Analysis
-
max time kernel
120s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20231025-en -
resource tags
-
submitted
01-12-2023 03:03
General
-
Target
b1b3d39b039dc591aeedda6195b5a8da9044e1bf4d574f471050447dba6a4ca2.exe
-
Size
2.8MB
-
MD5
fb5c3286d10602c46a2eda71f6dc9f80
-
SHA1
55f35e2fec2c4dd7bb050b5559728f78e33b377c
-
SHA256
b1b3d39b039dc591aeedda6195b5a8da9044e1bf4d574f471050447dba6a4ca2
-
SHA512
4d0e4ba8b45811d8fbc723404a5a446d6337f43e4ef30f4afac6224aa030e70f63e82374c93bfd43c5932b5410a0ba71bd42d7c88d03d776af2fb4588a187fbf
-
SSDEEP
49152:rLY5etGvnVEAjHWgYGe7dquNGAnOtNmpHdHEIyQrZX6uaMmSv/VcYpD/UVJ1BclU:40tGvnVhHWgYGoquNLnOtNmpHdk4X6ui
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload 2 IoCs
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 4 IoCs
-
Drops file in Program Files directory 6 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 53 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b1b3d39b039dc591aeedda6195b5a8da9044e1bf4d574f471050447dba6a4ca2.exe"C:\Users\Admin\AppData\Local\Temp\b1b3d39b039dc591aeedda6195b5a8da9044e1bf4d574f471050447dba6a4ca2.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Application Verifier\QQMicroGameBox.exe"C:\Program Files (x86)\Application Verifier\QQMicroGameBox.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\QQMicroGameBox.exe"C:\Users\Admin\AppData\Local\QQMicroGameBox.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.9MB
MD57f8f210a6f11a1e556b8dd7bb26e2e7d
SHA149a1e7d58e43cc5e177de7857b8fa9c8a6f6d1c1
SHA256c7109e87b0d20b842816f055a8714f0eebccfa99a031e6b7a472397736329af7
SHA5121c414aa37879bed96a82a1d14658e58da6d085cd0a6d523a65780c9dc585d78afa99eefc64dc5d9961702dc5fdd8b647f9475eed25ef67287de01f82962921a7
-
Filesize
1.9MB
MD57f8f210a6f11a1e556b8dd7bb26e2e7d
SHA149a1e7d58e43cc5e177de7857b8fa9c8a6f6d1c1
SHA256c7109e87b0d20b842816f055a8714f0eebccfa99a031e6b7a472397736329af7
SHA5121c414aa37879bed96a82a1d14658e58da6d085cd0a6d523a65780c9dc585d78afa99eefc64dc5d9961702dc5fdd8b647f9475eed25ef67287de01f82962921a7
-
Filesize
198KB
MD58d7b75e76767e7d80ba2d7c5f012cd53
SHA1a3b2f2dabc3ddd47d9c53b74202358136b23d2f9
SHA2564afd5abe32b72232a25e44c88f5af96f182c9ce8d06f3aa44970e5366989af43
SHA512d964016717b7fc4a9f443de9c85ec507d6c823b7616d8b51f31e5cacf992fd3519c170ea2cf14a88f0b3b17670871637a679807bf11f990d5e26eb00335feeb0
-
Filesize
41KB
MD580ecab1e6964fd8317a370c5afe6e701
SHA17243fa4607c5c7c8a055eb1351a4b02a24507013
SHA256fb701b41656908d9e4b14a1f368809a6a5d8c80b365cecf5b07c5414cc55ce7b
SHA5120cec55f9006a66035b61cd598961c85d70a84282b0c8cf093d197b0221862847505be39f8170cfe19a2a5ce6c961f2c40a60a3bc27a368ca9e3919f3487b9ac4
-
Filesize
1.9MB
MD57f8f210a6f11a1e556b8dd7bb26e2e7d
SHA149a1e7d58e43cc5e177de7857b8fa9c8a6f6d1c1
SHA256c7109e87b0d20b842816f055a8714f0eebccfa99a031e6b7a472397736329af7
SHA5121c414aa37879bed96a82a1d14658e58da6d085cd0a6d523a65780c9dc585d78afa99eefc64dc5d9961702dc5fdd8b647f9475eed25ef67287de01f82962921a7
-
Filesize
1.9MB
MD57f8f210a6f11a1e556b8dd7bb26e2e7d
SHA149a1e7d58e43cc5e177de7857b8fa9c8a6f6d1c1
SHA256c7109e87b0d20b842816f055a8714f0eebccfa99a031e6b7a472397736329af7
SHA5121c414aa37879bed96a82a1d14658e58da6d085cd0a6d523a65780c9dc585d78afa99eefc64dc5d9961702dc5fdd8b647f9475eed25ef67287de01f82962921a7
-
Filesize
1.9MB
MD57f8f210a6f11a1e556b8dd7bb26e2e7d
SHA149a1e7d58e43cc5e177de7857b8fa9c8a6f6d1c1
SHA256c7109e87b0d20b842816f055a8714f0eebccfa99a031e6b7a472397736329af7
SHA5121c414aa37879bed96a82a1d14658e58da6d085cd0a6d523a65780c9dc585d78afa99eefc64dc5d9961702dc5fdd8b647f9475eed25ef67287de01f82962921a7
-
Filesize
1.9MB
MD57f8f210a6f11a1e556b8dd7bb26e2e7d
SHA149a1e7d58e43cc5e177de7857b8fa9c8a6f6d1c1
SHA256c7109e87b0d20b842816f055a8714f0eebccfa99a031e6b7a472397736329af7
SHA5121c414aa37879bed96a82a1d14658e58da6d085cd0a6d523a65780c9dc585d78afa99eefc64dc5d9961702dc5fdd8b647f9475eed25ef67287de01f82962921a7
-
Filesize
41KB
MD580ecab1e6964fd8317a370c5afe6e701
SHA17243fa4607c5c7c8a055eb1351a4b02a24507013
SHA256fb701b41656908d9e4b14a1f368809a6a5d8c80b365cecf5b07c5414cc55ce7b
SHA5120cec55f9006a66035b61cd598961c85d70a84282b0c8cf093d197b0221862847505be39f8170cfe19a2a5ce6c961f2c40a60a3bc27a368ca9e3919f3487b9ac4
-
Filesize
41KB
MD580ecab1e6964fd8317a370c5afe6e701
SHA17243fa4607c5c7c8a055eb1351a4b02a24507013
SHA256fb701b41656908d9e4b14a1f368809a6a5d8c80b365cecf5b07c5414cc55ce7b
SHA5120cec55f9006a66035b61cd598961c85d70a84282b0c8cf093d197b0221862847505be39f8170cfe19a2a5ce6c961f2c40a60a3bc27a368ca9e3919f3487b9ac4
-
Filesize
1.9MB
MD57f8f210a6f11a1e556b8dd7bb26e2e7d
SHA149a1e7d58e43cc5e177de7857b8fa9c8a6f6d1c1
SHA256c7109e87b0d20b842816f055a8714f0eebccfa99a031e6b7a472397736329af7
SHA5121c414aa37879bed96a82a1d14658e58da6d085cd0a6d523a65780c9dc585d78afa99eefc64dc5d9961702dc5fdd8b647f9475eed25ef67287de01f82962921a7
-
Filesize
168KB
-
Filesize
400KB
-
Filesize
196KB
-
Filesize
136KB
-
Filesize
400KB
-
Filesize
168KB
-
Filesize
400KB