fatalrat | 60f3c8dfebe163f474fc691bcd6ff5dd008ee01125ac0672b8561755ddb78612

Analysis

max time kernel
117s
max time network
138s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05-03-2024 12:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

60f3c8dfebe163f474fc691bcd6ff5dd008ee01125ac0672b8561755ddb78612.exe
Size

1.1MB
MD5

fe2b01af685e7055401f945e1da3413a
SHA1

e07d8853b67cad9130812b010cede9f47cde686b
SHA256

60f3c8dfebe163f474fc691bcd6ff5dd008ee01125ac0672b8561755ddb78612
SHA512

c4d33395bae02650c0da06259cf4bd3ecde293adde4c18d908773ef4f73b06573f4ac0d92c0156cbd623084b64a8deadf698717686996742b4e4ee3ae065a931
SSDEEP

24576:poi7PS3m+tm6PhdxOEQeygp8iJRPmBh78fNw3B4xlfVyyYzni5s:Ak/kp8GRPqh7y23B4xHyyYz

Score

10^/10

fatalrat infostealer persistence rat upx

Malware Config

Signatures

FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
infostealer rat fatalrat

Fatal Rat payload 2 IoCs

rat infostealer

resource	yara_rule
behavioral1/memory/1980-38-0x0000000000230000-0x0000000000260000-memory.dmp	fatalrat
behavioral1/memory/1980-39-0x0000000010000000-0x0000000010029000-memory.dmp	fatalrat

