Analysis
-
max time kernel
127s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
-
submitted
30-11-2023 10:59
General
-
Target
df51f6f0974d1a8a729909388fd839b1cfbbe187ff1858cdf6d00aec0148269d.exe
-
Size
3.9MB
-
MD5
d8fd12d205b14a9f5a4cb33a0138bdff
-
SHA1
35470e0af16aed223ee583e4fc169a5ef69c331d
-
SHA256
df51f6f0974d1a8a729909388fd839b1cfbbe187ff1858cdf6d00aec0148269d
-
SHA512
3341570e2c017dfb7fdb7302122a5b43d80f21e15765b5c56bc677fe9c074ed70cbde6e1094967a9abe486a4627ba975c707f9978a28c9ce7100be6f86f1b7f3
-
SSDEEP
49152:Aw1MCHSGX17X8q5CVIRjOHGLis8e9YNcCy63/VcYpD/UVJ1BclhE5di8UR0mxvno:AovHz7X3jOHM8eMf3/VcixhE5rPKPa9
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload 2 IoCs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 2 IoCs
-
Drops file in Program Files directory 6 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\df51f6f0974d1a8a729909388fd839b1cfbbe187ff1858cdf6d00aec0148269d.exe"C:\Users\Admin\AppData\Local\Temp\df51f6f0974d1a8a729909388fd839b1cfbbe187ff1858cdf6d00aec0148269d.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Application Verifier\QQMicroGameBox.exe"C:\Program Files (x86)\Application Verifier\QQMicroGameBox.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\QQMicroGameBox.exe"C:\Users\Admin\AppData\Local\QQMicroGameBox.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.9MB
MD57f8f210a6f11a1e556b8dd7bb26e2e7d
SHA149a1e7d58e43cc5e177de7857b8fa9c8a6f6d1c1
SHA256c7109e87b0d20b842816f055a8714f0eebccfa99a031e6b7a472397736329af7
SHA5121c414aa37879bed96a82a1d14658e58da6d085cd0a6d523a65780c9dc585d78afa99eefc64dc5d9961702dc5fdd8b647f9475eed25ef67287de01f82962921a7
-
Filesize
1.9MB
MD57f8f210a6f11a1e556b8dd7bb26e2e7d
SHA149a1e7d58e43cc5e177de7857b8fa9c8a6f6d1c1
SHA256c7109e87b0d20b842816f055a8714f0eebccfa99a031e6b7a472397736329af7
SHA5121c414aa37879bed96a82a1d14658e58da6d085cd0a6d523a65780c9dc585d78afa99eefc64dc5d9961702dc5fdd8b647f9475eed25ef67287de01f82962921a7
-
Filesize
1.9MB
MD57f8f210a6f11a1e556b8dd7bb26e2e7d
SHA149a1e7d58e43cc5e177de7857b8fa9c8a6f6d1c1
SHA256c7109e87b0d20b842816f055a8714f0eebccfa99a031e6b7a472397736329af7
SHA5121c414aa37879bed96a82a1d14658e58da6d085cd0a6d523a65780c9dc585d78afa99eefc64dc5d9961702dc5fdd8b647f9475eed25ef67287de01f82962921a7
-
Filesize
198KB
MD505053c75e7990b751933d1bfffdb7ad1
SHA1ce609dfac995d70596b9df22ed6a8cd4e2da96d3
SHA2567ef58d246cc28f19808b28613a287b2cc2d2f359b17b5ca9a878e028e0a9bfae
SHA5128138755349167a473b1e5046c3af4fc6e097315e3e0e6eff6378d1123e2ebb9b36c59863ba8b43c8bc73be4f98721e81baf418b603fe07f3193a58b05937d97e
-
Filesize
84KB
MD51d78cc969d6d164f7c9c6605214f7f10
SHA1ab8a49fb4905bdd492671958a957b15060706daa
SHA256befef93e2df09e4bcad8518f8611bb615ef004bc0fabc4899e6e767184708cc6
SHA512a6d9f25d22cdf61d8f985bb219a4fcb14fe65de9ac0483cc74b7abbab537e2ca08b030714d1de2ef05da8fe4db41838adfc2c00aad4b671fd2c8a30c53865b69
-
Filesize
84KB
MD51d78cc969d6d164f7c9c6605214f7f10
SHA1ab8a49fb4905bdd492671958a957b15060706daa
SHA256befef93e2df09e4bcad8518f8611bb615ef004bc0fabc4899e6e767184708cc6
SHA512a6d9f25d22cdf61d8f985bb219a4fcb14fe65de9ac0483cc74b7abbab537e2ca08b030714d1de2ef05da8fe4db41838adfc2c00aad4b671fd2c8a30c53865b69
-
Filesize
84KB
MD51d78cc969d6d164f7c9c6605214f7f10
SHA1ab8a49fb4905bdd492671958a957b15060706daa
SHA256befef93e2df09e4bcad8518f8611bb615ef004bc0fabc4899e6e767184708cc6
SHA512a6d9f25d22cdf61d8f985bb219a4fcb14fe65de9ac0483cc74b7abbab537e2ca08b030714d1de2ef05da8fe4db41838adfc2c00aad4b671fd2c8a30c53865b69
-
Filesize
1.9MB
MD57f8f210a6f11a1e556b8dd7bb26e2e7d
SHA149a1e7d58e43cc5e177de7857b8fa9c8a6f6d1c1
SHA256c7109e87b0d20b842816f055a8714f0eebccfa99a031e6b7a472397736329af7
SHA5121c414aa37879bed96a82a1d14658e58da6d085cd0a6d523a65780c9dc585d78afa99eefc64dc5d9961702dc5fdd8b647f9475eed25ef67287de01f82962921a7
-
Filesize
1.9MB
MD57f8f210a6f11a1e556b8dd7bb26e2e7d
SHA149a1e7d58e43cc5e177de7857b8fa9c8a6f6d1c1
SHA256c7109e87b0d20b842816f055a8714f0eebccfa99a031e6b7a472397736329af7
SHA5121c414aa37879bed96a82a1d14658e58da6d085cd0a6d523a65780c9dc585d78afa99eefc64dc5d9961702dc5fdd8b647f9475eed25ef67287de01f82962921a7
-
Filesize
196KB
-
Filesize
400KB
-
Filesize
168KB
-
Filesize
400KB
-
Filesize
168KB
-
Filesize
400KB
-
Filesize
136KB