Analysis
-
max time kernel
146s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
-
submitted
05-12-2023 17:15
General
-
Target
ee1f34934049869dd608a6f1bea4aa5e0d27af7d197c96a21df301b60af64f53.exe
-
Size
10.0MB
-
MD5
73035d421b0a5db8728c28888ad73593
-
SHA1
5b3279de1d7991d93e07f1efde31d5b0872114b0
-
SHA256
ee1f34934049869dd608a6f1bea4aa5e0d27af7d197c96a21df301b60af64f53
-
SHA512
3f28920e9d6458dd0d3b7ad9bd30b5199e1d61c735563c0b1bf52cf4b8c5e473e5b7a938fa1244d98bb3704bb9ea32bc14e6bce406f810e8ed4a5c4314da1246
-
SSDEEP
196608:DrudeaplDyMSWKFPQwRX/taBdeTDClnHdcUQiBQ+rEKRquFYj+Ibho7:Dxaple9Fr5tp/Cl9/xFrt5FYj+G
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload 1 IoCs
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
-
ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
-
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 3 IoCs
-
Themida packer 20 IoCs
Detects Themida, an advanced Windows software protection system.
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Drops file in Program Files directory 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 55 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee1f34934049869dd608a6f1bea4aa5e0d27af7d197c96a21df301b60af64f53.exe"C:\Users\Admin\AppData\Local\Temp\ee1f34934049869dd608a6f1bea4aa5e0d27af7d197c96a21df301b60af64f53.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Funshion\Updater.exe"C:\Program Files (x86)\Funshion\Updater.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
234KB
MD549fdb26643239695c5faa0677965a94c
SHA1308bdcac85a1a61b0e8efccb6603a58c0c68e8ef
SHA2567b56b12a0e16f2123110222e3884ac44fddf2cb9c780b053d3e29c3468b3a256
SHA51264fc81965a5e564b2896f01f5419a3644f4b3f251422b0e81ad125f7c3145a9a23df58d7a0dcf8da06963a70f974d223646d7fa0e1e532f46e2d06d721b1e22d
-
Filesize
3.4MB
MD53e70fba5ef28862d49f63ac683859aa6
SHA17f74f5e0106d89e5c5e9b8cac71d28afaa790115
SHA25648c0f15c264d00bf7053531de69bc44a8d31246a1f867acfc5f48ec705624bd1
SHA5120be2e7d7dd1c07c348f2d1010d452972cba1db501c6ee69a1a40d68908866fb744a24f58caf9430b7ab48b78f4d0be06ce7ba7e0ce3fb0b4d8f903670e30ee1a
-
Filesize
3.4MB
MD53e70fba5ef28862d49f63ac683859aa6
SHA17f74f5e0106d89e5c5e9b8cac71d28afaa790115
SHA25648c0f15c264d00bf7053531de69bc44a8d31246a1f867acfc5f48ec705624bd1
SHA5120be2e7d7dd1c07c348f2d1010d452972cba1db501c6ee69a1a40d68908866fb744a24f58caf9430b7ab48b78f4d0be06ce7ba7e0ce3fb0b4d8f903670e30ee1a
-
Filesize
4.1MB
MD592f6caf3d0638a6d704f3eacbecb1a22
SHA190f0127e5fcce30d5466f469327f55f1810d330f
SHA256c570ec6625dc1d230df9f71176504477e49a37295e686c18272dcaa4d27abaa8
SHA512338da2ea8463b83248a5f818e77819506aeb6f10218395f6db73713c79bc8a316d17f4531eb196b98fe70a286ee10da14826816617a6bfcd1eea1a3364ef6e5c
-
Filesize
198KB
MD50a3e7298368aad0d573436d1ba82edd0
SHA1f1ba74aa2e5ec4350c59377bbc459d023d3b66c5
SHA256b889501c0ea0be389ddb310e2cd8de1d54397ed609c02247426bdf12e487229a
SHA512b0fae7327216cc49d2ec09d0d164ca9cdcd24dadb6c98358a5b5eecb7b60e3966554880535ba63cc1b7f26dfd1b4410dcc7a0cba2b64890c4fe7567dce652bbf
-
Filesize
234KB
MD549fdb26643239695c5faa0677965a94c
SHA1308bdcac85a1a61b0e8efccb6603a58c0c68e8ef
SHA2567b56b12a0e16f2123110222e3884ac44fddf2cb9c780b053d3e29c3468b3a256
SHA51264fc81965a5e564b2896f01f5419a3644f4b3f251422b0e81ad125f7c3145a9a23df58d7a0dcf8da06963a70f974d223646d7fa0e1e532f46e2d06d721b1e22d
-
Filesize
3.4MB
MD53e70fba5ef28862d49f63ac683859aa6
SHA17f74f5e0106d89e5c5e9b8cac71d28afaa790115
SHA25648c0f15c264d00bf7053531de69bc44a8d31246a1f867acfc5f48ec705624bd1
SHA5120be2e7d7dd1c07c348f2d1010d452972cba1db501c6ee69a1a40d68908866fb744a24f58caf9430b7ab48b78f4d0be06ce7ba7e0ce3fb0b4d8f903670e30ee1a
-
Filesize
4.1MB
MD592f6caf3d0638a6d704f3eacbecb1a22
SHA190f0127e5fcce30d5466f469327f55f1810d330f
SHA256c570ec6625dc1d230df9f71176504477e49a37295e686c18272dcaa4d27abaa8
SHA512338da2ea8463b83248a5f818e77819506aeb6f10218395f6db73713c79bc8a316d17f4531eb196b98fe70a286ee10da14826816617a6bfcd1eea1a3364ef6e5c
-
Filesize
15.6MB
-
Filesize
15.6MB
-
Filesize
15.6MB
-
Filesize
15.6MB
-
Filesize
15.6MB
-
Filesize
15.6MB
-
Filesize
8KB
-
Filesize
15.6MB
-
Filesize
15.6MB
-
Filesize
15.6MB
-
Filesize
10.2MB
-
Filesize
168KB
-
Filesize
10.2MB
-
Filesize
10.2MB
-
Filesize
196KB
-
Filesize
696KB
-
Filesize
564KB
-
Filesize
10.2MB
-
Filesize
10.2MB
-
Filesize
10.2MB
-
Filesize
564KB
-
Filesize
10.2MB
-
Filesize
10.2MB
-
Filesize
564KB
-
Filesize
10.2MB
-
Filesize
564KB