fatalrat | 68f5f8e2d9afd2c42b7315cafc726130c9e24a4ad6a0b97628efdc79e88bed5d

General

Target

68f5f8e2d9afd2c42b7315cafc726130c9e24a4ad6a0b97628efdc79e88bed5d.exe
Size

2.5MB
MD5

07520d8dba0ae86fc795544ef424f1c2
SHA1

b2543b059e92b32d5b3632a73e1e3d684c19468d
SHA256

68f5f8e2d9afd2c42b7315cafc726130c9e24a4ad6a0b97628efdc79e88bed5d
SHA512

dbd39e1e9e49c4328a11f68966f5f7a741068200658026db2b579fcc953314b7609e07d30e4a5c656d9ae7fc77ef2d20558264373adca923087a4cabe6345ea8
SSDEEP

49152:be8Pbe4aJLOeOQD63cqM91/3/yPpjfNBqWUa5mAlOKVtSquYS66p5IroB8qX51an:beSgJLDOQD6MV91/3/yRbNBqWUBLKVYC

Score

10^/10

fatalrat infostealer rat

Malware Config

Signatures

FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
infostealer rat fatalrat

Fatal Rat payload 1 IoCs

rat infostealer

resource	yara_rule
behavioral2/memory/1172-25-0x0000000000E20000-0x0000000000E4A000-memory.dmp	fatalrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	68f5f8e2d9afd2c42b7315cafc726130c9e24a4ad6a0b97628efdc79e88bed5d.exe

Executes dropped EXE 1 IoCs

pid	Process
1172	DySDKController.exe

Loads dropped DLL 1 IoCs

pid	Process
1172	DySDKController.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Funshion\cvsd.xml	68f5f8e2d9afd2c42b7315cafc726130c9e24a4ad6a0b97628efdc79e88bed5d.exe
File created	C:\Program Files (x86)\Funshion\DyCrashRpt.dll	68f5f8e2d9afd2c42b7315cafc726130c9e24a4ad6a0b97628efdc79e88bed5d.exe
File created	C:\Program Files (x86)\Funshion\DySDKController.exe	68f5f8e2d9afd2c42b7315cafc726130c9e24a4ad6a0b97628efdc79e88bed5d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1020	68f5f8e2d9afd2c42b7315cafc726130c9e24a4ad6a0b97628efdc79e88bed5d.exe
1020	68f5f8e2d9afd2c42b7315cafc726130c9e24a4ad6a0b97628efdc79e88bed5d.exe
1020	68f5f8e2d9afd2c42b7315cafc726130c9e24a4ad6a0b97628efdc79e88bed5d.exe
1020	68f5f8e2d9afd2c42b7315cafc726130c9e24a4ad6a0b97628efdc79e88bed5d.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1172	DySDKController.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1020	68f5f8e2d9afd2c42b7315cafc726130c9e24a4ad6a0b97628efdc79e88bed5d.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1020 wrote to memory of 1172	1020	68f5f8e2d9afd2c42b7315cafc726130c9e24a4ad6a0b97628efdc79e88bed5d.exe	98
PID 1020 wrote to memory of 1172	1020	68f5f8e2d9afd2c42b7315cafc726130c9e24a4ad6a0b97628efdc79e88bed5d.exe	98
PID 1020 wrote to memory of 1172	1020	68f5f8e2d9afd2c42b7315cafc726130c9e24a4ad6a0b97628efdc79e88bed5d.exe	98

C:\Users\Admin\AppData\Local\Temp\68f5f8e2d9afd2c42b7315cafc726130c9e24a4ad6a0b97628efdc79e88bed5d.exe
"C:\Users\Admin\AppData\Local\Temp\68f5f8e2d9afd2c42b7315cafc726130c9e24a4ad6a0b97628efdc79e88bed5d.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1020
- C:\Program Files (x86)\Funshion\DySDKController.exe
  "C:\Program Files (x86)\Funshion\DySDKController.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  PID:1172

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2232 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:8
1⤵
PID:2568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Funshion\DyCrashRpt.dll

Filesize
181KB

MD5
f1985fa57f2f5073830bcf7ab4dcae0a

SHA1
049e60c55818356873bbb45d40ecb34d588d7fbf

SHA256
adfca0ca54e24c60da3cac9c9686b28467253ec42bef0bdc9450354dfa752aa2

SHA512
b368ae280a8f76f5e2e3e38c29398116556215ed06b85ff68c5878daf1cc40ccf0b5b69b73127f775677bffa253f053fb76278c9aeca83314dccb0b9c4e75fc9

Download Submit
C:\Program Files (x86)\Funshion\DySDKController.exe

Filesize
1.1MB

MD5
5441bc3e3ceb2162a65cbfb4b6e7acd3

SHA1
103a0ec0f23e90def158eff9be7f63f6ca9af420

SHA256
90fe10bb10fbc95285696423e0ba4bfc10f4dcb63ea8d94fe29871036e4859f6

SHA512
f76ae8e1e43223e1fa06e5911b06dc7b2b3d60e3758fc5201c4dbd8df601b59be11e65f42ffe43a5823a71aa1cc328c7a2f625ca50893b1101d73d59b13b4ed4

Download Submit
C:\ProgramData\afd.bin

Filesize
198KB

MD5
e4813426c6d32d0ed3eb21369194f539

SHA1
f23b558f9917765a5e7848b05bd04aef813b46e5

SHA256
56bb0f8be5e06c1e394adbd88a97bbef4d5119a3b38d066c79a523790bb8a8d0

SHA512
2197a288939e21bb83682ac64b280a4fd029e629229c1190f2cc9839064b6ff6486d4c32d84c9c89f565460bae8a10a03a13b6cc5bf7a351b68d5bdf51a321a8

Download Submit
memory/1172-18-0x00000000755A0000-0x00000000755D3000-memory.dmp

Filesize
204KB

Download
memory/1172-20-0x0000000010000000-0x0000000010031000-memory.dmp

Filesize
196KB

Download
memory/1172-23-0x0000000000E60000-0x0000000000EC4000-memory.dmp

Filesize
400KB

Download
memory/1172-25-0x0000000000E20000-0x0000000000E4A000-memory.dmp

Filesize
168KB

Download
memory/1172-30-0x00000000755A0000-0x00000000755D3000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing