fatalrat | 65a6740aaab16104235a33c2e9aea03479491ac60cfb316b44a1ec3c1f87027d

Analysis

max time kernel
135s
max time network
146s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
12-01-2024 06:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

55bea56c9ad9357a714843e5da3a0165.exe
Size

335KB
MD5

55bea56c9ad9357a714843e5da3a0165
SHA1

4ef79ba772406e111ad986036324d1d0ea15cc9d
SHA256

65a6740aaab16104235a33c2e9aea03479491ac60cfb316b44a1ec3c1f87027d
SHA512

29893d2ad84093f36a549e5b02124ca562f20568bb9445687bc4e6109beb3b114bf86d11d6b6d00815d7ffa0f9694c8a5ef420c60d6380db29e95513f0ddbae5
SSDEEP

6144:AoLZBns/AeJrtYO+6FDsqTDFu3ZSCBt/oPRYYayHiS:AotmJMk9TDFu3ZS40RO2

Score

10^/10

fatalrat infostealer rat

Malware Config

Signatures

FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
infostealer rat fatalrat

Fatal Rat payload 1 IoCs

rat infostealer

Processes:

resource	yara_rule
behavioral1/memory/2936-2-0x0000000010000000-0x000000001002A000-memory.dmp	fatalrat

Executes dropped EXE 2 IoCs

Processes:

Pqrstu.exePqrstu.exe

pid	Process
3068	Pqrstu.exe
2020	Pqrstu.exe

Drops file in Windows directory 4 IoCs

Processes:

55bea56c9ad9357a714843e5da3a0165.exePqrstu.exe

description	ioc	Process
File created	C:\Windows\Pqrstu.exe	55bea56c9ad9357a714843e5da3a0165.exe
File opened for modification	C:\Windows\Pqrstu.exe	55bea56c9ad9357a714843e5da3a0165.exe
File opened for modification	C:\Windows\Pqrstu.exe	Pqrstu.exe
File created	C:\Windows\Pqrstu.exe	Pqrstu.exe

Modifies data under HKEY_USERS 16 IoCs

Processes:

Pqrstu.exePqrstu.exe

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion	Pqrstu.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	Pqrstu.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableLockWorkstation = "1"	Pqrstu.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System	Pqrstu.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableLockWorkstation = "1"	Pqrstu.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Services\Pqrstu Wxyabcde\Group = "Fatal"	Pqrstu.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	Pqrstu.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows	Pqrstu.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies	Pqrstu.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet	Pqrstu.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System	Pqrstu.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Services	Pqrstu.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Services\Pqrstu Wxyabcde\InstallTime = "2024-01-12 07:11"	Pqrstu.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	Pqrstu.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM	Pqrstu.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Services\Pqrstu Wxyabcde	Pqrstu.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

55bea56c9ad9357a714843e5da3a0165.exePqrstu.exePqrstu.exe

description	pid	Process
Token: SeDebugPrivilege	2936	55bea56c9ad9357a714843e5da3a0165.exe
Token: SeDebugPrivilege	3068	Pqrstu.exe
Token: SeDebugPrivilege	2020	Pqrstu.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

Pqrstu.exe

description	pid	Process	procid_target
PID 3068 wrote to memory of 2020	3068	Pqrstu.exe	1
PID 3068 wrote to memory of 2020	3068	Pqrstu.exe	1
PID 3068 wrote to memory of 2020	3068	Pqrstu.exe	1
PID 3068 wrote to memory of 2020	3068	Pqrstu.exe	1

C:\Windows\Pqrstu.exe
C:\Windows\Pqrstu.exe Win7
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2020

C:\Windows\Pqrstu.exe
C:\Windows\Pqrstu.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3068

C:\Users\Admin\AppData\Local\Temp\55bea56c9ad9357a714843e5da3a0165.exe
"C:\Users\Admin\AppData\Local\Temp\55bea56c9ad9357a714843e5da3a0165.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2936

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\Documents\SVP7.PNG

Filesize
152KB

MD5
b02e46db6e44bab74dccf4cfd14a1076

SHA1
295a06cc304356f7f9671c03fc858dc071e1f391

SHA256
24448f93ddeadd0d1c71f273e6a080f0f6200cc0c753f88efb06fced3c816ebf

SHA512
a53948cdef001502e0dc17c0ecf5331dfcff78c54b41d3a4bd11cbe73afe61a55339689d5192fcad7e7f2a805a7b8ada4fadd3b6e637738c589d5c91603e77b4

Download Submit
C:\Windows\Pqrstu.exe

Filesize
335KB

MD5
55bea56c9ad9357a714843e5da3a0165

SHA1
4ef79ba772406e111ad986036324d1d0ea15cc9d

SHA256
65a6740aaab16104235a33c2e9aea03479491ac60cfb316b44a1ec3c1f87027d

SHA512
29893d2ad84093f36a549e5b02124ca562f20568bb9445687bc4e6109beb3b114bf86d11d6b6d00815d7ffa0f9694c8a5ef420c60d6380db29e95513f0ddbae5

Download Submit
memory/2936-2-0x0000000010000000-0x000000001002A000-memory.dmp

Filesize
168KB

Download