Deletes itself 1 IoCs

pid	Process
3036	WScript.exe

Executes dropped EXE 2 IoCs

pid	Process
2228	go.exe
1980	Agghosts.exe

Loads dropped DLL 3 IoCs

pid	Process
2964	60f3c8dfebe163f474fc691bcd6ff5dd008ee01125ac0672b8561755ddb78612.exe
1980	Agghosts.exe
1980	Agghosts.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2964-0-0x0000000000400000-0x0000000000595000-memory.dmp	upx
behavioral1/memory/2964-1-0x0000000000400000-0x0000000000595000-memory.dmp	upx
behavioral1/files/0x0037000000014b4c-8.dat	upx
behavioral1/memory/2964-12-0x0000000003210000-0x0000000003355000-memory.dmp	upx
behavioral1/memory/2228-14-0x0000000000400000-0x0000000000545000-memory.dmp	upx
behavioral1/memory/2964-20-0x0000000000400000-0x0000000000595000-memory.dmp	upx
behavioral1/memory/2228-21-0x0000000000400000-0x0000000000545000-memory.dmp	upx
behavioral1/memory/2228-48-0x0000000000400000-0x0000000000545000-memory.dmp	upx
behavioral1/memory/2964-55-0x0000000000400000-0x0000000000595000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\Çý¶¯Éú = "C:\\cmnvyn\\Agghosts.exe"	Agghosts.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Agghosts.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Agghosts.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2964	60f3c8dfebe163f474fc691bcd6ff5dd008ee01125ac0672b8561755ddb78612.exe
2964	60f3c8dfebe163f474fc691bcd6ff5dd008ee01125ac0672b8561755ddb78612.exe
2964	60f3c8dfebe163f474fc691bcd6ff5dd008ee01125ac0672b8561755ddb78612.exe
2964	60f3c8dfebe163f474fc691bcd6ff5dd008ee01125ac0672b8561755ddb78612.exe
2964	60f3c8dfebe163f474fc691bcd6ff5dd008ee01125ac0672b8561755ddb78612.exe
2964	60f3c8dfebe163f474fc691bcd6ff5dd008ee01125ac0672b8561755ddb78612.exe
2964	60f3c8dfebe163f474fc691bcd6ff5dd008ee01125ac0672b8561755ddb78612.exe
2964	60f3c8dfebe163f474fc691bcd6ff5dd008ee01125ac0672b8561755ddb78612.exe
2964	60f3c8dfebe163f474fc691bcd6ff5dd008ee01125ac0672b8561755ddb78612.exe
2964	60f3c8dfebe163f474fc691bcd6ff5dd008ee01125ac0672b8561755ddb78612.exe
2964	60f3c8dfebe163f474fc691bcd6ff5dd008ee01125ac0672b8561755ddb78612.exe
2964	60f3c8dfebe163f474fc691bcd6ff5dd008ee01125ac0672b8561755ddb78612.exe
2964	60f3c8dfebe163f474fc691bcd6ff5dd008ee01125ac0672b8561755ddb78612.exe
2964	60f3c8dfebe163f474fc691bcd6ff5dd008ee01125ac0672b8561755ddb78612.exe
2964	60f3c8dfebe163f474fc691bcd6ff5dd008ee01125ac0672b8561755ddb78612.exe
2964	60f3c8dfebe163f474fc691bcd6ff5dd008ee01125ac0672b8561755ddb78612.exe
2964	60f3c8dfebe163f474fc691bcd6ff5dd008ee01125ac0672b8561755ddb78612.exe
2964	60f3c8dfebe163f474fc691bcd6ff5dd008ee01125ac0672b8561755ddb78612.exe
2964	60f3c8dfebe163f474fc691bcd6ff5dd008ee01125ac0672b8561755ddb78612.exe
2964	60f3c8dfebe163f474fc691bcd6ff5dd008ee01125ac0672b8561755ddb78612.exe
2964	60f3c8dfebe163f474fc691bcd6ff5dd008ee01125ac0672b8561755ddb78612.exe
2964	60f3c8dfebe163f474fc691bcd6ff5dd008ee01125ac0672b8561755ddb78612.exe
2964	60f3c8dfebe163f474fc691bcd6ff5dd008ee01125ac0672b8561755ddb78612.exe
2964	60f3c8dfebe163f474fc691bcd6ff5dd008ee01125ac0672b8561755ddb78612.exe
2964	60f3c8dfebe163f474fc691bcd6ff5dd008ee01125ac0672b8561755ddb78612.exe
2964	60f3c8dfebe163f474fc691bcd6ff5dd008ee01125ac0672b8561755ddb78612.exe
2964	60f3c8dfebe163f474fc691bcd6ff5dd008ee01125ac0672b8561755ddb78612.exe
2964	60f3c8dfebe163f474fc691bcd6ff5dd008ee01125ac0672b8561755ddb78612.exe
2964	60f3c8dfebe163f474fc691bcd6ff5dd008ee01125ac0672b8561755ddb78612.exe
2964	60f3c8dfebe163f474fc691bcd6ff5dd008ee01125ac0672b8561755ddb78612.exe
2964	60f3c8dfebe163f474fc691bcd6ff5dd008ee01125ac0672b8561755ddb78612.exe
2964	60f3c8dfebe163f474fc691bcd6ff5dd008ee01125ac0672b8561755ddb78612.exe
2964	60f3c8dfebe163f474fc691bcd6ff5dd008ee01125ac0672b8561755ddb78612.exe
2964	60f3c8dfebe163f474fc691bcd6ff5dd008ee01125ac0672b8561755ddb78612.exe
2964	60f3c8dfebe163f474fc691bcd6ff5dd008ee01125ac0672b8561755ddb78612.exe
2964	60f3c8dfebe163f474fc691bcd6ff5dd008ee01125ac0672b8561755ddb78612.exe
2964	60f3c8dfebe163f474fc691bcd6ff5dd008ee01125ac0672b8561755ddb78612.exe
2964	60f3c8dfebe163f474fc691bcd6ff5dd008ee01125ac0672b8561755ddb78612.exe
2964	60f3c8dfebe163f474fc691bcd6ff5dd008ee01125ac0672b8561755ddb78612.exe
2964	60f3c8dfebe163f474fc691bcd6ff5dd008ee01125ac0672b8561755ddb78612.exe
2964	60f3c8dfebe163f474fc691bcd6ff5dd008ee01125ac0672b8561755ddb78612.exe
2964	60f3c8dfebe163f474fc691bcd6ff5dd008ee01125ac0672b8561755ddb78612.exe
2964	60f3c8dfebe163f474fc691bcd6ff5dd008ee01125ac0672b8561755ddb78612.exe
2964	60f3c8dfebe163f474fc691bcd6ff5dd008ee01125ac0672b8561755ddb78612.exe
2964	60f3c8dfebe163f474fc691bcd6ff5dd008ee01125ac0672b8561755ddb78612.exe
2964	60f3c8dfebe163f474fc691bcd6ff5dd008ee01125ac0672b8561755ddb78612.exe
2964	60f3c8dfebe163f474fc691bcd6ff5dd008ee01125ac0672b8561755ddb78612.exe
2228	go.exe
2964	60f3c8dfebe163f474fc691bcd6ff5dd008ee01125ac0672b8561755ddb78612.exe
1980	Agghosts.exe
1980	Agghosts.exe
1980	Agghosts.exe
1980	Agghosts.exe
1980	Agghosts.exe
1980	Agghosts.exe
1980	Agghosts.exe
1980	Agghosts.exe
1980	Agghosts.exe
1980	Agghosts.exe
1980	Agghosts.exe
1980	Agghosts.exe
1980	Agghosts.exe
1980	Agghosts.exe
1980	Agghosts.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1576	helppane.exe
Token: SeDebugPrivilege	1980	Agghosts.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1576	helppane.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2964	60f3c8dfebe163f474fc691bcd6ff5dd008ee01125ac0672b8561755ddb78612.exe
2964	60f3c8dfebe163f474fc691bcd6ff5dd008ee01125ac0672b8561755ddb78612.exe
2228	go.exe
2228	go.exe
1576	helppane.exe
1576	helppane.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 2228	2964	60f3c8dfebe163f474fc691bcd6ff5dd008ee01125ac0672b8561755ddb78612.exe	30
PID 2964 wrote to memory of 2228	2964	60f3c8dfebe163f474fc691bcd6ff5dd008ee01125ac0672b8561755ddb78612.exe	30
PID 2964 wrote to memory of 2228	2964	60f3c8dfebe163f474fc691bcd6ff5dd008ee01125ac0672b8561755ddb78612.exe	30
PID 2964 wrote to memory of 2228	2964	60f3c8dfebe163f474fc691bcd6ff5dd008ee01125ac0672b8561755ddb78612.exe	30
PID 1576 wrote to memory of 1980	1576	helppane.exe	32
PID 1576 wrote to memory of 1980	1576	helppane.exe	32
PID 1576 wrote to memory of 1980	1576	helppane.exe	32
PID 1576 wrote to memory of 1980	1576	helppane.exe	32
PID 2228 wrote to memory of 1636	2228	go.exe	33
PID 2228 wrote to memory of 1636	2228	go.exe	33
PID 2228 wrote to memory of 1636	2228	go.exe	33
PID 2228 wrote to memory of 1636	2228	go.exe	33
PID 2964 wrote to memory of 3036	2964	60f3c8dfebe163f474fc691bcd6ff5dd008ee01125ac0672b8561755ddb78612.exe	34
PID 2964 wrote to memory of 3036	2964	60f3c8dfebe163f474fc691bcd6ff5dd008ee01125ac0672b8561755ddb78612.exe	34
PID 2964 wrote to memory of 3036	2964	60f3c8dfebe163f474fc691bcd6ff5dd008ee01125ac0672b8561755ddb78612.exe	34
PID 2964 wrote to memory of 3036	2964	60f3c8dfebe163f474fc691bcd6ff5dd008ee01125ac0672b8561755ddb78612.exe	34

