Analysis
-
max time kernel
139s -
max time network
142s -
platform
windows11-21h2_x64 -
resource
win11-20231129-en -
resource tags
-
submitted
14-12-2023 13:23
General
-
Target
cd9c6f0b76e00e15e91a483d23b2c66c7d9f65f296d5b70b8ba691acd82c283b.exe
-
Size
6.8MB
-
MD5
2f00f70020c479b1fe7e32b6fdde6ad2
-
SHA1
13b9ad6874690af1d32eaf3ee8b2bb5674d59953
-
SHA256
cd9c6f0b76e00e15e91a483d23b2c66c7d9f65f296d5b70b8ba691acd82c283b
-
SHA512
a2f55b7c8dd3b5cd330a4c2bef957cca5cb19b873544bb2a8b57c047959233a30b6ecbc96460c65a6773161292b9571a339b4f1af273c1e7fb908b7343ea4fc9
-
SSDEEP
196608:pszgrJ3dUZdF+7+oHKuGKVSlo2Eaezj8/DFvYKf1JFh:pszXd6+oCeSlo6e4xAKD
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
VMProtect packed file 2 IoCs
Detects executables packed with VMProtect commercial packer.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Drops file in Program Files directory 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cd9c6f0b76e00e15e91a483d23b2c66c7d9f65f296d5b70b8ba691acd82c283b.exe"C:\Users\Admin\AppData\Local\Temp\cd9c6f0b76e00e15e91a483d23b2c66c7d9f65f296d5b70b8ba691acd82c283b.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Actual\liaobei.exe"C:\Program Files (x86)\Actual\liaobei.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.6MB
MD591057184eb697259e88dff99a1e957cf
SHA10aad25610df49e54b2e6af9f888eff8fb5a99e07
SHA256149a58359c568d4a5ebb1fee53c5cba1dd63fdc14b165d043fd2a4c5f641ff67
SHA512e5b27feea207bb7d3d35f8b11b10d64cef7b947fb9aa2612fab6e69bb270c4bfe3f1316d477c7832ecd9f7fd9cb622721e2ee5ee717cef1954ad353221068ffe
-
Filesize
2.7MB
MD57cd35ab70d012b1bfea123bde328ee19
SHA1cc1a758af2f5c993eea24b7c8317daa4889a6502
SHA2560328df98442c6043103deb870987add9b874b95b72a3c0e4822c77fe08e86e3e
SHA512280a0dc72815f0be1bd275a7e2649d1610ff6e8545830f812ea3012da6cec7089fe5c136a4da39204a4ff006e1c9ee1a65a629ec7cc43a53ec8a350a43b98673
-
Filesize
198KB
MD51176ae44f89438b775fa2445ea7fcadb
SHA18c4ff222ac8f07bc4f05af6f324ef9591425dac3
SHA256f5363287d0e624309b76dcb5bbbffb2d8280407830daf095292d2738afc4c996
SHA5122df1dc165977e42e790002679d1b7de09c7a38a57300f0ea710cd5a1512c5751f02f6dff430e5f03aabe5684253b5f54c44cbdf8ae48bba951ec414fe0ed281b
-
Filesize
124KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
12.8MB
-
Filesize
4KB
-
Filesize
696KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
12.8MB
-
Filesize
196KB
-
Filesize
696KB
-
Filesize
168KB