Analysis
-
max time kernel
135s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
26-12-2023 09:51
General
-
Target
6c6d7f7d566de84cd12a53e3c6007982042626e906d8189932e3cca828ed2bf6.exe
-
Size
3.7MB
-
MD5
8257dbbadbf1508e030161cffa5ab3b0
-
SHA1
8666310ea7d1b9b1f1519ab614c3100bf6a55b68
-
SHA256
6c6d7f7d566de84cd12a53e3c6007982042626e906d8189932e3cca828ed2bf6
-
SHA512
070622c925eacbc4e10c4179d78a526f79dd13377c9beef3fd398dbb1830f1ce7962385b8bbe8d91e26953e134be226253fba76f06e5c319e79fbb97ca5335f0
-
SSDEEP
49152:F8y4+H/MA9KvdXjuvugsDwy9p6a7ZIcQ2R8+06QlCQ1U2V+6kYdke+/skGV8rOvN:J/MOeDp6l08+06QxUZ6kB/skbrOl
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Drops file in Program Files directory 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\6c6d7f7d566de84cd12a53e3c6007982042626e906d8189932e3cca828ed2bf6.exe"C:\Users\Admin\AppData\Local\Temp\6c6d7f7d566de84cd12a53e3c6007982042626e906d8189932e3cca828ed2bf6.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Funshion\DySDKController.exe"C:\Program Files (x86)\Funshion\DySDKController.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28KB
MD5469912710c302ff7f295c029dba7d2dd
SHA1827acaa15d6d87db1f64666fbcfa0da05d7127a2
SHA2564308b1ba1bf63da04114b6f01d28ceb34d7f59cfbb8a4e6af6c5c469e676653a
SHA5121ede2228c23a038f84eec1d17f17f9a95679b42019e6cc5bb1cfaec8d921424ee1560c8c4d086d7b5545060809a21872c964717056600f0270119c1e68a58531
-
Filesize
42KB
MD5e556470ab201442b3a8291e394bec61a
SHA1027b9b673c7db2fe9023c9bfea9a65139287f5dd
SHA25662270f54a19141433d2f11a3ccd90de9d6557aea361cc14dd3c7021d5c71a6d0
SHA51205eb2d9867afaaf0734eb249fc583ef5f5b3d4bcb07ccc1827f901bc323209048ae6cf4a9dac4bb46b97e956bec9414bd0fb0800ac930b9fc0f555e073c8b0b8
-
Filesize
26KB
MD50b607ff55df0b5acfcb7c5f3dc1ecf33
SHA19aa83e9fd691cdd2a1390d41c2c05a7de4608ba4
SHA25657efa81ba3b097c2328e6686439451fb31be3d05a53e24e709e43d33ab6766de
SHA512dcc791377465acf72afbfcb7d6dc8cd6b36e01929ecfe3d4d4c19d9793f2518591b7c7e3a4de87e6988fdd18071e8baa93bf884ef388c481d7717c0ff4bfad1e
-
Filesize
51KB
MD5580658d954eb40d8a9328769be10b74d
SHA13363face37fac6eaf09829d3f7dee8896dcaa3dd
SHA256c72772a35b8b9b4c84e1aa336f0fac7615d5d975aa10ac9e0eaba500527f8e19
SHA512233103004bb7342dc9b88049354300bf92cf720126fce63568f331ddb83db4dcd9555f9f5e315179602db5b5389f837b37a8398d534f3b98b7e6b4e0287fc3a8
-
Filesize
160KB
-
Filesize
400KB
-
Filesize
168KB
-
Filesize
196KB
-
Filesize
160KB