C:\Users\Admin\AppData\Local\Temp\60f3c8dfebe163f474fc691bcd6ff5dd008ee01125ac0672b8561755ddb78612.exe
"C:\Users\Admin\AppData\Local\Temp\60f3c8dfebe163f474fc691bcd6ff5dd008ee01125ac0672b8561755ddb78612.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Users\Public\Pictures\go\go.exe
  C:\Users\Public\Pictures\go\go.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2228
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Public\Pictures\go\tem.vbs"
    3⤵
    PID:1636
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\tem.vbs"
  2⤵
  - Deletes itself
  PID:3036

C:\Windows\helppane.exe
C:\Windows\helppane.exe -Embedding
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1576
- C:\cmnvyn\Agghosts.exe
  "C:\cmnvyn\Agghosts.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tem.vbs

Filesize
275B

MD5
d774e3336b7cc910f6c999c0dec27849

SHA1
2056bf57c62008e2715e270d5f414c93a71a7dbc

SHA256
f5205b1dd0b4113858fed0d3b33b0713174c54c6ff8dae37ac99427eae1b2e14

SHA512
6db90f157a4a8d5e488bfb38a6c0136bc3c1fc65ed8d33118c520f2dbda53d72cb51a94d774edb430ddbf4c96a160af4213da1844479e2d24c31c4ac29265221

Download Submit
C:\Users\Public\Pictures\go\tem.vbs

Filesize
201B

MD5
07c0daef4072e4780abfff9a950f5dc7

SHA1
24b613773ba7171d72306da438c7cd851add7256

SHA256
7a445e7acd2798b120ac9804ecf5f47a5007f0f9502ab93bd419bbe5e2eca58a

SHA512
a1e70ba62ac07719fe9fab3d3088aae3050b8c5bd0cb38b6807ca1f3b7d364fdca9c144287554388641e813d842019723944b72c5a3d43446080148595151305

