Overview

overview

10

Static

static

7

0b7e750fd4...3d.exe

windows7-x64

10

0b7e750fd4...3d.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    121s
  • max time network
    139s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    04-03-2024 10:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0b7e750fd4f4216365b186c27d56010944292fc560187caaf6927d39c0475f3d.exe

  • Size

    1.2MB

  • MD5

    4f3c210c1dca2812a5f5ab5204af0452

  • SHA1

    088b32035675b4c6de57b08ca70492eb82bfe2f7

  • SHA256

    0b7e750fd4f4216365b186c27d56010944292fc560187caaf6927d39c0475f3d

  • SHA512

    96172a727d3e0074de190c7f1355b1825b5435c92f2328d5b9f68deaf6aa0a706d206197d0e2e467da37a1b3bd4c97fac27f3e33aa26575b0a6f337e699429ca

  • SSDEEP

    24576:SCPiA4TZzM/LGZfnMkDdNOWvqszPUFc9OuQlzE9fzwJVjDKkdog4w+C0YdMpN5Vn:CtMk/vqszMi9OuQlzE9MJhKkSgv+CLm/

Score
10/10
fatalratinfostealerpersistenceratupx

Malware Config

Signatures

  • FatalRat

    FatalRat is a modular infostealer family written in C++ first appearing in June 2021.

    infostealerratfatalrat
  • Fatal Rat payload 2 IoCs
    ratinfostealer
  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0b7e750fd4f4216365b186c27d56010944292fc560187caaf6927d39c0475f3d.exe
    "C:\Users\Admin\AppData\Local\Temp\0b7e750fd4f4216365b186c27d56010944292fc560187caaf6927d39c0475f3d.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2304
    • C:\Users\Public\Pictures\eu\eu.exe
      C:\Users\Public\Pictures\eu\eu.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2444
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Public\Pictures\eu\tem.vbs"
        3⤵
          PID:2840
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\tem.vbs"
        2⤵
        • Deletes itself
        PID:2056
    • C:\Windows\helppane.exe
      C:\Windows\helppane.exe -Embedding
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1996
      • C:\tqwepy\Agghosts.exe
        "C:\tqwepy\Agghosts.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2692

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tem.vbs
      Filesize

      275B

      MD5

      0693877e4a90188fe92ff74791081a6c

      SHA1

      bd3d55f34dfa0873e69926ffb47e32148d14f626

      SHA256

      a49e3117718d4f83fef1e8614fccbf1a7c0d8b1a224df2f18fa6b5ec44ade416

      SHA512

      35c2139f575f7f07cf0a889c8758fdb3b2e453ae9a1f5faa575ef9492836418bfacef5898e13f87c528f03e8a57862455126589fe7a48e4b672cc34387a3c601

      Download Submit

    • C:\Users\Public\Pictures\eu\tem.vbs
      Filesize

      201B

      MD5

      c86d821f954a4f79e49aac16f6c3e8e3

      SHA1

      ba584bd057858c40e06a957dd7ae7c8bd2bcf828

      SHA256

      3e88132abfaec0c1f6be4a07d0dad8c05d945ab5693d910917d35db51cb02ae6

      SHA512

      d97ca6a505009c3a63b12731ce205f16ce71ef05bf6fca16bde3f636da091cf39e5766f416815997444a9e3eb4daffa62b226bf35c57c001e55421dfa7b011c8

      Download Submit

    • C:\tqwepy\Agghosts.exe
      Filesize

      23KB

      MD5

      5aab297fa8f143bfa67310ad78b76d3f

      SHA1

      5db963c2cca1bc8c8c060c52f7df76ccb477f01a

      SHA256

      8ec64bc55e5641d7683288e5e8e27c9391f06eb4da096c3d677d8f25ca4d04df

      SHA512

      c1ee67bd4c6bcfdc4179f905c7abc4ac632c9265b61dd5fdb90eeeec39802abe2cc487a5c8ded8a0748728104170c1b4d3a88904f102e1c3f891fac7702a2256

