fatalrat | f4b9cba127f9777efe96fe8ab144d00a49dc31b5fb3129a13da5beaf8394e5c7

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
12-12-2023 14:01

Target

f4b9cba127f9777efe96fe8ab144d00a49dc31b5fb3129a13da5beaf8394e5c7.dll
Size

288KB
MD5

b5c9489325d82c45715e00a08541217c
SHA1

247af428a997e9e111bd76a1fbeb13494075b651
SHA256

f4b9cba127f9777efe96fe8ab144d00a49dc31b5fb3129a13da5beaf8394e5c7
SHA512

3e4ed93f64d2f7222a15f04d3481bd8f685782bb6762dbbd924ded87e5970c8fe0631da7c8b22bb4b76c8d36bdb50b4b6f9f4b5ac7a6e3bb03b2bd21a079882d
SSDEEP

3072:oMy3mBPptH5LZseWDzoPZ6WS6BLfvgaSlpcD+05f2bRSH+zgn2zCFvu+2sLbzu6y:/SmZtSzkPDNGEfBHlHFGwLmVpkdwsFX

Score

10^/10

FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
infostealer rat fatalrat

Fatal Rat payload 1 IoCs

rat infostealer

resource	yara_rule
behavioral1/memory/1352-0-0x00000000001F0000-0x000000000021A000-memory.dmp	fatalrat

Kills process with taskkill 1 IoCs

evasion

pid	Process
2660	taskkill.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1352	rundll32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1352	rundll32.exe
Token: SeDebugPrivilege	2660	taskkill.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1264 wrote to memory of 1352	1264	rundll32.exe	28
PID 1264 wrote to memory of 1352	1264	rundll32.exe	28
PID 1264 wrote to memory of 1352	1264	rundll32.exe	28
PID 1264 wrote to memory of 1352	1264	rundll32.exe	28
PID 1264 wrote to memory of 1352	1264	rundll32.exe	28
PID 1264 wrote to memory of 1352	1264	rundll32.exe	28
PID 1264 wrote to memory of 1352	1264	rundll32.exe	28
PID 1352 wrote to memory of 2660	1352	rundll32.exe	29
PID 1352 wrote to memory of 2660	1352	rundll32.exe	29
PID 1352 wrote to memory of 2660	1352	rundll32.exe	29
PID 1352 wrote to memory of 2660	1352	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f4b9cba127f9777efe96fe8ab144d00a49dc31b5fb3129a13da5beaf8394e5c7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f4b9cba127f9777efe96fe8ab144d00a49dc31b5fb3129a13da5beaf8394e5c7.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1352
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im rundll32.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2660

memory/1352-0-0x00000000001F0000-0x000000000021A000-memory.dmp

Filesize
168KB

Download