Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
06-03-2024 10:36
General
-
Target
b7794e9d2be35d928d7ca6bcf5e60903d3da29bec3d3940339a81be3708e4d4e.exe
-
Size
1.2MB
-
MD5
a0cd682572bead77d039b40912ae1b70
-
SHA1
74e4615558ffb8d6c22ced83b8912c79140fae50
-
SHA256
b7794e9d2be35d928d7ca6bcf5e60903d3da29bec3d3940339a81be3708e4d4e
-
SHA512
dc838cd33dcfff3b471213ba4e9fbf9e22a30aa0c980b19d7e7f345d2a2e069453c6ece02bf274a8912f9dd34cb468bc747b6c61657d6320bd9ccfb3b317e1d8
-
SSDEEP
24576:aCPiA4TZzM/LGZfnMkDdNOWvqszPUFc9OuQlzE9fzwJVjDKkdog4w+C0YdMpN5VM:6tMk/vqszMi9OuQlzE9MJhKkSgv+CLmk
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload 2 IoCs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 2 IoCs
-
UPX packed file 8 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies registry class 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b7794e9d2be35d928d7ca6bcf5e60903d3da29bec3d3940339a81be3708e4d4e.exe"C:\Users\Admin\AppData\Local\Temp\b7794e9d2be35d928d7ca6bcf5e60903d3da29bec3d3940339a81be3708e4d4e.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\Pictures\hi\hi.exeC:\Users\Public\Pictures\hi\hi.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Public\Pictures\hi\tem.vbs"3⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\tem.vbs"2⤵
- Deletes itself
-
-
C:\Windows\helppane.exeC:\Windows\helppane.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\ruynvt\Agghosts.exe"C:\ruynvt\Agghosts.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
275B
MD5a43f5c2b0a5e5198ab5801402cf1a9a5
SHA1e0be78f806b58f5bb53674bc065d14a3ad8eef84
SHA2566324000401c93c23825aef6bc652b0e57e7a8d74b314c3ceb3486cd0b91eb2d5
SHA5123ea5b9e258ed53a2da11a8555ae18bca5c768d35ff334cdeb850ea12663977f2057f46de375ee48fbf6fd654aab874527036ba0d43bc099840c0d56816234747
-
Filesize
618KB
MD5a42deae0974ab7c9122370bfba837fe6
SHA1237ff0b63a56126542a9cb103c7cbfc397ada84b
SHA25636ad631425f128b45e48d26d11e8750f44aa4d4802d60cff4dc7ab9577639b74
SHA5129ea8820f7da135a9188b1cca234cdc7080e7dade8b69b9e8c79569fa9c5c49406d8e3b84bdae0b29aa5f836804f9c855f7c662ceb9d152cff1dd01478996fcad
-
Filesize
201B
MD5725fc97f5d1d6a9a70fbfb9336d8eb4f
SHA14f7c9f7e6ee4d0358edfdc037e2c2c28879a7005
SHA256e5ceba897e436cd8d43bd2d96c080be666837ca1f00630c732f5ffc72518f19f
SHA512489b6101db6c513a8492d8b58a2e0c9cccd80d6f215f519ca8737b8b4b6b8d35313783f75b80dd1fdca91f49a6ef57df2ea6fbfaeb9e75db173967392900e3bd
-
Filesize
23KB
MD55aab297fa8f143bfa67310ad78b76d3f
SHA15db963c2cca1bc8c8c060c52f7df76ccb477f01a
SHA2568ec64bc55e5641d7683288e5e8e27c9391f06eb4da096c3d677d8f25ca4d04df
SHA512c1ee67bd4c6bcfdc4179f905c7abc4ac632c9265b61dd5fdb90eeeec39802abe2cc487a5c8ded8a0748728104170c1b4d3a88904f102e1c3f891fac7702a2256
-
Filesize
157KB
MD56d4775f18b2ee05bb4763d3080d36bbe
SHA1cdf9525b39409515b350d02b91bff61aac3cd55f
SHA25623bb3a8e6cd6be562f57e98441888782f8f0d8d8ce456a9a40bf711a68a34c97
SHA51245368d3468e45324362eded3905d16850136318acf88c9d8d9590f77fb912d423fe52f24ab3b0b4d001605692e2d0627ba1463de533b96724cd25a8548cf9e82
-
Filesize
123KB
MD5daa799b7defab6d9867c5d519b36611f
SHA14020d8587c28df934bd460b4dc953561be61e4ff
SHA2566cec316645c5abc4f31eb25f3f09f462f843fc73b9c1db79c5f580c6773e8d00
SHA51252979cb556129d2efd2615001cfd5dab74066c9ed45d46746c02d71f6418b92a61fc5dc4c182089d2bc66d7d1a5e461b8fa60702f872d63194412bc4fa699777
-
Filesize
77KB
MD5f107a3c7371c4543bd3908ba729dd2db
SHA1af8e7e8f446de74db2f31d532e46eab8bbf41e0a
SHA25600df0901c101254525a219d93ff1830da3a20d3f14bc323354d8d5fee5854ec0
SHA512fd776f8ceaac498f4f44819794c0fa89224712a8c476819ffc76ba4c7ff4caa9b360b9d299d9df7965387e5bbcb330f316f53759b5146a73b27a5f2e964c3530
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
192KB
-
Filesize
164KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