Download Submit
C:\cmnvyn\Agghosts.exe

Filesize
23KB

MD5
5aab297fa8f143bfa67310ad78b76d3f

SHA1
5db963c2cca1bc8c8c060c52f7df76ccb477f01a

SHA256
8ec64bc55e5641d7683288e5e8e27c9391f06eb4da096c3d677d8f25ca4d04df

SHA512
c1ee67bd4c6bcfdc4179f905c7abc4ac632c9265b61dd5fdb90eeeec39802abe2cc487a5c8ded8a0748728104170c1b4d3a88904f102e1c3f891fac7702a2256

Download Submit
C:\cmnvyn\Enpud.png

Filesize
157KB

MD5
083695ee2461e132175382f6e5fdb406

SHA1
a7cbca531965347369a5ad1880d1cd04e07fd495

SHA256
408fc0f25c7f15b118b62aa791d9a341766e4a9c0c68b428305f7b27c9b340d8

SHA512
edd84627591eb712320b4d4b8e239ba72c3708ec302bb7db621d4b98d7582cb5eb56b579a96c8b666381d8c636e44e1b5a54fb40de80bb15cbc157255aa951e2

Download Submit
\Users\Public\Pictures\go\go.exe

Filesize
618KB

MD5
42e3ff02624af409baad3dbce6c75157

SHA1
e411abc73bed5fd672d3588d9db0f06f93d4969e

SHA256
678eb3f0c74171692335675e08c5d5921554c4e3dc98a29478e4d544204526be

SHA512
1f6ddffc287fa351d886c3409549f90dcee66d41dbff820c927d02cc67b787346df80fba2051d4a76a9cd5b6e417969acf3370577076bc1ea6fb2681c65a500f

Download Submit
\cmnvyn\QiDianBrowserMgr.dll

Filesize
124KB

MD5
257288f9dea07264b8f33be282582990

SHA1
2916c8e54e176086e8cfabf61afecc8bbf257a1f

SHA256
8c31cd54e0ea20795a81349af30231bf3b18c4c42c1c5a38664334140a8ab552

SHA512
ad5d275f6d774253f11ac190fe3d6368bec6ad8d80189b1837f3abc7479a00f1e297e4752b79da6de051986aaefeeb4f29eefff9b43e8a06f61a2c5765faf05a

Download Submit
\cmnvyn\vcruntime140.dll

Filesize
77KB

MD5
f107a3c7371c4543bd3908ba729dd2db

SHA1
af8e7e8f446de74db2f31d532e46eab8bbf41e0a

SHA256
00df0901c101254525a219d93ff1830da3a20d3f14bc323354d8d5fee5854ec0

SHA512
fd776f8ceaac498f4f44819794c0fa89224712a8c476819ffc76ba4c7ff4caa9b360b9d299d9df7965387e5bbcb330f316f53759b5146a73b27a5f2e964c3530

Download Submit
memory/1576-30-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/1980-38-0x0000000000230000-0x0000000000260000-memory.dmp

Filesize
192KB

Download
memory/1980-39-0x0000000010000000-0x0000000010029000-memory.dmp

Filesize
164KB

Download
memory/2228-21-0x0000000000400000-0x0000000000545000-memory.dmp

Filesize
1.3MB

Download
memory/2228-14-0x0000000000400000-0x0000000000545000-memory.dmp

Filesize
1.3MB

Download
memory/2228-48-0x0000000000400000-0x0000000000545000-memory.dmp

Filesize
1.3MB

Download
memory/2964-0-0x0000000000400000-0x0000000000595000-memory.dmp

Filesize
1.6MB

Download
memory/2964-24-0x0000000003210000-0x0000000003355000-memory.dmp

Filesize
1.3MB

Download
memory/2964-20-0x0000000000400000-0x0000000000595000-memory.dmp

Filesize
1.6MB

Download
memory/2964-12-0x0000000003210000-0x0000000003355000-memory.dmp

Filesize
1.3MB

Download
memory/2964-55-0x0000000000400000-0x0000000000595000-memory.dmp

Filesize
1.6MB

Download
memory/2964-1-0x0000000000400000-0x0000000000595000-memory.dmp

Filesize
1.6MB

Download