Analysis
-
max time kernel
121s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20231025-en -
resource tags
-
submitted
05-12-2023 16:46
General
-
Target
d526fabab53957d2f0d399d1f0181f2426635aeacdca76bd6ff4f70ff11858c9.exe
-
Size
2.8MB
-
MD5
541223c59d0b222184dbfa85f72d4324
-
SHA1
15f20b79dcbbcec73e8877cae40b8e060063cfcf
-
SHA256
d526fabab53957d2f0d399d1f0181f2426635aeacdca76bd6ff4f70ff11858c9
-
SHA512
619bd8af46bbc9ee137de4a2d9b574aafb3e96d129d8f7627e68ff35730a150e0d75182a87557eb24a39e12baf9468903b4f51184b85616f2e7788aa85042e49
-
SSDEEP
49152:FIReUCpSq8TBMxcD1Z9sCykCRKjadHik88wzNSQ1RHKevdIXYwp426/VcYpD/UV3:rzpShT8o1Z9ssCRKjadHik88h+HTvdIN
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload 2 IoCs
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 4 IoCs
-
Drops file in Program Files directory 6 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 53 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d526fabab53957d2f0d399d1f0181f2426635aeacdca76bd6ff4f70ff11858c9.exe"C:\Users\Admin\AppData\Local\Temp\d526fabab53957d2f0d399d1f0181f2426635aeacdca76bd6ff4f70ff11858c9.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Application Verifier\QQMicroGameBox.exe"C:\Program Files (x86)\Application Verifier\QQMicroGameBox.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\QQMicroGameBox.exe"C:\Users\Admin\AppData\Local\QQMicroGameBox.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.9MB
MD57f8f210a6f11a1e556b8dd7bb26e2e7d
SHA149a1e7d58e43cc5e177de7857b8fa9c8a6f6d1c1
SHA256c7109e87b0d20b842816f055a8714f0eebccfa99a031e6b7a472397736329af7
SHA5121c414aa37879bed96a82a1d14658e58da6d085cd0a6d523a65780c9dc585d78afa99eefc64dc5d9961702dc5fdd8b647f9475eed25ef67287de01f82962921a7
-
Filesize
1.9MB
MD57f8f210a6f11a1e556b8dd7bb26e2e7d
SHA149a1e7d58e43cc5e177de7857b8fa9c8a6f6d1c1
SHA256c7109e87b0d20b842816f055a8714f0eebccfa99a031e6b7a472397736329af7
SHA5121c414aa37879bed96a82a1d14658e58da6d085cd0a6d523a65780c9dc585d78afa99eefc64dc5d9961702dc5fdd8b647f9475eed25ef67287de01f82962921a7
-
Filesize
198KB
MD5f366dac933970f44d93c67875ec656e3
SHA1e0b39137e1afce9bb3ea4be421091f7f62d045a5
SHA2562670ae7ac41715c1114c91ca89682a1b9c522727397f182b8bd162d4a89cf534
SHA5129ea1ee338d9ff4e480e1936ab11c425db38ce97dd7f89675164e9ceac5db8f0fac660c590db47050377056540f9346de9d388429fa71b3f0dc7f088e6cb91697
-
Filesize
49KB
MD5ba2e2fd07d935adc95090696cf9a636f
SHA1cc6077e50b86ff845fc4a637573f86c452c5f69f
SHA256961e3272a08a7652d4197be2a0fb1b6aa75524f5ccadd1942267cfc743be95fc
SHA512f9bdbb070f1105e530a3f0c9085180f61c34ab4750e4f3be9cc4da23c4040c1fa5d5d9e26cfa526e7b7de8ea41b0e1a3216e69a298246dbf6f5ada00510ca0c7
-
Filesize
1.9MB
MD57f8f210a6f11a1e556b8dd7bb26e2e7d
SHA149a1e7d58e43cc5e177de7857b8fa9c8a6f6d1c1
SHA256c7109e87b0d20b842816f055a8714f0eebccfa99a031e6b7a472397736329af7
SHA5121c414aa37879bed96a82a1d14658e58da6d085cd0a6d523a65780c9dc585d78afa99eefc64dc5d9961702dc5fdd8b647f9475eed25ef67287de01f82962921a7
-
Filesize
1.9MB
MD57f8f210a6f11a1e556b8dd7bb26e2e7d
SHA149a1e7d58e43cc5e177de7857b8fa9c8a6f6d1c1
SHA256c7109e87b0d20b842816f055a8714f0eebccfa99a031e6b7a472397736329af7
SHA5121c414aa37879bed96a82a1d14658e58da6d085cd0a6d523a65780c9dc585d78afa99eefc64dc5d9961702dc5fdd8b647f9475eed25ef67287de01f82962921a7
-
Filesize
1.9MB
MD57f8f210a6f11a1e556b8dd7bb26e2e7d
SHA149a1e7d58e43cc5e177de7857b8fa9c8a6f6d1c1
SHA256c7109e87b0d20b842816f055a8714f0eebccfa99a031e6b7a472397736329af7
SHA5121c414aa37879bed96a82a1d14658e58da6d085cd0a6d523a65780c9dc585d78afa99eefc64dc5d9961702dc5fdd8b647f9475eed25ef67287de01f82962921a7
-
Filesize
1.9MB
MD57f8f210a6f11a1e556b8dd7bb26e2e7d
SHA149a1e7d58e43cc5e177de7857b8fa9c8a6f6d1c1
SHA256c7109e87b0d20b842816f055a8714f0eebccfa99a031e6b7a472397736329af7
SHA5121c414aa37879bed96a82a1d14658e58da6d085cd0a6d523a65780c9dc585d78afa99eefc64dc5d9961702dc5fdd8b647f9475eed25ef67287de01f82962921a7
-
Filesize
49KB
MD5ba2e2fd07d935adc95090696cf9a636f
SHA1cc6077e50b86ff845fc4a637573f86c452c5f69f
SHA256961e3272a08a7652d4197be2a0fb1b6aa75524f5ccadd1942267cfc743be95fc
SHA512f9bdbb070f1105e530a3f0c9085180f61c34ab4750e4f3be9cc4da23c4040c1fa5d5d9e26cfa526e7b7de8ea41b0e1a3216e69a298246dbf6f5ada00510ca0c7
-
Filesize
49KB
MD5ba2e2fd07d935adc95090696cf9a636f
SHA1cc6077e50b86ff845fc4a637573f86c452c5f69f
SHA256961e3272a08a7652d4197be2a0fb1b6aa75524f5ccadd1942267cfc743be95fc
SHA512f9bdbb070f1105e530a3f0c9085180f61c34ab4750e4f3be9cc4da23c4040c1fa5d5d9e26cfa526e7b7de8ea41b0e1a3216e69a298246dbf6f5ada00510ca0c7
-
Filesize
1.9MB
MD57f8f210a6f11a1e556b8dd7bb26e2e7d
SHA149a1e7d58e43cc5e177de7857b8fa9c8a6f6d1c1
SHA256c7109e87b0d20b842816f055a8714f0eebccfa99a031e6b7a472397736329af7
SHA5121c414aa37879bed96a82a1d14658e58da6d085cd0a6d523a65780c9dc585d78afa99eefc64dc5d9961702dc5fdd8b647f9475eed25ef67287de01f82962921a7
-
Filesize
168KB
-
Filesize
400KB
-
Filesize
136KB
-
Filesize
400KB
-
Filesize
168KB
-
Filesize
196KB
-
Filesize
400KB