Analysis
-
max time kernel
121s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20231025-en -
resource tags
-
submitted
01-12-2023 21:03
General
-
Target
bbfed27c40fe643add2d5c29571bdf35373a5144ed46e02e5602f8b12336b6a5.exe
-
Size
3.9MB
-
MD5
b4853b1f25e77f9c49ac0977a6976e88
-
SHA1
cbb54eb656efc0ac7ff1be0062d42cde4c5689e5
-
SHA256
bbfed27c40fe643add2d5c29571bdf35373a5144ed46e02e5602f8b12336b6a5
-
SHA512
4dde6af63dc6a4db5e4744a1a3d76abf5e20b65b31050018c8075d656d4c2a00b6f7d7f760edbc42a8cc265d762c361ced7bf8555b8252a56cfa42437a014403
-
SSDEEP
49152:N9K4eAA3e/ttICC2K+5Ia9sF3/JplynF5C/VcYpD/UVJ1BclhE5di8UR0mxvn7Z:NQ4TEe1rCtYsF3lyF5C/VcixhE5rPKP
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload 2 IoCs
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 4 IoCs
-
Drops file in Program Files directory 6 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 53 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bbfed27c40fe643add2d5c29571bdf35373a5144ed46e02e5602f8b12336b6a5.exe"C:\Users\Admin\AppData\Local\Temp\bbfed27c40fe643add2d5c29571bdf35373a5144ed46e02e5602f8b12336b6a5.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Application Verifier\QQMicroGameBox.exe"C:\Program Files (x86)\Application Verifier\QQMicroGameBox.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\QQMicroGameBox.exe"C:\Users\Admin\AppData\Local\QQMicroGameBox.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.9MB
MD57f8f210a6f11a1e556b8dd7bb26e2e7d
SHA149a1e7d58e43cc5e177de7857b8fa9c8a6f6d1c1
SHA256c7109e87b0d20b842816f055a8714f0eebccfa99a031e6b7a472397736329af7
SHA5121c414aa37879bed96a82a1d14658e58da6d085cd0a6d523a65780c9dc585d78afa99eefc64dc5d9961702dc5fdd8b647f9475eed25ef67287de01f82962921a7
-
Filesize
1.9MB
MD57f8f210a6f11a1e556b8dd7bb26e2e7d
SHA149a1e7d58e43cc5e177de7857b8fa9c8a6f6d1c1
SHA256c7109e87b0d20b842816f055a8714f0eebccfa99a031e6b7a472397736329af7
SHA5121c414aa37879bed96a82a1d14658e58da6d085cd0a6d523a65780c9dc585d78afa99eefc64dc5d9961702dc5fdd8b647f9475eed25ef67287de01f82962921a7
-
Filesize
198KB
MD58d7b75e76767e7d80ba2d7c5f012cd53
SHA1a3b2f2dabc3ddd47d9c53b74202358136b23d2f9
SHA2564afd5abe32b72232a25e44c88f5af96f182c9ce8d06f3aa44970e5366989af43
SHA512d964016717b7fc4a9f443de9c85ec507d6c823b7616d8b51f31e5cacf992fd3519c170ea2cf14a88f0b3b17670871637a679807bf11f990d5e26eb00335feeb0
-
Filesize
84KB
MD51d78cc969d6d164f7c9c6605214f7f10
SHA1ab8a49fb4905bdd492671958a957b15060706daa
SHA256befef93e2df09e4bcad8518f8611bb615ef004bc0fabc4899e6e767184708cc6
SHA512a6d9f25d22cdf61d8f985bb219a4fcb14fe65de9ac0483cc74b7abbab537e2ca08b030714d1de2ef05da8fe4db41838adfc2c00aad4b671fd2c8a30c53865b69
-
Filesize
1.9MB
MD57f8f210a6f11a1e556b8dd7bb26e2e7d
SHA149a1e7d58e43cc5e177de7857b8fa9c8a6f6d1c1
SHA256c7109e87b0d20b842816f055a8714f0eebccfa99a031e6b7a472397736329af7
SHA5121c414aa37879bed96a82a1d14658e58da6d085cd0a6d523a65780c9dc585d78afa99eefc64dc5d9961702dc5fdd8b647f9475eed25ef67287de01f82962921a7
-
Filesize
1.9MB
MD57f8f210a6f11a1e556b8dd7bb26e2e7d
SHA149a1e7d58e43cc5e177de7857b8fa9c8a6f6d1c1
SHA256c7109e87b0d20b842816f055a8714f0eebccfa99a031e6b7a472397736329af7
SHA5121c414aa37879bed96a82a1d14658e58da6d085cd0a6d523a65780c9dc585d78afa99eefc64dc5d9961702dc5fdd8b647f9475eed25ef67287de01f82962921a7
-
Filesize
1.9MB
MD57f8f210a6f11a1e556b8dd7bb26e2e7d
SHA149a1e7d58e43cc5e177de7857b8fa9c8a6f6d1c1
SHA256c7109e87b0d20b842816f055a8714f0eebccfa99a031e6b7a472397736329af7
SHA5121c414aa37879bed96a82a1d14658e58da6d085cd0a6d523a65780c9dc585d78afa99eefc64dc5d9961702dc5fdd8b647f9475eed25ef67287de01f82962921a7
-
Filesize
1.9MB
MD57f8f210a6f11a1e556b8dd7bb26e2e7d
SHA149a1e7d58e43cc5e177de7857b8fa9c8a6f6d1c1
SHA256c7109e87b0d20b842816f055a8714f0eebccfa99a031e6b7a472397736329af7
SHA5121c414aa37879bed96a82a1d14658e58da6d085cd0a6d523a65780c9dc585d78afa99eefc64dc5d9961702dc5fdd8b647f9475eed25ef67287de01f82962921a7
-
Filesize
84KB
MD51d78cc969d6d164f7c9c6605214f7f10
SHA1ab8a49fb4905bdd492671958a957b15060706daa
SHA256befef93e2df09e4bcad8518f8611bb615ef004bc0fabc4899e6e767184708cc6
SHA512a6d9f25d22cdf61d8f985bb219a4fcb14fe65de9ac0483cc74b7abbab537e2ca08b030714d1de2ef05da8fe4db41838adfc2c00aad4b671fd2c8a30c53865b69
-
Filesize
84KB
MD51d78cc969d6d164f7c9c6605214f7f10
SHA1ab8a49fb4905bdd492671958a957b15060706daa
SHA256befef93e2df09e4bcad8518f8611bb615ef004bc0fabc4899e6e767184708cc6
SHA512a6d9f25d22cdf61d8f985bb219a4fcb14fe65de9ac0483cc74b7abbab537e2ca08b030714d1de2ef05da8fe4db41838adfc2c00aad4b671fd2c8a30c53865b69
-
Filesize
1.9MB
MD57f8f210a6f11a1e556b8dd7bb26e2e7d
SHA149a1e7d58e43cc5e177de7857b8fa9c8a6f6d1c1
SHA256c7109e87b0d20b842816f055a8714f0eebccfa99a031e6b7a472397736329af7
SHA5121c414aa37879bed96a82a1d14658e58da6d085cd0a6d523a65780c9dc585d78afa99eefc64dc5d9961702dc5fdd8b647f9475eed25ef67287de01f82962921a7
-
Filesize
168KB
-
Filesize
400KB
-
Filesize
196KB
-
Filesize
136KB
-
Filesize
120KB
-
Filesize
168KB
-
Filesize
400KB