Overview

overview

10

Static

static

3

6a60bb89f8...14.exe

windows7-x64

1

6a60bb89f8...14.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-12-2023 08:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6a60bb89f83b1bf201e2552ed71ff0c7d24f3620992c82382e266f88feeb0814.exe

  • Size

    951KB

  • MD5

    c6f4b84ea898f6a46cf5c4d78b84b58d

  • SHA1

    9a70d273c9e6c05dc8ca1d449eb7bf9bbe0206a1

  • SHA256

    6a60bb89f83b1bf201e2552ed71ff0c7d24f3620992c82382e266f88feeb0814

  • SHA512

    a7cd8277ae8da1103c825a9b66c184428d86e13924d6edef6f0dc247b5e8258e7645e6945fe379950722e206d3f2cb949c3fbff34d3171b2335a339e0f833cdf

  • SSDEEP

    24576:k0FaewhcAu6vcEDdNAlRQY1IJQTGngTqhG7:itw4cEDd2l12iTGnWqh

Score
10/10
fatalratgh0stratinfostealerpersistenceratupx

Malware Config

Signatures

  • FatalRat

    FatalRat is a modular infostealer family written in C++ first appearing in June 2021.

    infostealerratfatalrat
  • Gh0st RAT payload 2 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat
  • Fatal Rat payload 2 IoCs
    ratinfostealer
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6a60bb89f83b1bf201e2552ed71ff0c7d24f3620992c82382e266f88feeb0814.exe
    "C:\Users\Admin\AppData\Local\Temp\6a60bb89f83b1bf201e2552ed71ff0c7d24f3620992c82382e266f88feeb0814.exe"
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:452
    • C:\Users\Public\Pictures\en\en.exe
      C:\Users\Public\Pictures\en\en.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2108
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Public\Pictures\en\tem.vbs"
        3⤵
          PID:3668
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\tem.vbs"
        2⤵
        • Deletes itself
        PID:1864
    • C:\Windows\helppane.exe
      C:\Windows\helppane.exe -Embedding
      1⤵
      • Modifies registry class
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2876
      • C:\nfbemp\Agghosts.exe
        "C:\nfbemp\Agghosts.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Checks processor information in registry
        • Suspicious use of AdjustPrivilegeToken
        PID:2184

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tem.vbs
      Filesize

      275B

      MD5

      1cfa0bfd5509dbc83ca1e2a819bceaf1

      SHA1

      80c89fd052ddf749fbbc0725c49837cb37669ef6

      SHA256

      4b4af0a6021b734f292dbddb3f13b6aca9e3ee77c07c688d73f2f0da67eab4ac

      SHA512

      0daef18479f8901902d89974fe4306cca000904c3e471cbac2c41d1d375b73284b1852eae18ac09e30db68b15f16dc4c21439966056f7b677e5f0cdeadba8242

      Download Submit

    • C:\Users\Public\Pictures\en\en.exe
      Filesize

      618KB

      MD5

      a42deae0974ab7c9122370bfba837fe6

      SHA1

      237ff0b63a56126542a9cb103c7cbfc397ada84b

      SHA256

      36ad631425f128b45e48d26d11e8750f44aa4d4802d60cff4dc7ab9577639b74

      SHA512

      9ea8820f7da135a9188b1cca234cdc7080e7dade8b69b9e8c79569fa9c5c49406d8e3b84bdae0b29aa5f836804f9c855f7c662ceb9d152cff1dd01478996fcad

      Download Submit

    • C:\Users\Public\Pictures\en\tem.vbs
      Filesize

      201B

      MD5

      5874194ca45bbcdef0cd97b4dd74f67b

      SHA1

      79463b9eea30ce54006f5ed141967401c3a39be5

      SHA256

      25435af4b04471ae098fc67306bf5b855c1df60c2274ce473b683b10b5359fce

      SHA512

      73db0899d3afbd03021be4394b7250577cad3fc221365a35b1fb51a1aeaa35b9ca252ee76d93ef74303b4b362e0a4efc6064adafebbbfddc98c0a56176ed423a

