Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
-
submitted
14-12-2023 07:59
General
-
Target
c2422939cbcf66f08891548d86ff2a83756ef4fd058ef89cd11afb743b69345c.exe
-
Size
2.2MB
-
MD5
9abd44a5e4b419839d37e222f86860f4
-
SHA1
c3355f1848dff160b14b75eefebd3d1b0f6a1c1b
-
SHA256
c2422939cbcf66f08891548d86ff2a83756ef4fd058ef89cd11afb743b69345c
-
SHA512
9dae7da70cee0b7b8ad90233920bc525a79186efe6fc7263d40287e27cc4bb661886ac4a981bdafa8b6ada0370b517653def69f16ad5303e7104aba2a2c75fae
-
SSDEEP
49152:c0smKY68xpKotIZLoYDHUT9LQodim4nFFgNMPq5:pJRxHhtlYDHOQodim4n4NMPY
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 3 IoCs
-
Drops file in Program Files directory 5 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c2422939cbcf66f08891548d86ff2a83756ef4fd058ef89cd11afb743b69345c.exe"C:\Users\Admin\AppData\Local\Temp\c2422939cbcf66f08891548d86ff2a83756ef4fd058ef89cd11afb743b69345c.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Soga64\elin_render.exe"C:\Program Files (x86)\Soga64\elin_render.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
112KB
MD592330a0fc4dd6876fc41187039b0293b
SHA1413a4d2abae844548eb1aa543372c82d699911fe
SHA25676d6a5838d897fc9a7db31c1d0195ba817026da3f5bff23c83dad509b2646198
SHA5125eaf6720d095c379049b7cba696e2f8b8cd03ef2e1be8c099e64a6c2b3daf55f1ff672d3e070934be1b36f7001ec7fcd2d990cd2e4e4136b3683fbfd5696b485
-
Filesize
81KB
MD588ca65c5f9939179dcf6f93f47763706
SHA1dd5769c6eee278e76b22283185984d8298ae5575
SHA2569c066f40043cdf341d1c56fb268f9d952c6266739d32d1c96fb07dc406b02ec2
SHA5121d8dc4731d6430949a4bf7d4d33a31c70e225b57977af412ac85a2a561e02e307c6de56d10cf82cd0fdf7b35b7f8b4d6fb5c695c514c8b360dab52f5d393b041
-
Filesize
131KB
MD5b991295071496f0cecfa0eef6f9c2d1f
SHA1c6665c2a9674efcedd2d92954e2bec9432de9a3d
SHA256c16ef1080f6284c2d2112b2ebcb894544e9355748460e5554370e257cd1dfd8f
SHA5128bb1b7ebee987ec00715821a8a99750c3bbeddf19e128616378b5693040f1e65ad3619c380b48d48bd6a314b249619ed5e0f52c7d4e65c89b5c0b7059d864e67
-
Filesize
80KB
MD5a63a8142db4ffb2632c55b311a355e21
SHA19cff492f82df57d830b9afed1cc3482b1d7aeeb4
SHA2563e2d1c08d16ce259bb534c7bdf5e952cf1c3079f0a06657650430e97eb0aaa88
SHA5125c1afb7f6d16800b33993bea5533e97627e83210f0f766bc1f9bfaa41f7f4c40c359d811e7794b698d10c9c2d790bf1b42a41e478e84fcd7d6aff66e5336aecb
-
Filesize
51KB
MD5c8cc550fb1b06754a6a97ea465da1364
SHA1e3b53c72acbd72a5e9d0be1d04bb6260daee8d23
SHA2568376bd67a841fc85c5c4214f4aaaf6700f75d7471fb749f192b74c423df66960
SHA512359edc9eb87a0664afc11ac8ae2868d375c972cdcdc4ed169d1d1a3b5432fe574b95a221fd83376a6bf945724416cce895862118cd766c4cdd63a3842136e331
-
Filesize
32KB
MD510553a9f09cf320bfffb1c704b5ade51
SHA1612efa8813f9209dcdaf6bd4e1e80c3cc266c308
SHA256bdb44b2d1bebf33dbb2ea5717f5c512d285cdc380eecf91c9380bcb9b722578e
SHA512af2212b82e967776d46dadb4f7e35cb619898c5bf3361110b9cb34c2ce680c1488f7e6cb4e78113bb79d7a4162744a8c7b82713cd43339b2d89e7eadacedeb56
-
Filesize
147KB
MD58c752bbcd4b66c676004f3928ecffda3
SHA1c55578bb6025e66a0bddec1b3bb51eca8239f390
SHA256203b24ebfdffcf582e50854ae99ad8195c542b5abc21793d960c8280f2737849
SHA51247a37da0984a38ca4eaea9f87263e08cba51e8e1f98614784b67903a8610b57c1e4da6c33e99529e9370dbbdbe89b2df62add3e318b74ffd49d005a586707597
-
Filesize
71KB
MD5c5219707d30dac147996654c18e26abd
SHA113926205afb0887d420e5196cad207607fdfca4c
SHA256b617f6c3314234a1d0c0bd0c5367d29ecb4ed17afc9b604d3c9df96e84f77065
SHA512f2e7bec495954ddbf5c5e8aacbe0d739cbb8dfe15af7c7ce2740c0db8f75c05f87c988a61326fcd5b786303c02f6d866ebbe2500e9cd35ecd7ced665fbf3b0ac
-
Filesize
114KB
MD504b3bb8045725b80df46ac0d3a2f943e
SHA1a96f5a5be3299d2afb20025d1ecd3906b15ea847
SHA2568e2947862bebebf4e696b109872f7c2b11b81b7e1e0707d11d71d8962e11cfbf
SHA51297a7e4b9927e519e92f889ad6b6468f911762bb021ee387a3d8a8c20ebdd5230c0fb8f44b5a40b62699baa2904255af7686a65f5e9f670d3eaee873c3caa10e5
-
Filesize
4.8MB
-
Filesize
296KB
-
Filesize
296KB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
48KB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
296KB
-
Filesize
64KB
-
Filesize
4.8MB
-
Filesize
4KB
-
Filesize
196KB
-
Filesize
696KB
-
Filesize
168KB