Analysis
-
max time kernel
143s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
-
submitted
05-12-2023 17:43
General
-
Target
ec945f2d6b7a41cd6f9ed4b370f8a0bc595db3cfd8abfeb9edc06aa88b67729a.exe
-
Size
5.5MB
-
MD5
d414027b4174b50f1b66b4591414673e
-
SHA1
633efc9e4ee12c0eae5431b434adcf410731950b
-
SHA256
ec945f2d6b7a41cd6f9ed4b370f8a0bc595db3cfd8abfeb9edc06aa88b67729a
-
SHA512
581333ed6ca5e13c7e21ffc51422fdf5cd34592c9c3d91ef5241cdd1ccdd1cf8ca455762f3688d4faa4adff246b219ae1cc24f1098909b78f59fd7c72be42218
-
SSDEEP
98304:YclLQZyVp1vSIpvrU38WSJWN5orrj6/GGQGSZ2P4SNuF2Fo0i+M7xdI:V1BnU38WNibGSYP4w0RxX7xdI
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload 1 IoCs
-
ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 3 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Drops file in Program Files directory 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 53 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ec945f2d6b7a41cd6f9ed4b370f8a0bc595db3cfd8abfeb9edc06aa88b67729a.exe"C:\Users\Admin\AppData\Local\Temp\ec945f2d6b7a41cd6f9ed4b370f8a0bc595db3cfd8abfeb9edc06aa88b67729a.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Funshion\Updater.exe"C:\Program Files (x86)\Funshion\Updater.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
234KB
MD549fdb26643239695c5faa0677965a94c
SHA1308bdcac85a1a61b0e8efccb6603a58c0c68e8ef
SHA2567b56b12a0e16f2123110222e3884ac44fddf2cb9c780b053d3e29c3468b3a256
SHA51264fc81965a5e564b2896f01f5419a3644f4b3f251422b0e81ad125f7c3145a9a23df58d7a0dcf8da06963a70f974d223646d7fa0e1e532f46e2d06d721b1e22d
-
Filesize
3.4MB
MD53e70fba5ef28862d49f63ac683859aa6
SHA17f74f5e0106d89e5c5e9b8cac71d28afaa790115
SHA25648c0f15c264d00bf7053531de69bc44a8d31246a1f867acfc5f48ec705624bd1
SHA5120be2e7d7dd1c07c348f2d1010d452972cba1db501c6ee69a1a40d68908866fb744a24f58caf9430b7ab48b78f4d0be06ce7ba7e0ce3fb0b4d8f903670e30ee1a
-
Filesize
3.4MB
MD53e70fba5ef28862d49f63ac683859aa6
SHA17f74f5e0106d89e5c5e9b8cac71d28afaa790115
SHA25648c0f15c264d00bf7053531de69bc44a8d31246a1f867acfc5f48ec705624bd1
SHA5120be2e7d7dd1c07c348f2d1010d452972cba1db501c6ee69a1a40d68908866fb744a24f58caf9430b7ab48b78f4d0be06ce7ba7e0ce3fb0b4d8f903670e30ee1a
-
Filesize
181KB
MD5aad80396201a6e9ce14d806f5ba1f507
SHA1abc52c284ef9727d99ef596114b03cdce8a0fc38
SHA256b66225b2e4fd0f445518a3a21469da2af0a3fb95b42cf386a1f6b09a0c4ccc6e
SHA512b491723224790464187b9a5facfaf69ae48c4134957a07ca3ce6f3773cc7d515caca9a39b71903a91657fe568e14ca8f26515b2539dcb2dd88202a1cc792c94d
-
Filesize
198KB
MD5c68f04b5648ffe2e351d2f3831d708e5
SHA1e21871056c7b767bf357a1f5bc399fe7f1248a92
SHA256e5153b805563b3d00f7a7796d313f60685cc31b3f883fe47887ade617ca076aa
SHA5128807b38723f37c9b197a0d9f090c00fdd467ceb26ba810767676f16c29d6248a41ac6b41460a6b4972209ca0da5457622ce6b56205d0d27034bc57b6c5069d7d
-
Filesize
234KB
MD549fdb26643239695c5faa0677965a94c
SHA1308bdcac85a1a61b0e8efccb6603a58c0c68e8ef
SHA2567b56b12a0e16f2123110222e3884ac44fddf2cb9c780b053d3e29c3468b3a256
SHA51264fc81965a5e564b2896f01f5419a3644f4b3f251422b0e81ad125f7c3145a9a23df58d7a0dcf8da06963a70f974d223646d7fa0e1e532f46e2d06d721b1e22d
-
Filesize
3.4MB
MD53e70fba5ef28862d49f63ac683859aa6
SHA17f74f5e0106d89e5c5e9b8cac71d28afaa790115
SHA25648c0f15c264d00bf7053531de69bc44a8d31246a1f867acfc5f48ec705624bd1
SHA5120be2e7d7dd1c07c348f2d1010d452972cba1db501c6ee69a1a40d68908866fb744a24f58caf9430b7ab48b78f4d0be06ce7ba7e0ce3fb0b4d8f903670e30ee1a
-
Filesize
181KB
MD5aad80396201a6e9ce14d806f5ba1f507
SHA1abc52c284ef9727d99ef596114b03cdce8a0fc38
SHA256b66225b2e4fd0f445518a3a21469da2af0a3fb95b42cf386a1f6b09a0c4ccc6e
SHA512b491723224790464187b9a5facfaf69ae48c4134957a07ca3ce6f3773cc7d515caca9a39b71903a91657fe568e14ca8f26515b2539dcb2dd88202a1cc792c94d
-
Filesize
13.5MB
-
Filesize
3.8MB
-
Filesize
13.5MB
-
Filesize
4KB
-
Filesize
3.8MB
-
Filesize
400KB
-
Filesize
196KB
-
Filesize
564KB
-
Filesize
168KB
-
Filesize
564KB
-
Filesize
564KB