Analysis
-
max time kernel
140s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
-
submitted
09/12/2023, 06:53
General
-
Target
b1009b8d107227e4ac86188a6f5f44e09814c65e8ed6077837f83253afe99225.exe
-
Size
2.6MB
-
MD5
5b15faa8c691740955275e26e80fafc5
-
SHA1
f478d3b62c3bc6fe909832928ae131380faa0468
-
SHA256
b1009b8d107227e4ac86188a6f5f44e09814c65e8ed6077837f83253afe99225
-
SHA512
f497e16d53315d830b29d6ade52671ea2d84aeb80391cad5bfba723c64d61ba5451b3957051ee188af8390f3eb8cfc5c5b44c02b09cee01f7ec9f30e4b852dca
-
SSDEEP
49152:zQoE06wk5MOufRnJ3v3WJwKnMcwbO49VgekNs39dvNfsg0O2iM2K:+/5KpJ3AirKN4vrp2Hl
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Drops file in Program Files directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b1009b8d107227e4ac86188a6f5f44e09814c65e8ed6077837f83253afe99225.exe"C:\Users\Admin\AppData\Local\Temp\b1009b8d107227e4ac86188a6f5f44e09814c65e8ed6077837f83253afe99225.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Actual\liaobei.exe"C:\Program Files (x86)\Actual\liaobei.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.6MB
MD591057184eb697259e88dff99a1e957cf
SHA10aad25610df49e54b2e6af9f888eff8fb5a99e07
SHA256149a58359c568d4a5ebb1fee53c5cba1dd63fdc14b165d043fd2a4c5f641ff67
SHA512e5b27feea207bb7d3d35f8b11b10d64cef7b947fb9aa2612fab6e69bb270c4bfe3f1316d477c7832ecd9f7fd9cb622721e2ee5ee717cef1954ad353221068ffe
-
Filesize
2.6MB
MD591057184eb697259e88dff99a1e957cf
SHA10aad25610df49e54b2e6af9f888eff8fb5a99e07
SHA256149a58359c568d4a5ebb1fee53c5cba1dd63fdc14b165d043fd2a4c5f641ff67
SHA512e5b27feea207bb7d3d35f8b11b10d64cef7b947fb9aa2612fab6e69bb270c4bfe3f1316d477c7832ecd9f7fd9cb622721e2ee5ee717cef1954ad353221068ffe
-
Filesize
2.6MB
MD591057184eb697259e88dff99a1e957cf
SHA10aad25610df49e54b2e6af9f888eff8fb5a99e07
SHA256149a58359c568d4a5ebb1fee53c5cba1dd63fdc14b165d043fd2a4c5f641ff67
SHA512e5b27feea207bb7d3d35f8b11b10d64cef7b947fb9aa2612fab6e69bb270c4bfe3f1316d477c7832ecd9f7fd9cb622721e2ee5ee717cef1954ad353221068ffe
-
Filesize
35KB
MD5c8a94c6c7ed5c2c11add2e1601d44b60
SHA13f0188484eebfcf60f9c0cc568c79e99af6fbc3c
SHA256423967caf82131d986e05deb1809dde356da3f053775069f0071816f8a5fa0c9
SHA5127c87218e495bcb0a247124157fe78c7e941f2c2fa65b86adb1db0c457322b1be2d46e3d77f13e134c9f83b3b87876088e708f1bd96e41e46545248362c70ba34
-
Filesize
35KB
MD5c8a94c6c7ed5c2c11add2e1601d44b60
SHA13f0188484eebfcf60f9c0cc568c79e99af6fbc3c
SHA256423967caf82131d986e05deb1809dde356da3f053775069f0071816f8a5fa0c9
SHA5127c87218e495bcb0a247124157fe78c7e941f2c2fa65b86adb1db0c457322b1be2d46e3d77f13e134c9f83b3b87876088e708f1bd96e41e46545248362c70ba34
-
Filesize
198KB
MD570b59a8bd5d1b7d3fc5d3b92f763a3fa
SHA1f7178d3f1305222f88d8113c9865c8afee090973
SHA256ce51d9ddfbe074f296de43ff0a8e25d84dbbf343ca475fe35c96bdf58882156b
SHA51279ada5880bafea76390c7ef2cbab43314f16826302f05925e18ab4d00fe1ef5a7452c8f73b8fad8a773909c228caf270e1220d406671d36b731693e36e51db16
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
168KB
-
Filesize
696KB
-
Filesize
196KB
-
Filesize
6.5MB
-
Filesize
296KB
-
Filesize
6.5MB
-
Filesize
6.5MB
-
Filesize
6.5MB
-
Filesize
6.5MB
-
Filesize
296KB
-
Filesize
6.5MB
-
Filesize
6.5MB
-
Filesize
6.5MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
48KB
-
Filesize
296KB