Analysis
-
max time kernel
130s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
03-03-2024 16:35
General
-
Target
e127b2751dbf53db3d7b63f55b969ffc419275446168c3c1496ca4a99b3594f6.exe
-
Size
1.1MB
-
MD5
e1995e1ea6000f8382d98e22aba021ba
-
SHA1
716aa9a9b4ce87c92a4c9661ebdf8ce4cd0a0d51
-
SHA256
e127b2751dbf53db3d7b63f55b969ffc419275446168c3c1496ca4a99b3594f6
-
SHA512
3015d6738e3f337c63041311053d3ba3059252721eb4f2c926955d78612dd3c0c4941d806270b76db2c0676bec64e7b785ced2b6181d8ff0a5155626d35f6e79
-
SSDEEP
24576:jh81D9tMyR1ev8r6TmyfPT7MmaR8HzbiXEyvYhINGwApm:jhQmEr6T1fPT/HiXSI0we
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload 2 IoCs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 2 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies registry class 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e127b2751dbf53db3d7b63f55b969ffc419275446168c3c1496ca4a99b3594f6.exe"C:\Users\Admin\AppData\Local\Temp\e127b2751dbf53db3d7b63f55b969ffc419275446168c3c1496ca4a99b3594f6.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\Pictures\md\md.exeC:\Users\Public\Pictures\md\md.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Public\Pictures\md\tem.vbs"3⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\tem.vbs"2⤵
- Deletes itself
-
-
C:\Windows\helppane.exeC:\Windows\helppane.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\ozujru\Agghosts.exe"C:\ozujru\Agghosts.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
275B
MD523fda4f2ea5f8aa4998f45effabff39c
SHA1591a10ba19f057b5c550260a723364457661a903
SHA256adc0da4808d255af2d881fba45d3fcb9decab7fb1616b2282e312109a181461f
SHA512ddc64835a69c2e3f5057ba5ab9e56b652eea0a9694e5b68ea6573f8281e03bf5fc2da3863a62f14f4c8759aa5b712af95a64e87e8258dd646ccb2488cbe9e9f7
-
Filesize
618KB
MD542e3ff02624af409baad3dbce6c75157
SHA1e411abc73bed5fd672d3588d9db0f06f93d4969e
SHA256678eb3f0c74171692335675e08c5d5921554c4e3dc98a29478e4d544204526be
SHA5121f6ddffc287fa351d886c3409549f90dcee66d41dbff820c927d02cc67b787346df80fba2051d4a76a9cd5b6e417969acf3370577076bc1ea6fb2681c65a500f
-
Filesize
201B
MD5840f46b36eb4ebba01fc75cbbb51c51f
SHA1e27aa9d445de870cee195024f5638c322eaff9c6
SHA256d22f112666cf1e6ab94f04f302ab91f093558ec5b7602a1406e5de580312b93e
SHA512ffe627c507c08275a1ca481bb4ea6512d03e0110876d60d55ede6314ca7b3c65ada07c88e24761ea7f6f0d4b4fc36ddf1a4ddf27e4b6286171c5d1819e280e1c
-
Filesize
23KB
MD55aab297fa8f143bfa67310ad78b76d3f
SHA15db963c2cca1bc8c8c060c52f7df76ccb477f01a
SHA2568ec64bc55e5641d7683288e5e8e27c9391f06eb4da096c3d677d8f25ca4d04df
SHA512c1ee67bd4c6bcfdc4179f905c7abc4ac632c9265b61dd5fdb90eeeec39802abe2cc487a5c8ded8a0748728104170c1b4d3a88904f102e1c3f891fac7702a2256
-
Filesize
157KB
MD5083695ee2461e132175382f6e5fdb406
SHA1a7cbca531965347369a5ad1880d1cd04e07fd495
SHA256408fc0f25c7f15b118b62aa791d9a341766e4a9c0c68b428305f7b27c9b340d8
SHA512edd84627591eb712320b4d4b8e239ba72c3708ec302bb7db621d4b98d7582cb5eb56b579a96c8b666381d8c636e44e1b5a54fb40de80bb15cbc157255aa951e2
-
Filesize
124KB
MD5257288f9dea07264b8f33be282582990
SHA12916c8e54e176086e8cfabf61afecc8bbf257a1f
SHA2568c31cd54e0ea20795a81349af30231bf3b18c4c42c1c5a38664334140a8ab552
SHA512ad5d275f6d774253f11ac190fe3d6368bec6ad8d80189b1837f3abc7479a00f1e297e4752b79da6de051986aaefeeb4f29eefff9b43e8a06f61a2c5765faf05a
-
Filesize
77KB
MD5f107a3c7371c4543bd3908ba729dd2db
SHA1af8e7e8f446de74db2f31d532e46eab8bbf41e0a
SHA25600df0901c101254525a219d93ff1830da3a20d3f14bc323354d8d5fee5854ec0
SHA512fd776f8ceaac498f4f44819794c0fa89224712a8c476819ffc76ba4c7ff4caa9b360b9d299d9df7965387e5bbcb330f316f53759b5146a73b27a5f2e964c3530
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
164KB
-
Filesize
192KB
