Analysis
-
max time kernel
118s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
04-03-2024 10:37
General
-
Target
0b7e750fd4f4216365b186c27d56010944292fc560187caaf6927d39c0475f3d.exe
-
Size
1.2MB
-
MD5
4f3c210c1dca2812a5f5ab5204af0452
-
SHA1
088b32035675b4c6de57b08ca70492eb82bfe2f7
-
SHA256
0b7e750fd4f4216365b186c27d56010944292fc560187caaf6927d39c0475f3d
-
SHA512
96172a727d3e0074de190c7f1355b1825b5435c92f2328d5b9f68deaf6aa0a706d206197d0e2e467da37a1b3bd4c97fac27f3e33aa26575b0a6f337e699429ca
-
SSDEEP
24576:SCPiA4TZzM/LGZfnMkDdNOWvqszPUFc9OuQlzE9fzwJVjDKkdog4w+C0YdMpN5Vn:CtMk/vqszMi9OuQlzE9MJhKkSgv+CLm/
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload 2 IoCs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 2 IoCs
-
UPX packed file 8 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies registry class 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0b7e750fd4f4216365b186c27d56010944292fc560187caaf6927d39c0475f3d.exe"C:\Users\Admin\AppData\Local\Temp\0b7e750fd4f4216365b186c27d56010944292fc560187caaf6927d39c0475f3d.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\Pictures\db\db.exeC:\Users\Public\Pictures\db\db.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Public\Pictures\db\tem.vbs"3⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\tem.vbs"2⤵
- Deletes itself
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4340 --field-trial-handle=2240,i,16875000905773190493,11379096115878622792,262144 --variations-seed-version /prefetch:81⤵
-
C:\Windows\helppane.exeC:\Windows\helppane.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\bdantq\Agghosts.exe"C:\bdantq\Agghosts.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
275B
MD50693877e4a90188fe92ff74791081a6c
SHA1bd3d55f34dfa0873e69926ffb47e32148d14f626
SHA256a49e3117718d4f83fef1e8614fccbf1a7c0d8b1a224df2f18fa6b5ec44ade416
SHA51235c2139f575f7f07cf0a889c8758fdb3b2e453ae9a1f5faa575ef9492836418bfacef5898e13f87c528f03e8a57862455126589fe7a48e4b672cc34387a3c601
-
Filesize
618KB
MD5a42deae0974ab7c9122370bfba837fe6
SHA1237ff0b63a56126542a9cb103c7cbfc397ada84b
SHA25636ad631425f128b45e48d26d11e8750f44aa4d4802d60cff4dc7ab9577639b74
SHA5129ea8820f7da135a9188b1cca234cdc7080e7dade8b69b9e8c79569fa9c5c49406d8e3b84bdae0b29aa5f836804f9c855f7c662ceb9d152cff1dd01478996fcad
-
Filesize
201B
MD595740dcb990d12a2297dbac140eb8e94
SHA18ff4077720cbc4fc92ec95f58dbcadf6d63678ed
SHA2567a6d4c02178dcd0125ba32233aaa32e44e4ee14924fe7cbfcedc8ad75ff2a16e
SHA51204890f30e412fa5e0d1378a4ce7a47533233ec7d9f846eb9056ff13e8e32eae74341eadcf4283fe4b0d47f675d85a75853984f9df8217cd36d18dd58656bcf12
-
Filesize
23KB
MD55aab297fa8f143bfa67310ad78b76d3f
SHA15db963c2cca1bc8c8c060c52f7df76ccb477f01a
SHA2568ec64bc55e5641d7683288e5e8e27c9391f06eb4da096c3d677d8f25ca4d04df
SHA512c1ee67bd4c6bcfdc4179f905c7abc4ac632c9265b61dd5fdb90eeeec39802abe2cc487a5c8ded8a0748728104170c1b4d3a88904f102e1c3f891fac7702a2256
-
Filesize
157KB
MD56d4775f18b2ee05bb4763d3080d36bbe
SHA1cdf9525b39409515b350d02b91bff61aac3cd55f
SHA25623bb3a8e6cd6be562f57e98441888782f8f0d8d8ce456a9a40bf711a68a34c97
SHA51245368d3468e45324362eded3905d16850136318acf88c9d8d9590f77fb912d423fe52f24ab3b0b4d001605692e2d0627ba1463de533b96724cd25a8548cf9e82
-
Filesize
123KB
MD5daa799b7defab6d9867c5d519b36611f
SHA14020d8587c28df934bd460b4dc953561be61e4ff
SHA2566cec316645c5abc4f31eb25f3f09f462f843fc73b9c1db79c5f580c6773e8d00
SHA51252979cb556129d2efd2615001cfd5dab74066c9ed45d46746c02d71f6418b92a61fc5dc4c182089d2bc66d7d1a5e461b8fa60702f872d63194412bc4fa699777
-
Filesize
77KB
MD5f107a3c7371c4543bd3908ba729dd2db
SHA1af8e7e8f446de74db2f31d532e46eab8bbf41e0a
SHA25600df0901c101254525a219d93ff1830da3a20d3f14bc323354d8d5fee5854ec0
SHA512fd776f8ceaac498f4f44819794c0fa89224712a8c476819ffc76ba4c7ff4caa9b360b9d299d9df7965387e5bbcb330f316f53759b5146a73b27a5f2e964c3530
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
192KB
-
Filesize
164KB
-
Filesize
192KB