      Download Submit

    • C:\tqwepy\Enpud.png
      Filesize

      157KB

      MD5

      6d4775f18b2ee05bb4763d3080d36bbe

      SHA1

      cdf9525b39409515b350d02b91bff61aac3cd55f

      SHA256

      23bb3a8e6cd6be562f57e98441888782f8f0d8d8ce456a9a40bf711a68a34c97

      SHA512

      45368d3468e45324362eded3905d16850136318acf88c9d8d9590f77fb912d423fe52f24ab3b0b4d001605692e2d0627ba1463de533b96724cd25a8548cf9e82

      Download Submit

    • C:\tqwepy\VCRUNTIME140.dll
      Filesize

      77KB

      MD5

      f107a3c7371c4543bd3908ba729dd2db

      SHA1

      af8e7e8f446de74db2f31d532e46eab8bbf41e0a

      SHA256

      00df0901c101254525a219d93ff1830da3a20d3f14bc323354d8d5fee5854ec0

      SHA512

      fd776f8ceaac498f4f44819794c0fa89224712a8c476819ffc76ba4c7ff4caa9b360b9d299d9df7965387e5bbcb330f316f53759b5146a73b27a5f2e964c3530

      Download Submit

    • \Users\Public\Pictures\eu\eu.exe
      Filesize

      618KB

      MD5

      a42deae0974ab7c9122370bfba837fe6

      SHA1

      237ff0b63a56126542a9cb103c7cbfc397ada84b

      SHA256

      36ad631425f128b45e48d26d11e8750f44aa4d4802d60cff4dc7ab9577639b74

      SHA512

      9ea8820f7da135a9188b1cca234cdc7080e7dade8b69b9e8c79569fa9c5c49406d8e3b84bdae0b29aa5f836804f9c855f7c662ceb9d152cff1dd01478996fcad

      Download Submit

    • \tqwepy\QiDianBrowserMgr.dll
      Filesize

      123KB

      MD5

      daa799b7defab6d9867c5d519b36611f

      SHA1

      4020d8587c28df934bd460b4dc953561be61e4ff

      SHA256

      6cec316645c5abc4f31eb25f3f09f462f843fc73b9c1db79c5f580c6773e8d00

      SHA512

      52979cb556129d2efd2615001cfd5dab74066c9ed45d46746c02d71f6418b92a61fc5dc4c182089d2bc66d7d1a5e461b8fa60702f872d63194412bc4fa699777

      Download Submit

    • memory/1996-30-0x00000000003C0000-0x00000000003C1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2304-0-0x0000000000400000-0x00000000005A4000-memory.dmp

      Filesize

      1.6MB

      Download

    • memory/2304-23-0x00000000033A0000-0x00000000034E5000-memory.dmp

      Filesize

      1.3MB

      Download

    • memory/2304-20-0x0000000000400000-0x00000000005A4000-memory.dmp

      Filesize

      1.6MB

      Download

    • memory/2304-11-0x00000000033A0000-0x00000000034E5000-memory.dmp

      Filesize

      1.3MB

      Download

    • memory/2304-55-0x0000000000400000-0x00000000005A4000-memory.dmp

      Filesize

      1.6MB

      Download

    • memory/2304-1-0x0000000000400000-0x00000000005A4000-memory.dmp

      Filesize

      1.6MB

      Download

    • memory/2444-21-0x0000000000400000-0x0000000000545000-memory.dmp

      Filesize

      1.3MB

      Download

    • memory/2444-14-0x0000000000400000-0x0000000000545000-memory.dmp

      Filesize

      1.3MB

      Download

    • memory/2444-48-0x0000000000400000-0x0000000000545000-memory.dmp

      Filesize

      1.3MB

      Download

    • memory/2692-39-0x0000000010000000-0x0000000010029000-memory.dmp

      Filesize

      164KB

      Download

    • memory/2692-38-0x0000000000080000-0x00000000000B0000-memory.dmp

      Filesize

      192KB

      Download