Analysis
-
max time kernel
140s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
-
submitted
27-11-2023 12:07
General
-
Target
7cb4877a66f0388b9a3ce0563f72bfe74b39d4dc80634db428cee86d15c41d00.exe
-
Size
3.8MB
-
MD5
069e092fd0eba1888a71d08223039ff2
-
SHA1
951adc3fc08b3012fd43739a8fc042f1f8e97ca2
-
SHA256
7cb4877a66f0388b9a3ce0563f72bfe74b39d4dc80634db428cee86d15c41d00
-
SHA512
e0b5e6cebcae283f2af9d7c93a2f30cd18505156fed6ae02f470a56d9745eed945c5489de3847ce6ec6c4b9fe84f2e9cad8596ca597396d20f487bbdc1ae5c16
-
SSDEEP
49152:y3knbYapsl0VRMWxEP0XprnoFNQ/lnq6aYNLbFsIuciOAQ0i1kTM8qxBwWXmZvt1:y3oEKsgvXprnaCLgOAjMRxBLWd+5
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Drops file in Program Files directory 6 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7cb4877a66f0388b9a3ce0563f72bfe74b39d4dc80634db428cee86d15c41d00.exe"C:\Users\Admin\AppData\Local\Temp\7cb4877a66f0388b9a3ce0563f72bfe74b39d4dc80634db428cee86d15c41d00.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\AliWangWang\gameCore_cef.exe"C:\Program Files (x86)\AliWangWang\gameCore_cef.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
267KB
MD5f0cb65b4920ee4c42749f877b0f020b4
SHA127f9fedd22fe48736e32d0ea33795bed6aaa5c98
SHA256a2e50cc29a52d730edf21c1cd539ef6a8cf47a17151731afd7af16c6149d8ea9
SHA51261b233fa345f3ee7bf6cfe95cdd75e57c035b55b07986cca8b8c412e3c71ebb23db3d449bef8b1764ce61a827cbf4fab3ec8492d832cece86f9253694ae0335e
-
Filesize
267KB
MD5f0cb65b4920ee4c42749f877b0f020b4
SHA127f9fedd22fe48736e32d0ea33795bed6aaa5c98
SHA256a2e50cc29a52d730edf21c1cd539ef6a8cf47a17151731afd7af16c6149d8ea9
SHA51261b233fa345f3ee7bf6cfe95cdd75e57c035b55b07986cca8b8c412e3c71ebb23db3d449bef8b1764ce61a827cbf4fab3ec8492d832cece86f9253694ae0335e
-
Filesize
198KB
MD58d7b75e76767e7d80ba2d7c5f012cd53
SHA1a3b2f2dabc3ddd47d9c53b74202358136b23d2f9
SHA2564afd5abe32b72232a25e44c88f5af96f182c9ce8d06f3aa44970e5366989af43
SHA512d964016717b7fc4a9f443de9c85ec507d6c823b7616d8b51f31e5cacf992fd3519c170ea2cf14a88f0b3b17670871637a679807bf11f990d5e26eb00335feeb0
-
Filesize
1.5MB
MD57c76fd6958c799bf95b6a04a1be5b1ce
SHA17eb983ed895c797ceecbfd610735b3207e0aca00
SHA2560fc4cd06e025ea530bcf06f3d569798d378076ceeda9260496414604033223ea
SHA512644f285a9477bd635b4ddce18cac49ccb4dc3256005e1a92746d3c95d41700beee029ce750b4147977324207407294ac75bdf91c7915a7a42650e243c1552b1f
-
Filesize
1.5MB
MD57c76fd6958c799bf95b6a04a1be5b1ce
SHA17eb983ed895c797ceecbfd610735b3207e0aca00
SHA2560fc4cd06e025ea530bcf06f3d569798d378076ceeda9260496414604033223ea
SHA512644f285a9477bd635b4ddce18cac49ccb4dc3256005e1a92746d3c95d41700beee029ce750b4147977324207407294ac75bdf91c7915a7a42650e243c1552b1f
-
Filesize
1.5MB
MD57c76fd6958c799bf95b6a04a1be5b1ce
SHA17eb983ed895c797ceecbfd610735b3207e0aca00
SHA2560fc4cd06e025ea530bcf06f3d569798d378076ceeda9260496414604033223ea
SHA512644f285a9477bd635b4ddce18cac49ccb4dc3256005e1a92746d3c95d41700beee029ce750b4147977324207407294ac75bdf91c7915a7a42650e243c1552b1f
-
Filesize
202KB
MD5c3fe88331fcf2d622aac0aa36e55061a
SHA1a61d1c9fa6d1a598e631865fb7dda01cdc98ec1f
SHA25682e1f78188fe985472ab4caa6da1bd6695ff64f23612ec6a477e9303a05363b0
SHA5123d7e806b3bcc29accd0ce8d4a8ef6b46fb1af666d5c709de14d5be92d010783f100b4a28ce1069495a3f2ba47b93f06a6fdba3e3b8853dcbd9b96c160915f275
-
Filesize
202KB
MD5c3fe88331fcf2d622aac0aa36e55061a
SHA1a61d1c9fa6d1a598e631865fb7dda01cdc98ec1f
SHA25682e1f78188fe985472ab4caa6da1bd6695ff64f23612ec6a477e9303a05363b0
SHA5123d7e806b3bcc29accd0ce8d4a8ef6b46fb1af666d5c709de14d5be92d010783f100b4a28ce1069495a3f2ba47b93f06a6fdba3e3b8853dcbd9b96c160915f275
-
Filesize
196KB
-
Filesize
400KB
-
Filesize
168KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
960KB