Analysis
-
max time kernel
143s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
-
submitted
30-11-2023 04:58
General
-
Target
d034f51c56aff89183119dc15cb6f966960f304e05c57b0f4958cecfc2d4811a.exe
-
Size
1.1MB
-
MD5
c538e111df08e83a056625baa3255333
-
SHA1
3196ef0ec82cbdc2cac8727fc034bfc994ca8f0b
-
SHA256
d034f51c56aff89183119dc15cb6f966960f304e05c57b0f4958cecfc2d4811a
-
SHA512
1a2d2fe8e7e382301228077b2beac6976c484e64ea849f7ba99153ca5b27b08b6f986fa5936d6ab9f282d0fdd78a76e769d15cd6e7a5ee0e8b143485fa751a12
-
SSDEEP
24576:zwDXIGPt2U4q9+Jpxcx7REstoKcCuj5qAQNvtOKer50/Zy6+:gIGo3TI7RBo7qZvtOp5n6+
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload 1 IoCs
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 2 IoCs
-
Drops file in Windows directory 5 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d034f51c56aff89183119dc15cb6f966960f304e05c57b0f4958cecfc2d4811a.exe"C:\Users\Admin\AppData\Local\Temp\d034f51c56aff89183119dc15cb6f966960f304e05c57b0f4958cecfc2d4811a.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\Web\erp.exe"C:\Windows\Web\erp.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Web\erp.exeC:\Windows\Web\erp.exe --type=crashpad-handler /prefetch:7 --no-rate-limit --database=C:\Users\Admin\AppData\Local\Crashpad --annotation=channel= --annotation=plat=Win32 --annotation=prod=书生ERP --annotation=ver=-devel --handshake-handle=0x2183⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40B
MD5c74eb50e4ee9951b1c2b562372795596
SHA1fdf2a071bd3474aaeaf1109c13077970a419d38f
SHA256db8d26df6c9d6f867f22a3614f7718990367670bc30e9d7c254e5468adcde711
SHA512c6c72f47aa9f93031c92304cd1036ffca30fd3bae79428e10352b722dd5af0dee9aee97e282e46289eb51c5b66f8d80b1e46c2eca5598ce661ae482b880fac5f
-
Filesize
198KB
MD5b96ceeb2d20f407a433e9b416dd3a359
SHA1d31b51633670cb46b9df34b294bb1fc351317937
SHA256d1fc47d4b7ce95c75026fc127ad5800468c58f1b6316b096417786fef77158f9
SHA5123faefef780c6355d3688d0d3fd5866ac82d8a468b882e4b223f5e7fa428ad62437818f535e5556e13a3900b4fb43e15783f7affdb80bc75fc8288e3f9e4a5c02
-
Filesize
1.0MB
MD5a182097a3169f5924c29d107c0b4b5a4
SHA18c5e7ff7a8b62de893a3cb6dad3fc028435ead92
SHA256a60a8592d45f56d9c2ec2039089b55b371dda0797e4fbb57038d40e8c8530e01
SHA5120f57bac990a446d17c468cd4cf9604c5eec4e40c599afd64451a6718417174f7f06de717412863c0f44f2f692a0557857a8799f3f4c700016db2a406f1d6a50d
-
Filesize
1.0MB
MD5a182097a3169f5924c29d107c0b4b5a4
SHA18c5e7ff7a8b62de893a3cb6dad3fc028435ead92
SHA256a60a8592d45f56d9c2ec2039089b55b371dda0797e4fbb57038d40e8c8530e01
SHA5120f57bac990a446d17c468cd4cf9604c5eec4e40c599afd64451a6718417174f7f06de717412863c0f44f2f692a0557857a8799f3f4c700016db2a406f1d6a50d
-
Filesize
1.0MB
MD5a182097a3169f5924c29d107c0b4b5a4
SHA18c5e7ff7a8b62de893a3cb6dad3fc028435ead92
SHA256a60a8592d45f56d9c2ec2039089b55b371dda0797e4fbb57038d40e8c8530e01
SHA5120f57bac990a446d17c468cd4cf9604c5eec4e40c599afd64451a6718417174f7f06de717412863c0f44f2f692a0557857a8799f3f4c700016db2a406f1d6a50d
-
Filesize
1.0MB
MD5a182097a3169f5924c29d107c0b4b5a4
SHA18c5e7ff7a8b62de893a3cb6dad3fc028435ead92
SHA256a60a8592d45f56d9c2ec2039089b55b371dda0797e4fbb57038d40e8c8530e01
SHA5120f57bac990a446d17c468cd4cf9604c5eec4e40c599afd64451a6718417174f7f06de717412863c0f44f2f692a0557857a8799f3f4c700016db2a406f1d6a50d
-
Filesize
63KB
MD541d6c940f8d9fac21bbff423cac25d0c
SHA109c3db17b9552689b3f38b9c2be30851f56f15c9
SHA2567da2b5062b3ed76a250e96aee6b460441bf0feb317f0de7aa5f11d24a49eb393
SHA512a73f543891f789c438f32c5f4fa187f65e3067752ae3367a4b74ab87bd3e6fe0532b8c31305ac00fbb74c498781d0d3ad016f3d4f5e50afe505a8fc2f9d455c7
-
Filesize
63KB
MD541d6c940f8d9fac21bbff423cac25d0c
SHA109c3db17b9552689b3f38b9c2be30851f56f15c9
SHA2567da2b5062b3ed76a250e96aee6b460441bf0feb317f0de7aa5f11d24a49eb393
SHA512a73f543891f789c438f32c5f4fa187f65e3067752ae3367a4b74ab87bd3e6fe0532b8c31305ac00fbb74c498781d0d3ad016f3d4f5e50afe505a8fc2f9d455c7
-
Filesize
63KB
MD541d6c940f8d9fac21bbff423cac25d0c
SHA109c3db17b9552689b3f38b9c2be30851f56f15c9
SHA2567da2b5062b3ed76a250e96aee6b460441bf0feb317f0de7aa5f11d24a49eb393
SHA512a73f543891f789c438f32c5f4fa187f65e3067752ae3367a4b74ab87bd3e6fe0532b8c31305ac00fbb74c498781d0d3ad016f3d4f5e50afe505a8fc2f9d455c7
-
Filesize
196KB
-
Filesize
200KB
-
Filesize
168KB
-
Filesize
628KB
-
Filesize
616KB
-
Filesize
628KB
-
Filesize
628KB