fatalrat | d5c48236a5de2d68e64f40c685e9b3e583d0d73d5457331f1332809efae1c79d

Analysis

max time kernel
146s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
21-12-2023 18:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d5c48236a5de2d68e64f40c685e9b3e583d0d73d5457331f1332809efae1c79d.exe
Size

324KB
MD5

c17eecabcc478ec9761143ac39d5fd49
SHA1

6a00b754fbdd81b8378ea95ad2402056cf2e4b7c
SHA256

d5c48236a5de2d68e64f40c685e9b3e583d0d73d5457331f1332809efae1c79d
SHA512

8ce968107bf2134658df857bc246565fd0fdf6f02973d66557eac676e6f07874c96441ba6fd6e90b1b1bf5e8a6ba1631a34398ff0da8fb83d3e1777f62f0b505
SSDEEP

6144:T3IF2wpuBBI4tStmnyD/nyW7qifJbQQuHyan7CK82O:T3KCStqyznyW7Lludp8V

Score

10^/10

fatalrat infostealer rat

Malware Config

Signatures

FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
infostealer rat fatalrat

Fatal Rat payload 1 IoCs

rat infostealer

resource	yara_rule
behavioral2/memory/4756-2-0x0000000010000000-0x000000001002A000-memory.dmp	fatalrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation	d5c48236a5de2d68e64f40c685e9b3e583d0d73d5457331f1332809efae1c79d.exe

Executes dropped EXE 1 IoCs

pid	Process
3052	d5c48236a5de2d68e64f40c685e9b3e583d0d73d5457331f1332809efae1c79d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4756	d5c48236a5de2d68e64f40c685e9b3e583d0d73d5457331f1332809efae1c79d.exe
Token: SeDebugPrivilege	3052	d5c48236a5de2d68e64f40c685e9b3e583d0d73d5457331f1332809efae1c79d.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4756 wrote to memory of 3052	4756	d5c48236a5de2d68e64f40c685e9b3e583d0d73d5457331f1332809efae1c79d.exe	90
PID 4756 wrote to memory of 3052	4756	d5c48236a5de2d68e64f40c685e9b3e583d0d73d5457331f1332809efae1c79d.exe	90
PID 4756 wrote to memory of 3052	4756	d5c48236a5de2d68e64f40c685e9b3e583d0d73d5457331f1332809efae1c79d.exe	90

C:\Users\Admin\AppData\Local\Temp\d5c48236a5de2d68e64f40c685e9b3e583d0d73d5457331f1332809efae1c79d.exe
"C:\Users\Admin\AppData\Local\Temp\d5c48236a5de2d68e64f40c685e9b3e583d0d73d5457331f1332809efae1c79d.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4756
- C:\Users\Admin\AppData\Local\d5c48236a5de2d68e64f40c685e9b3e583d0d73d5457331f1332809efae1c79d.exe
  "C:\Users\Admin\AppData\Local\d5c48236a5de2d68e64f40c685e9b3e583d0d73d5457331f1332809efae1c79d.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\d5c48236a5de2d68e64f40c685e9b3e583d0d73d5457331f1332809efae1c79d.exe

Filesize
324KB

MD5
c17eecabcc478ec9761143ac39d5fd49

SHA1
6a00b754fbdd81b8378ea95ad2402056cf2e4b7c

SHA256
d5c48236a5de2d68e64f40c685e9b3e583d0d73d5457331f1332809efae1c79d

SHA512
8ce968107bf2134658df857bc246565fd0fdf6f02973d66557eac676e6f07874c96441ba6fd6e90b1b1bf5e8a6ba1631a34398ff0da8fb83d3e1777f62f0b505

Download Submit
C:\Users\Public\Documents\SVP7.PNG

Filesize
151KB

MD5
ba3e241765eba6d5be6490d4c4e4528d

SHA1
2b9b6acc6b2af30208699d819c8b891797d4cb45

SHA256
cfb5d25c2e51c8723792ca1eafc19fc83e3485be8e196576206a6d65361e12ad

SHA512
f28502e97b9f71b8c5b8383d04a08518f738090255fbe305e349f99df575f056a86e3232ac768db7b77134c8ce4b069f756d8efc49cdb17b5da011a0c5da90cb

Download Submit
memory/4756-2-0x0000000010000000-0x000000001002A000-memory.dmp

Filesize
168KB

Download