Analysis
-
max time kernel
121s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20231130-en -
resource tags
-
submitted
07-12-2023 01:36
General
-
Target
30dc5dc2f8ee89b8a7b764b09c163929f8710d6d49d38c8021eccf029a066961.exe
-
Size
3.9MB
-
MD5
ce29721e3d1b71c975df9acc77ab23ca
-
SHA1
48d53c0e1da944a20c6b681a0270e00dff2e35c8
-
SHA256
30dc5dc2f8ee89b8a7b764b09c163929f8710d6d49d38c8021eccf029a066961
-
SHA512
103edf608282cdc650d369c3bc020766ca8982096adca8d84737f36f9815b25fe30ccb3d7565650142210663a6321d86568c47792085e450ae2596f4695b0373
-
SSDEEP
98304:+18SHoZeL0ZK3XOloYZ5XR1b8CbQDlogUeFeiCRoRIzDE3R/YrvPcX/:+188oZeLs267b8uCeeAiCR0gDuSvPcX
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Drops file in Program Files directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 53 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\30dc5dc2f8ee89b8a7b764b09c163929f8710d6d49d38c8021eccf029a066961.exe"C:\Users\Admin\AppData\Local\Temp\30dc5dc2f8ee89b8a7b764b09c163929f8710d6d49d38c8021eccf029a066961.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Sofa32\cef_render.exe"C:\Program Files (x86)\Sofa32\cef_render.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
822KB
MD5764a44a428c0f3c5170cb099a65bd51d
SHA146ca3c34a7a38b3cf51a18ba804b81cc270ea614
SHA25667aa81c9252beb1d2526027eb12f6e3f4603284439953c9f5503fa9d42a2fe03
SHA512ec26ed0fbe14ab35f1fa3d50450c83670e641f5e2b9d1ca26628524f0c851544ceb1f337fa3b0228eb425daaf69ec053f3abd443597d2644573400ee85e5d7af
-
Filesize
822KB
MD5764a44a428c0f3c5170cb099a65bd51d
SHA146ca3c34a7a38b3cf51a18ba804b81cc270ea614
SHA25667aa81c9252beb1d2526027eb12f6e3f4603284439953c9f5503fa9d42a2fe03
SHA512ec26ed0fbe14ab35f1fa3d50450c83670e641f5e2b9d1ca26628524f0c851544ceb1f337fa3b0228eb425daaf69ec053f3abd443597d2644573400ee85e5d7af
-
Filesize
156KB
MD5de867299bdbb12cb0cc69238b5e6e367
SHA1d7757578c815bd91b8aa98e52c0ccd2470913b71
SHA256e258e18ab4454e2fd8a60e11eb0f83fe2ec6c5c7a21476d608aa7095eff346fd
SHA512848c4cc126e3570f2803ea499ee90d82ee27d20f803b3315f14a6faa487b52ab7fc34bedd5f6f9dd4188a300dce9a205e3254a9c7cbdbaf48083c224d2c95851
-
Filesize
198KB
MD57f4f6f2fb0767d623598787c80a3886e
SHA16e80630908741661b8227c25a35047d5c86cc0ba
SHA2561cf5a49f808e3297bfd47c2e38c75bf7ac875470f52969b0bd55d57ae44ddaa8
SHA512f9d7b51e9d3d9f08374a500c0b7d09f67864164208268ccdfd4d3ae89a7155734f70dc25f4f6528e16be60674a772a7347ad610416a118100f1e699a9d0bafc5
-
Filesize
822KB
MD5764a44a428c0f3c5170cb099a65bd51d
SHA146ca3c34a7a38b3cf51a18ba804b81cc270ea614
SHA25667aa81c9252beb1d2526027eb12f6e3f4603284439953c9f5503fa9d42a2fe03
SHA512ec26ed0fbe14ab35f1fa3d50450c83670e641f5e2b9d1ca26628524f0c851544ceb1f337fa3b0228eb425daaf69ec053f3abd443597d2644573400ee85e5d7af
-
Filesize
156KB
MD5de867299bdbb12cb0cc69238b5e6e367
SHA1d7757578c815bd91b8aa98e52c0ccd2470913b71
SHA256e258e18ab4454e2fd8a60e11eb0f83fe2ec6c5c7a21476d608aa7095eff346fd
SHA512848c4cc126e3570f2803ea499ee90d82ee27d20f803b3315f14a6faa487b52ab7fc34bedd5f6f9dd4188a300dce9a205e3254a9c7cbdbaf48083c224d2c95851
-
Filesize
196KB
-
Filesize
400KB
-
Filesize
168KB
-
Filesize
13.1MB
-
Filesize
13.1MB
-
Filesize
3.8MB
-
Filesize
4KB
-
Filesize
3.8MB