Analysis
-
max time kernel
141s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
-
submitted
30-11-2023 02:17
General
-
Target
税51发_票_.exe
-
Size
2.5MB
-
MD5
9393a9c95f8a40ad022562848e92a58b
-
SHA1
3079b39c35b5912a6f6d31180ca8ae531d5d5a31
-
SHA256
284eee0dd617e5409bbce94302d73629efedff6c4c92cd0e4333a19adf047044
-
SHA512
8678fc00a6f94bf46a05deeb2b4353ffd048204b528a3a5eed15979a0fe415eb3e607938eeebf956adcdd4ccaa55a2f35478fa650d995c485dafc73d3117a66d
-
SSDEEP
49152:R8HqtWATVLe2RNODMGJ9jinsXGeXxj3i/5Ea8x2zvMyGhgYrWtbnzp6sghYn+U/D:8mWATV1RNODMmjinsWeXxj3i/5fMyGhM
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload 2 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Drops file in Program Files directory 5 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\税51发_票_.exe"C:\Users\Admin\AppData\Local\Temp\税51发_票_.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\oray32\gameCore_cef.exe"C:\Program Files (x86)\oray32\gameCore_cef.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
267KB
MD5f0cb65b4920ee4c42749f877b0f020b4
SHA127f9fedd22fe48736e32d0ea33795bed6aaa5c98
SHA256a2e50cc29a52d730edf21c1cd539ef6a8cf47a17151731afd7af16c6149d8ea9
SHA51261b233fa345f3ee7bf6cfe95cdd75e57c035b55b07986cca8b8c412e3c71ebb23db3d449bef8b1764ce61a827cbf4fab3ec8492d832cece86f9253694ae0335e
-
Filesize
267KB
MD5f0cb65b4920ee4c42749f877b0f020b4
SHA127f9fedd22fe48736e32d0ea33795bed6aaa5c98
SHA256a2e50cc29a52d730edf21c1cd539ef6a8cf47a17151731afd7af16c6149d8ea9
SHA51261b233fa345f3ee7bf6cfe95cdd75e57c035b55b07986cca8b8c412e3c71ebb23db3d449bef8b1764ce61a827cbf4fab3ec8492d832cece86f9253694ae0335e
-
Filesize
198KB
MD58d7b75e76767e7d80ba2d7c5f012cd53
SHA1a3b2f2dabc3ddd47d9c53b74202358136b23d2f9
SHA2564afd5abe32b72232a25e44c88f5af96f182c9ce8d06f3aa44970e5366989af43
SHA512d964016717b7fc4a9f443de9c85ec507d6c823b7616d8b51f31e5cacf992fd3519c170ea2cf14a88f0b3b17670871637a679807bf11f990d5e26eb00335feeb0
-
Filesize
1.5MB
MD57c76fd6958c799bf95b6a04a1be5b1ce
SHA17eb983ed895c797ceecbfd610735b3207e0aca00
SHA2560fc4cd06e025ea530bcf06f3d569798d378076ceeda9260496414604033223ea
SHA512644f285a9477bd635b4ddce18cac49ccb4dc3256005e1a92746d3c95d41700beee029ce750b4147977324207407294ac75bdf91c7915a7a42650e243c1552b1f
-
Filesize
1.5MB
MD57c76fd6958c799bf95b6a04a1be5b1ce
SHA17eb983ed895c797ceecbfd610735b3207e0aca00
SHA2560fc4cd06e025ea530bcf06f3d569798d378076ceeda9260496414604033223ea
SHA512644f285a9477bd635b4ddce18cac49ccb4dc3256005e1a92746d3c95d41700beee029ce750b4147977324207407294ac75bdf91c7915a7a42650e243c1552b1f
-
Filesize
1.5MB
MD57c76fd6958c799bf95b6a04a1be5b1ce
SHA17eb983ed895c797ceecbfd610735b3207e0aca00
SHA2560fc4cd06e025ea530bcf06f3d569798d378076ceeda9260496414604033223ea
SHA512644f285a9477bd635b4ddce18cac49ccb4dc3256005e1a92746d3c95d41700beee029ce750b4147977324207407294ac75bdf91c7915a7a42650e243c1552b1f
-
Filesize
106KB
MD5fb241daf1b3065bb2c23a24ff4bd7e87
SHA189dec7a6429dfe668948f8be7da3df1bbeff55ca
SHA2564216f8ac13f7207638d47f1b4e67f9abc42b4e85d1c864cabded35d10088f86a
SHA5124de29b3a18bee553a04c7e7b3231b1242069116d8431ce85f3e939b40d2cb7707e631d037359b7ae37b23e2f5d3a0f38653361f0e2073883bf2c1c5e0cb006f9
-
Filesize
106KB
MD5fb241daf1b3065bb2c23a24ff4bd7e87
SHA189dec7a6429dfe668948f8be7da3df1bbeff55ca
SHA2564216f8ac13f7207638d47f1b4e67f9abc42b4e85d1c864cabded35d10088f86a
SHA5124de29b3a18bee553a04c7e7b3231b1242069116d8431ce85f3e939b40d2cb7707e631d037359b7ae37b23e2f5d3a0f38653361f0e2073883bf2c1c5e0cb006f9
-
Filesize
196KB
-
Filesize
400KB
-
Filesize
960KB
-
Filesize
168KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
960KB