Analysis
-
max time kernel
141s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
-
submitted
15-12-2023 04:59
General
-
Target
d95d7da7bc04833b132d7b612522cd4058f052e84ee8c82f34687bc548d3e36a.exe
-
Size
7.8MB
-
MD5
0ff89a747039fda2b552d6dd405b3dca
-
SHA1
c0abfbfe54e09e312be89111d8f5b770c038be8e
-
SHA256
d95d7da7bc04833b132d7b612522cd4058f052e84ee8c82f34687bc548d3e36a
-
SHA512
c9e5f35d6637a4bcf600a414d556f6221f24991c23378d24a811ed85806ac797058c49e805e2600523f90dab2e4607b4551334cf93210a01e93a29ce3b5c3424
-
SSDEEP
196608:RfYOSYUX/C+TFsIsESAxj0dUv1RJsASY8Wb2PVpu9Q3AJ:RrU6+ZsNU0YsE8b/
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
VMProtect packed file 3 IoCs
Detects executables packed with VMProtect commercial packer.
-
Drops file in Program Files directory 6 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d95d7da7bc04833b132d7b612522cd4058f052e84ee8c82f34687bc548d3e36a.exe"C:\Users\Admin\AppData\Local\Temp\d95d7da7bc04833b132d7b612522cd4058f052e84ee8c82f34687bc548d3e36a.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Funshion\GNCEFExternal.exe"C:\Program Files (x86)\Funshion\GNCEFExternal.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
550KB
MD537f24d777f06a274be6091e876910295
SHA1fca8aa72cad4f30aac459d76bd71e8cfc9a7b367
SHA256baa59def8aaad78906b5f1bde287224df378e6dfda62fa5a2279e6875d4d94f4
SHA512f037d8c138de63cff11e96bb219c0f630d43434cf27c6c328108f508c0619238668803f9ef249b0f9fdc377f99ce7a56b60e5642397bc23cd7a1ff36e0d285e4
-
Filesize
756KB
MD5ef3e115c225588a680acf365158b2f4a
SHA1ecda6d3b4642d2451817833b39248778e9c2cbb0
SHA25625d1cc5be93c7a0b58855ad1f4c9df3cfb9ec87e5dc13db85b147b1951ac6fa8
SHA512d51f51336b7a34eb6c8f429597c3d685eb53853ee5e9d4857c40fc7be6956f1b8363d8d34bebad15ccceae45a6eb69f105f2df6a672f15fb0e6f8d0bb1afb91a
-
Filesize
18KB
MD538619b5de44247530eae8e6682aee536
SHA197f1f9b717d300482ca35dba6ab48f0e7458178e
SHA2562e85458d05bef20852c5afcff5d6f783feda7da106aeea7a7fc830e56921fd58
SHA5127130096df695021c8dfe4e561bd1e94e8b1f40a980ed6101475dc075f2f4fa687bce69aaa7bad0a5790e7856ac5059a2fe9940835c9210a897fbd7da9fa97760
-
Filesize
198KB
MD5c227081c485d962210c24dd3e2656ffd
SHA119804d32bf47438d7b0f7e910343f468ceff981b
SHA256cf880632ce06a144dc356768c40233526792e7932f0278ce580f8967e14bdae1
SHA51264b298b39fa8fc940c820f923cd189cd7157006e16752e7ab731aa479ce476105d0267cfa30d1a8b3e0f66b5410cf7331700bebf5b6e8aa56ea932f1c44a2017
-
Filesize
4KB
-
Filesize
15.4MB
-
Filesize
15.4MB
-
Filesize
15.4MB
-
Filesize
196KB
-
Filesize
696KB
-
Filesize
168KB