Analysis
-
max time kernel
142s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
15-12-2023 17:00
General
-
Target
17c784cd4aea713b258cd4d740b87be2037ae7a17c09dc8fbd54b496c4f7d812.exe
-
Size
4.5MB
-
MD5
2390f2ab0086c69d3780bd45f3a23c55
-
SHA1
f1a507bf4bd11f6159097b1b20e551534581c033
-
SHA256
17c784cd4aea713b258cd4d740b87be2037ae7a17c09dc8fbd54b496c4f7d812
-
SHA512
d34c4b228e2a455174a50e71cd3c44cf5ce6a16716c31e289ce099e06e0b91d6e61b63d4ad5c50f93862d52dd7b0647461dde6c3df7643abd4916a8e024e44a7
-
SSDEEP
98304:WSL/0AAKzg3oRug6oY3zp274J2AWYPSIJxSOz/P8vFySufuqzEEzNpCmhxY7Zm57:Wezzg3Dt9MiPSIJxSOz/0QfFzhBW7Zcz
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Drops file in Program Files directory 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\17c784cd4aea713b258cd4d740b87be2037ae7a17c09dc8fbd54b496c4f7d812.exe"C:\Users\Admin\AppData\Local\Temp\17c784cd4aea713b258cd4d740b87be2037ae7a17c09dc8fbd54b496c4f7d812.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Actual\liaobei.exe"C:\Program Files (x86)\Actual\liaobei.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
799KB
MD5daff152a449d5e991bd5be33ca8cb19d
SHA19e4b6dd18f9b624f63b4026cbfe341376390159b
SHA2567a2c4fc05ddb644280b333d38fe4a6ffd9d0853807c8d6afda948e625a3bace9
SHA512dafedcbb0bacc838957634a02c9c14210c9a33449b9df9b39e813559840865607647e6e5e1e8ad853580391c2a88a3bd21902b5b889f83d0747a1bf1aecb92e3
-
Filesize
2.6MB
MD591057184eb697259e88dff99a1e957cf
SHA10aad25610df49e54b2e6af9f888eff8fb5a99e07
SHA256149a58359c568d4a5ebb1fee53c5cba1dd63fdc14b165d043fd2a4c5f641ff67
SHA512e5b27feea207bb7d3d35f8b11b10d64cef7b947fb9aa2612fab6e69bb270c4bfe3f1316d477c7832ecd9f7fd9cb622721e2ee5ee717cef1954ad353221068ffe
-
Filesize
1.8MB
MD5906b751d379bdd6d783a097b4fa1b2f1
SHA1a297e640a9eae6d48a6a62096f343b7f5177da70
SHA25632442b74e2ebfe6d4a440b7fc7a807cb234fc1c620be1bfc6a15cb52b49c0efc
SHA5126158ebc0aca28ad23e7afd3b6bcdeec3bb0033aaac2bbd17b738dbf8642a1284319fabd191fb5adb66770657f75e9e2ae5e75386c22f04c638afa8c26da7f82b
-
Filesize
198KB
MD51176ae44f89438b775fa2445ea7fcadb
SHA18c4ff222ac8f07bc4f05af6f324ef9591425dac3
SHA256f5363287d0e624309b76dcb5bbbffb2d8280407830daf095292d2738afc4c996
SHA5122df1dc165977e42e790002679d1b7de09c7a38a57300f0ea710cd5a1512c5751f02f6dff430e5f03aabe5684253b5f54c44cbdf8ae48bba951ec414fe0ed281b
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
196KB
-
Filesize
5.2MB
-
Filesize
696KB
-
Filesize
168KB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
124KB
-
Filesize
696KB