Analysis
-
max time kernel
139s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
29/12/2023, 11:04
General
-
Target
ef784be3a22fd220f7e409d9d821e9b8802afb63ba611c68a6d0887f85d5584c.exe
-
Size
4.0MB
-
MD5
c1c1898e903d510a040ba12b7838b2e5
-
SHA1
91e814f99ace82cad8cc8bde919e7148bd3582a7
-
SHA256
ef784be3a22fd220f7e409d9d821e9b8802afb63ba611c68a6d0887f85d5584c
-
SHA512
fa073c10de4f3abc897f4f19bb6c4b6e72a5f0e3a27d6266a158bc8a236a44fe01c2e52a37d3a2b0cf6f78a6bc9e3a1bf69affa476b95e1060a6d3e226fee4c2
-
SSDEEP
98304:t3/+58f1r2yIrOqFH3aCv6M8mqHS4sjsmRzhIn98E3z9ADmrQ9CZlT:tv+y23Zt8mqRsfRKnWE3uDmwCf
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Drops file in Program Files directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ef784be3a22fd220f7e409d9d821e9b8802afb63ba611c68a6d0887f85d5584c.exe"C:\Users\Admin\AppData\Local\Temp\ef784be3a22fd220f7e409d9d821e9b8802afb63ba611c68a6d0887f85d5584c.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Funshion\Pepper.exe"C:\Program Files (x86)\Funshion\Pepper.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
116KB
MD5562d40948c0346e53d1b377cd075b074
SHA151a6e707440c7175a08c7380dd47dca1add857a4
SHA2563df16acc2429ddd7324bd58a5ea3bec7094939a1617e7fe7755d43ed8d00dd63
SHA51248eb5831b10d671f22b66df92df8752a7927bd52a9999922240eb945fcafa2cc0ace51a913358201484e7720572b0f202528b3c06c399867f08b0ff763e92661
-
Filesize
100KB
MD58a675f90a3af0c8be0851d193caebec3
SHA1114c4a2929fe567999fe0b6e7e0abab9d1929019
SHA256892f8aa9fb0c0d2d0375ce923ecf62f6596022fd1a6d1970413998aa46500631
SHA51242349359b592d2e40b390adef8769ce005eb9989f17d45dd7e70a206c0df8e5b13b3da8cd66eb9016d6953fbeadee96db033839c45ccdf06f9e5434f358a2540
-
Filesize
100KB
MD5ab7f6226f4dba571f6e0e406ac3337ab
SHA132edc43e35437a53d72427fbd0254ab0b7218306
SHA2560bfe39cdaf741fc12025728b781bc64f7a6f15f3fe4e5b6e66c293186880eaf9
SHA512c29435f7d99f131e4fde04c3ef0c42f8bd960ba2306bdfdb7590cc9f7c3b245cba9d5a52478064b9d9a2ef8a83444bba785005ca500f1b57b9e26938ee9b82a5
-
Filesize
162KB
MD5eae742be4cc1f8eb8cc39233bf7a6889
SHA17d177d10cf433d8ed60f36f6e2cdd34ede8e4c4b
SHA256cec93d630d6f2f2ff2f7a4cd42bdbae48f500dad9186364fe5c88ef9ba533f5d
SHA5127a5efb9f6a7f0c6db7b9196f7d8ac882c3a9c8da3d36b6ec7c68f116d1605a665631fec2841007b70e1e48bb7f53592db55e4c0186053ecfd302ae01f71ba6ba
-
Filesize
65KB
MD5edc855f768e8f97336105a9922ad25f0
SHA148fd0f16c6b2a220e53cd82bdfc7e87f96c6594f
SHA2564f0c031979ce84c94ff9c62af2be4d0c82b12ae1940e09d3d29a0d1e081dc738
SHA5121867d50d4d049037724ecb8234f44a460491c9edb04f08eddce8859ec838c955d4aa9d7f29a103679ae0c1b95d88daf9e883883abf301b739f485cde68d684ef
-
Filesize
1.1MB
-
Filesize
400KB
-
Filesize
168KB
-
Filesize
196KB
-
Filesize
1.1MB
-
Filesize
13.2MB
-
Filesize
3.8MB
-
Filesize
13.2MB
-
Filesize
4KB
-
Filesize
3.8MB