Analysis
-
max time kernel
149s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
12-03-2024 06:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1121.exe
Resource
win7-20240221-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
1121.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
1121.exe
-
Size
140KB
-
MD5
77508f7ca0b04dfa1847bbc5bfdf80f8
-
SHA1
4c39b8dee2aeea459cc39f370307c50fe5eb39ee
-
SHA256
772b4d710d2bc04f6d3d79acd8eecbf538a163ecc382fd95513d7939ddb3556a
-
SHA512
d7f611864b66d256f1825663625ad0bb41dba6cb64d89c7932e804942e8e335330c75390e8b56a8ab628b5a7409f945795ee1298f2eae3e3ae02775792fffc8c
-
SSDEEP
1536:Vua+BTv3tIO8MtM+/6jRVGIk1MgHjsPGYYwOda2CqqZOIgQJb0lfjtO+vbWL8xJb:Vn+htWMtf+7GZYGVA2QJgi8xJLDoU
Score
10/10
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload 2 IoCs
resource yara_rule behavioral2/memory/3660-0-0x0000000010000000-0x000000001001C000-memory.dmp fatalrat behavioral2/memory/1440-8-0x0000000010000000-0x000000001001C000-memory.dmp fatalrat -
Executes dropped EXE 2 IoCs
pid Process 1440 Wxyabc.exe 3956 Wxyabc.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\Wxyabc.exe 1121.exe File opened for modification C:\Windows\Wxyabc.exe 1121.exe File opened for modification C:\Windows\Wxyabc.exe Wxyabc.exe File created C:\Windows\Wxyabc.exe Wxyabc.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Modifies data under HKEY_USERS 7 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Services Wxyabc.exe Key created \REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Services\Wxyabc Efghijkl Wxyabc.exe Set value (str) \REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Services\Wxyabc Efghijkl\Group = "Fatal" Wxyabc.exe Set value (str) \REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Services\Wxyabc Efghijkl\InstallTime = "2024-03-12 06:17" Wxyabc.exe Key created \REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Services\Wxyabc Efghijkl Wxyabc.exe Key created \REGISTRY\USER\.DEFAULT\SYSTEM Wxyabc.exe Key created \REGISTRY\USER\.DEFAULT\System\CurrentControlSet Wxyabc.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3660 1121.exe 3660 1121.exe 1440 Wxyabc.exe 1440 Wxyabc.exe 3956 Wxyabc.exe 3956 Wxyabc.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4780 taskmgr.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 3660 1121.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 3660 1121.exe Token: SeDebugPrivilege 1440 Wxyabc.exe Token: SeDebugPrivilege 3956 Wxyabc.exe Token: SeDebugPrivilege 4780 taskmgr.exe Token: SeSystemProfilePrivilege 4780 taskmgr.exe Token: SeCreateGlobalPrivilege 4780 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1440 wrote to memory of 3956 1440 Wxyabc.exe 92 PID 1440 wrote to memory of 3956 1440 Wxyabc.exe 92 PID 1440 wrote to memory of 3956 1440 Wxyabc.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\1121.exe"C:\Users\Admin\AppData\Local\Temp\1121.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:3660
-
C:\Windows\Wxyabc.exeC:\Windows\Wxyabc.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Windows\Wxyabc.exeC:\Windows\Wxyabc.exe Win72⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3956
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4780
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
140KB
MD577508f7ca0b04dfa1847bbc5bfdf80f8
SHA14c39b8dee2aeea459cc39f370307c50fe5eb39ee
SHA256772b4d710d2bc04f6d3d79acd8eecbf538a163ecc382fd95513d7939ddb3556a
SHA512d7f611864b66d256f1825663625ad0bb41dba6cb64d89c7932e804942e8e335330c75390e8b56a8ab628b5a7409f945795ee1298f2eae3e3ae02775792fffc8c