Analysis
-
max time kernel
143s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
-
submitted
13/12/2023, 20:09
General
-
Target
73c6174b41b66acb8f91e54dad3040dfe361d02a7ac8b04effcfb951263e57f6.exe
-
Size
2.5MB
-
MD5
3ec22a37102f0daae1fe3e90dd401a41
-
SHA1
bb9e16ebfe7c28be118b2230159cb3455159c3f3
-
SHA256
73c6174b41b66acb8f91e54dad3040dfe361d02a7ac8b04effcfb951263e57f6
-
SHA512
25915ee423ce01100012d85cc522a87ebfdb28a1c7fa91ef1aaabc6fd69a85379781b126d5fb91a5ff1a31b93ba3bef9601527f40aedb185fa6b9490acf45852
-
SSDEEP
49152:vMtAJ0LwABY7WIEVYzzaWwgqWtbl9BSO31pKXEejAvtGxDcBPDIZTTV6+T7uci7I:vwLwoYsVYnaWwgqWtbl9BSO31yEejxAK
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Drops file in Program Files directory 6 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\73c6174b41b66acb8f91e54dad3040dfe361d02a7ac8b04effcfb951263e57f6.exe"C:\Users\Admin\AppData\Local\Temp\73c6174b41b66acb8f91e54dad3040dfe361d02a7ac8b04effcfb951263e57f6.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\AliWangWang\gameCore_cef.exe"C:\Program Files (x86)\AliWangWang\gameCore_cef.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
267KB
MD5f0cb65b4920ee4c42749f877b0f020b4
SHA127f9fedd22fe48736e32d0ea33795bed6aaa5c98
SHA256a2e50cc29a52d730edf21c1cd539ef6a8cf47a17151731afd7af16c6149d8ea9
SHA51261b233fa345f3ee7bf6cfe95cdd75e57c035b55b07986cca8b8c412e3c71ebb23db3d449bef8b1764ce61a827cbf4fab3ec8492d832cece86f9253694ae0335e
-
Filesize
198KB
MD5c68f04b5648ffe2e351d2f3831d708e5
SHA1e21871056c7b767bf357a1f5bc399fe7f1248a92
SHA256e5153b805563b3d00f7a7796d313f60685cc31b3f883fe47887ade617ca076aa
SHA5128807b38723f37c9b197a0d9f090c00fdd467ceb26ba810767676f16c29d6248a41ac6b41460a6b4972209ca0da5457622ce6b56205d0d27034bc57b6c5069d7d
-
Filesize
1.5MB
MD57c76fd6958c799bf95b6a04a1be5b1ce
SHA17eb983ed895c797ceecbfd610735b3207e0aca00
SHA2560fc4cd06e025ea530bcf06f3d569798d378076ceeda9260496414604033223ea
SHA512644f285a9477bd635b4ddce18cac49ccb4dc3256005e1a92746d3c95d41700beee029ce750b4147977324207407294ac75bdf91c7915a7a42650e243c1552b1f
-
Filesize
1003KB
MD59b19dc06f09d20ff1856ea3efb34a16c
SHA1777bdff784bdb1011b2fdfcc7b9d5df9d41b3fa9
SHA256689aadaa47a45c8ab21e7977424f8496fb3e5b628715a3b1a735c254fe1dc669
SHA512dea4c61e36ac309a7a9573b24f4f85619ccc39b46ed90f2baac5a04fb3db8b15377d8a2721a48dab3f7f7ba31f65dc8ab3c88be401ad075b372e67dbfe1f1b51
-
Filesize
1.1MB
MD5d6490bc1b40362c382a05ead78ed4fb6
SHA12f612ca8167183c0593576da291e7f327a972e47
SHA2568cf183732d9143a7202b896b516a9f835174bd68032b653193fff05cea9996b2
SHA512881f0799285e27271cf621bd63db7f8a986c0e49eeb0bf8257069e5ecd88942e9921404419f934e255295365318bd19b545c7bb480a9e36c30b9c85b437317ec
-
Filesize
248KB
MD569bdd9fc93864f81180e8fd4c6131c5a
SHA10c01b83128884edbb739cd817a657fd1f020e0ed
SHA256debd2581dea4273bfdd74f152ba6d514bd3144886d7571fe543953fc7c64f778
SHA512f9c55425788b03e654dca168c4e7c66601dc50631f3c6aca970cb981abefb60d12400eabddb13672338c18b248c847fb4a7d46d564446d72673e23a9d2dd07da
-
Filesize
400KB
-
Filesize
196KB
-
Filesize
960KB
-
Filesize
168KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
960KB