Analysis
-
max time kernel
141s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
15-12-2023 17:00
General
-
Target
17c784cd4aea713b258cd4d740b87be2037ae7a17c09dc8fbd54b496c4f7d812.exe
-
Size
4.5MB
-
MD5
2390f2ab0086c69d3780bd45f3a23c55
-
SHA1
f1a507bf4bd11f6159097b1b20e551534581c033
-
SHA256
17c784cd4aea713b258cd4d740b87be2037ae7a17c09dc8fbd54b496c4f7d812
-
SHA512
d34c4b228e2a455174a50e71cd3c44cf5ce6a16716c31e289ce099e06e0b91d6e61b63d4ad5c50f93862d52dd7b0647461dde6c3df7643abd4916a8e024e44a7
-
SSDEEP
98304:WSL/0AAKzg3oRug6oY3zp274J2AWYPSIJxSOz/P8vFySufuqzEEzNpCmhxY7Zm57:Wezzg3Dt9MiPSIJxSOz/0QfFzhBW7Zcz
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Drops file in Program Files directory 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 52 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\17c784cd4aea713b258cd4d740b87be2037ae7a17c09dc8fbd54b496c4f7d812.exe"C:\Users\Admin\AppData\Local\Temp\17c784cd4aea713b258cd4d740b87be2037ae7a17c09dc8fbd54b496c4f7d812.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Actual\liaobei.exe"C:\Program Files (x86)\Actual\liaobei.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
487KB
MD5c3955d20098daf8a29b3c704edf27050
SHA1c50d59a148756626f08ba6c6510b31dd5f34ade2
SHA256673a55baf3593e83091201cb4a814deb718a600a101e7e558687d34c1ebfe255
SHA5126e984e627f7ed1c9ac16d31c24abc999b4518e870757fb8cfdf68ff2ef711f43ed47474867b70620829a14a32722966e658d1278150acb2623f533bdf225e819
-
Filesize
269KB
MD52a3b9a89641f968e02106c2b4769c317
SHA1a8cca6b5bb571f16da98c5f5aaa8a8d2db1e8df0
SHA2567978718eee2f968095ab12405b20bed711798ad9b2d9319640d2b847bbef2bfb
SHA5124182aa661ce2c95d4ba4bdc76e7c25a05e7e2c05bcd41feadebf3d890be7913e8c382bb5d83a86bcec31b189b287b38faf4501e0425b42d623dde87fa50086d7
-
Filesize
467KB
MD54c790c10cfd13e4eb16294044f68b0c0
SHA1bede6a82c8126068a41c3b527a392f6ec00250d8
SHA25695618fcf6825b8ab8a9f7ed67d32bea4ee55b8ab18fb1d9bcf10fe78d6e625c8
SHA5128d68057e414a25dd4859c047eeceb055fe602d815918599b9ba715147d4b3d3742f7b4f102911112e924681cdadbbdf94674facc2b0fd4fb402efb75c76cd63a
-
Filesize
198KB
MD51176ae44f89438b775fa2445ea7fcadb
SHA18c4ff222ac8f07bc4f05af6f324ef9591425dac3
SHA256f5363287d0e624309b76dcb5bbbffb2d8280407830daf095292d2738afc4c996
SHA5122df1dc165977e42e790002679d1b7de09c7a38a57300f0ea710cd5a1512c5751f02f6dff430e5f03aabe5684253b5f54c44cbdf8ae48bba951ec414fe0ed281b
-
Filesize
1.3MB
MD5260ec133aecff68f026e2d060f55a119
SHA1358161d1eb7cae3f1de305f6ef8ab9378d458db6
SHA256c3293af11f1c628573d45e7fab30885da5080787fdec3275657d7fc9a88680a2
SHA5120cd9174a932b97a5d6246fc1ec76be4ee5f4b595cbb1f81a39c77e24154568d924927d4bbe7400bd4cbac5adfab008552af7802681bedd4ebee3258bc6a35b28
-
Filesize
538KB
MD5e2081aa984a673b1bd454e0b0bb98d60
SHA17fdc08cc249af92c7dc9e44d48d3c618bea7c665
SHA256636003441ba35f6b00ccabc83a5f03eab2a286d7aca109208e910e6fafa7ba1a
SHA51239bc2bbadc07b15ce4947c1f225710695d053dc739e494ec052e4b83398d44a349b202ce690af8fbeb86cae15670c60823587246aa67490d3ffee16441a4044c
-
Filesize
696KB
-
Filesize
124KB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
696KB
-
Filesize
196KB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
168KB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB