Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
-
submitted
26/11/2023, 14:17
General
-
Target
c3c89877a369ad1d94342b4e05f0abc03c4cb5560ec6d834c34fc4ca231bf1d9.exe
-
Size
1.9MB
-
MD5
1ed1cc584962a2a0234885ca7cbbf87f
-
SHA1
14e225ae0699a5758dd5aaaa5d1c5037c6c6c944
-
SHA256
c3c89877a369ad1d94342b4e05f0abc03c4cb5560ec6d834c34fc4ca231bf1d9
-
SHA512
c11674ff35b49fae7ea9c30a1e6bcc98a8f4b5c8f264f9d55669f22a4083ade5fdb0a091a43ce2d04537ed383d23f0324b565fac1182b66478ec8d1c8f584d17
-
SSDEEP
49152:47QMGIEr2hyyU/sQaIbd/HA/XXO5YbQBIEbrGygStXBqxoXbrSIQ5kBGpo2A:45GIE6XU/sQDd4/e5YkBIEbrGygSZr9C
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Drops file in System32 directory 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c3c89877a369ad1d94342b4e05f0abc03c4cb5560ec6d834c34fc4ca231bf1d9.exe"C:\Users\Admin\AppData\Local\Temp\c3c89877a369ad1d94342b4e05f0abc03c4cb5560ec6d834c34fc4ca231bf1d9.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Svwxya.exeC:\Windows\Svwxya.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
209KB
MD5bf40a37bf17824bac4d6324170848495
SHA160d19043f912c1e2cbf034f6c8dc89dc858ee8a5
SHA256f7c2997e2ab1ae511693b05dc7adc302dbea2fc34424761e081177a614f97a5a
SHA512d17c33970b6e092bf185b84ac8271f2f1f309034b258394832a6f70750a7e5f82835d68ff994341259658597aedc965c6f7430efa8dd15cea1c28089fcc9af5f
-
Filesize
1.9MB
MD51ed1cc584962a2a0234885ca7cbbf87f
SHA114e225ae0699a5758dd5aaaa5d1c5037c6c6c944
SHA256c3c89877a369ad1d94342b4e05f0abc03c4cb5560ec6d834c34fc4ca231bf1d9
SHA512c11674ff35b49fae7ea9c30a1e6bcc98a8f4b5c8f264f9d55669f22a4083ade5fdb0a091a43ce2d04537ed383d23f0324b565fac1182b66478ec8d1c8f584d17
-
Filesize
1.9MB
MD51ed1cc584962a2a0234885ca7cbbf87f
SHA114e225ae0699a5758dd5aaaa5d1c5037c6c6c944
SHA256c3c89877a369ad1d94342b4e05f0abc03c4cb5560ec6d834c34fc4ca231bf1d9
SHA512c11674ff35b49fae7ea9c30a1e6bcc98a8f4b5c8f264f9d55669f22a4083ade5fdb0a091a43ce2d04537ed383d23f0324b565fac1182b66478ec8d1c8f584d17
-
Filesize
212KB
-
Filesize
168KB