Analysis
-
max time kernel
148s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
08-03-2024 17:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe
Resource
win7-20240221-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe
-
Size
884KB
-
MD5
07050f58d4734f94d71d5c656306c23b
-
SHA1
0e7fb849a476226e5f00ae52ee14bc7a04934e8a
-
SHA256
ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc
-
SHA512
bf56b15e5b40a851241dcaa6005ce6fc1df72355550025a4f18b863258f6f704132c6c6ae1741f58d3944edc71a8d0e9ca44ae29c27d88135202b303f254cb09
-
SSDEEP
24576:d3HGeQT9vKePfo8j+v3nynH3ounCv6IQF2rmo/hQg:dWtKQfWv34nM82rXZQg
Score
10/10
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload 4 IoCs
resource yara_rule behavioral2/memory/3528-13073-0x0000000000400000-0x00000000004F2000-memory.dmp fatalrat behavioral2/memory/3528-13074-0x0000000010000000-0x000000001002A000-memory.dmp fatalrat behavioral2/memory/3044-26161-0x0000000000400000-0x00000000004F2000-memory.dmp fatalrat behavioral2/memory/3044-26167-0x0000000000400000-0x00000000004F2000-memory.dmp fatalrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe -
Executes dropped EXE 1 IoCs
pid Process 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 37 IoCs
pid Process 3528 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3528 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 3528 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3528 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe Token: SeDebugPrivilege 3044 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3528 wrote to memory of 3044 3528 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 96 PID 3528 wrote to memory of 3044 3528 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 96 PID 3528 wrote to memory of 3044 3528 ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe"C:\Users\Admin\AppData\Local\Temp\ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe"1⤵
- Checks computer location settings
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Users\Admin\AppData\Local\ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe"C:\Users\Admin\AppData\Local\ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc.exe"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3044
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
884KB
MD507050f58d4734f94d71d5c656306c23b
SHA10e7fb849a476226e5f00ae52ee14bc7a04934e8a
SHA256ef1b05a2a63607ac4554f2303fdd46377fc79b6fdc1117c9340af5d7d2f945bc
SHA512bf56b15e5b40a851241dcaa6005ce6fc1df72355550025a4f18b863258f6f704132c6c6ae1741f58d3944edc71a8d0e9ca44ae29c27d88135202b303f254cb09