      Download Submit

    • C:\nfbemp\Agghosts.exe
      Filesize

      23KB

      MD5

      5aab297fa8f143bfa67310ad78b76d3f

      SHA1

      5db963c2cca1bc8c8c060c52f7df76ccb477f01a

      SHA256

      8ec64bc55e5641d7683288e5e8e27c9391f06eb4da096c3d677d8f25ca4d04df

      SHA512

      c1ee67bd4c6bcfdc4179f905c7abc4ac632c9265b61dd5fdb90eeeec39802abe2cc487a5c8ded8a0748728104170c1b4d3a88904f102e1c3f891fac7702a2256

      Download Submit

    • C:\nfbemp\Enpud.png
      Filesize

      157KB

      MD5

      6d4775f18b2ee05bb4763d3080d36bbe

      SHA1

      cdf9525b39409515b350d02b91bff61aac3cd55f

      SHA256

      23bb3a8e6cd6be562f57e98441888782f8f0d8d8ce456a9a40bf711a68a34c97

      SHA512

      45368d3468e45324362eded3905d16850136318acf88c9d8d9590f77fb912d423fe52f24ab3b0b4d001605692e2d0627ba1463de533b96724cd25a8548cf9e82

      Download Submit

    • C:\nfbemp\QiDianBrowserMgr.dll
      Filesize

      123KB

      MD5

      daa799b7defab6d9867c5d519b36611f

      SHA1

      4020d8587c28df934bd460b4dc953561be61e4ff

      SHA256

      6cec316645c5abc4f31eb25f3f09f462f843fc73b9c1db79c5f580c6773e8d00

      SHA512

      52979cb556129d2efd2615001cfd5dab74066c9ed45d46746c02d71f6418b92a61fc5dc4c182089d2bc66d7d1a5e461b8fa60702f872d63194412bc4fa699777

      Download Submit

    • C:\nfbemp\vcruntime140.dll
      Filesize

      77KB

      MD5

      f107a3c7371c4543bd3908ba729dd2db

      SHA1

      af8e7e8f446de74db2f31d532e46eab8bbf41e0a

      SHA256

      00df0901c101254525a219d93ff1830da3a20d3f14bc323354d8d5fee5854ec0

      SHA512

      fd776f8ceaac498f4f44819794c0fa89224712a8c476819ffc76ba4c7ff4caa9b360b9d299d9df7965387e5bbcb330f316f53759b5146a73b27a5f2e964c3530

      Download Submit

    • memory/452-19-0x0000000000400000-0x0000000000598000-memory.dmp

      Filesize

      1.6MB

      Download

    • memory/452-0-0x0000000000400000-0x0000000000598000-memory.dmp

      Filesize

      1.6MB

      Download

    • memory/452-2-0x0000000000400000-0x0000000000598000-memory.dmp

      Filesize

      1.6MB

      Download

    • memory/452-51-0x0000000000400000-0x0000000000598000-memory.dmp

      Filesize

      1.6MB

      Download

    • memory/452-1-0x0000000000400000-0x0000000000598000-memory.dmp

      Filesize

      1.6MB

      Download

    • memory/2108-20-0x0000000000400000-0x0000000000545000-memory.dmp

      Filesize

      1.3MB

      Download

    • memory/2108-12-0x0000000000400000-0x0000000000545000-memory.dmp

      Filesize

      1.3MB

      Download

    • memory/2108-45-0x0000000000400000-0x0000000000545000-memory.dmp

      Filesize

      1.3MB

      Download

    • memory/2184-35-0x0000000001580000-0x00000000015B0000-memory.dmp

      Filesize

      192KB

      Download

    • memory/2184-36-0x0000000010000000-0x0000000010029000-memory.dmp

      Filesize

      164KB

      Download

    • memory/2184-53-0x0000000003960000-0x0000000003AAD000-memory.dmp

      Filesize

      1.3MB

      Download

    • memory/2184-56-0x0000000003960000-0x0000000003AAD000-memory.dmp

      Filesize

      1.3MB

      Download

    • memory/2184-58-0x0000000003960000-0x0000000003AAD000-memory.dmp

      Filesize

      1.3MB

      Download