04c555a33af09079
SHA256c1d0301453553dc1cba5155dbc16a1b4a2e1890a93f35171f516605e72081afb
SHA512decc2b4c5bda313ba3e15b3e9118c1f4441957cf8441e4de98667a7be1eca5888d869b69e5cbfe5e2e7e6bdbd356733e1a62285fa43983fb6d3775843bc0c099
-
Filesize
716KB
MD50c9b21dc850a12745679ba35b88cd8b4
SHA1ff60c5e36db537d512ef260a04c555a33af09079
SHA256c1d0301453553dc1cba5155dbc16a1b4a2e1890a93f35171f516605e72081afb
SHA512decc2b4c5bda313ba3e15b3e9118c1f4441957cf8441e4de98667a7be1eca5888d869b69e5cbfe5e2e7e6bdbd356733e1a62285fa43983fb6d3775843bc0c099