Analysis
-
max time kernel
131s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
-
submitted
01-12-2023 11:03
General
-
Target
fe67f80a73b6fa7d3020492e8fe0bb5261e838758ecd8069daabd3f74aea095b.exe
-
Size
3.9MB
-
MD5
fe0768b33b57930a3290f9cfab4c1159
-
SHA1
26ea1f56ab4a96c256f9c6423d94c12073c44a84
-
SHA256
fe67f80a73b6fa7d3020492e8fe0bb5261e838758ecd8069daabd3f74aea095b
-
SHA512
402a52aa381839c9d295cf6eb070fba99d0e250ee438801e4ae014b5134b62bd04e72138043aba96d6c4562a4914c64f1c812cb86477f038524dd5198974687b
-
SSDEEP
49152:ew1MCHSGX17X8q5CVIRjOHGLis8e9YNcCyN/VcYpD/UVJ1BclhE5di8UR0mxvnMF:eovHz7X3jOHM8eMM/VcixhE5rPKPIb
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload 2 IoCs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 2 IoCs
-
Drops file in Program Files directory 6 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe67f80a73b6fa7d3020492e8fe0bb5261e838758ecd8069daabd3f74aea095b.exe"C:\Users\Admin\AppData\Local\Temp\fe67f80a73b6fa7d3020492e8fe0bb5261e838758ecd8069daabd3f74aea095b.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Application Verifier\QQMicroGameBox.exe"C:\Program Files (x86)\Application Verifier\QQMicroGameBox.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\QQMicroGameBox.exe"C:\Users\Admin\AppData\Local\QQMicroGameBox.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.9MB
MD57f8f210a6f11a1e556b8dd7bb26e2e7d
SHA149a1e7d58e43cc5e177de7857b8fa9c8a6f6d1c1
SHA256c7109e87b0d20b842816f055a8714f0eebccfa99a031e6b7a472397736329af7
SHA5121c414aa37879bed96a82a1d14658e58da6d085cd0a6d523a65780c9dc585d78afa99eefc64dc5d9961702dc5fdd8b647f9475eed25ef67287de01f82962921a7
-
Filesize
1.9MB
MD57f8f210a6f11a1e556b8dd7bb26e2e7d
SHA149a1e7d58e43cc5e177de7857b8fa9c8a6f6d1c1
SHA256c7109e87b0d20b842816f055a8714f0eebccfa99a031e6b7a472397736329af7
SHA5121c414aa37879bed96a82a1d14658e58da6d085cd0a6d523a65780c9dc585d78afa99eefc64dc5d9961702dc5fdd8b647f9475eed25ef67287de01f82962921a7
-
Filesize
1.9MB
MD57f8f210a6f11a1e556b8dd7bb26e2e7d
SHA149a1e7d58e43cc5e177de7857b8fa9c8a6f6d1c1
SHA256c7109e87b0d20b842816f055a8714f0eebccfa99a031e6b7a472397736329af7
SHA5121c414aa37879bed96a82a1d14658e58da6d085cd0a6d523a65780c9dc585d78afa99eefc64dc5d9961702dc5fdd8b647f9475eed25ef67287de01f82962921a7
-
Filesize
198KB
MD58d7b75e76767e7d80ba2d7c5f012cd53
SHA1a3b2f2dabc3ddd47d9c53b74202358136b23d2f9
SHA2564afd5abe32b72232a25e44c88f5af96f182c9ce8d06f3aa44970e5366989af43
SHA512d964016717b7fc4a9f443de9c85ec507d6c823b7616d8b51f31e5cacf992fd3519c170ea2cf14a88f0b3b17670871637a679807bf11f990d5e26eb00335feeb0
-
Filesize
84KB
MD51d78cc969d6d164f7c9c6605214f7f10
SHA1ab8a49fb4905bdd492671958a957b15060706daa
SHA256befef93e2df09e4bcad8518f8611bb615ef004bc0fabc4899e6e767184708cc6
SHA512a6d9f25d22cdf61d8f985bb219a4fcb14fe65de9ac0483cc74b7abbab537e2ca08b030714d1de2ef05da8fe4db41838adfc2c00aad4b671fd2c8a30c53865b69
-
Filesize
84KB
MD51d78cc969d6d164f7c9c6605214f7f10
SHA1ab8a49fb4905bdd492671958a957b15060706daa
SHA256befef93e2df09e4bcad8518f8611bb615ef004bc0fabc4899e6e767184708cc6
SHA512a6d9f25d22cdf61d8f985bb219a4fcb14fe65de9ac0483cc74b7abbab537e2ca08b030714d1de2ef05da8fe4db41838adfc2c00aad4b671fd2c8a30c53865b69
-
Filesize
84KB
MD51d78cc969d6d164f7c9c6605214f7f10
SHA1ab8a49fb4905bdd492671958a957b15060706daa
SHA256befef93e2df09e4bcad8518f8611bb615ef004bc0fabc4899e6e767184708cc6
SHA512a6d9f25d22cdf61d8f985bb219a4fcb14fe65de9ac0483cc74b7abbab537e2ca08b030714d1de2ef05da8fe4db41838adfc2c00aad4b671fd2c8a30c53865b69
-
Filesize
1.9MB
MD57f8f210a6f11a1e556b8dd7bb26e2e7d
SHA149a1e7d58e43cc5e177de7857b8fa9c8a6f6d1c1
SHA256c7109e87b0d20b842816f055a8714f0eebccfa99a031e6b7a472397736329af7
SHA5121c414aa37879bed96a82a1d14658e58da6d085cd0a6d523a65780c9dc585d78afa99eefc64dc5d9961702dc5fdd8b647f9475eed25ef67287de01f82962921a7
-
Filesize
1.9MB
MD57f8f210a6f11a1e556b8dd7bb26e2e7d
SHA149a1e7d58e43cc5e177de7857b8fa9c8a6f6d1c1
SHA256c7109e87b0d20b842816f055a8714f0eebccfa99a031e6b7a472397736329af7
SHA5121c414aa37879bed96a82a1d14658e58da6d085cd0a6d523a65780c9dc585d78afa99eefc64dc5d9961702dc5fdd8b647f9475eed25ef67287de01f82962921a7
-
Filesize
400KB
-
Filesize
136KB
-
Filesize
400KB
-
Filesize
168KB
-
Filesize
196KB
-
Filesize
400KB
-
Filesize
168KB