fatalrat | f4b9cba127f9777efe96fe8ab144d00a49dc31b5fb3129a13da5beaf8394e5c7

Analysis

max time kernel
125s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20231130-en
resource tags

arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system
submitted
12-12-2023 14:01

Target

f4b9cba127f9777efe96fe8ab144d00a49dc31b5fb3129a13da5beaf8394e5c7.dll
Size

288KB
MD5

b5c9489325d82c45715e00a08541217c
SHA1

247af428a997e9e111bd76a1fbeb13494075b651
SHA256

f4b9cba127f9777efe96fe8ab144d00a49dc31b5fb3129a13da5beaf8394e5c7
SHA512

3e4ed93f64d2f7222a15f04d3481bd8f685782bb6762dbbd924ded87e5970c8fe0631da7c8b22bb4b76c8d36bdb50b4b6f9f4b5ac7a6e3bb03b2bd21a079882d
SSDEEP

3072:oMy3mBPptH5LZseWDzoPZ6WS6BLfvgaSlpcD+05f2bRSH+zgn2zCFvu+2sLbzu6y:/SmZtSzkPDNGEfBHlHFGwLmVpkdwsFX

Score

10^/10

FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
infostealer rat fatalrat

Fatal Rat payload 1 IoCs

rat infostealer

resource	yara_rule
behavioral2/memory/2868-0-0x0000000000A60000-0x0000000000A8A000-memory.dmp	fatalrat

Kills process with taskkill 1 IoCs

evasion

pid	Process
4744	taskkill.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2868	rundll32.exe
2868	rundll32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2868	rundll32.exe
Token: SeDebugPrivilege	4744	taskkill.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 2868	2308	rundll32.exe	53
PID 2308 wrote to memory of 2868	2308	rundll32.exe	53
PID 2308 wrote to memory of 2868	2308	rundll32.exe	53
PID 2868 wrote to memory of 4744	2868	rundll32.exe	88
PID 2868 wrote to memory of 4744	2868	rundll32.exe	88
PID 2868 wrote to memory of 4744	2868	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f4b9cba127f9777efe96fe8ab144d00a49dc31b5fb3129a13da5beaf8394e5c7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f4b9cba127f9777efe96fe8ab144d00a49dc31b5fb3129a13da5beaf8394e5c7.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2868
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im rundll32.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4744

memory/2868-0-0x0000000000A60000-0x0000000000A8A000-memory.dmp

Filesize
168KB

Download