fatalrat | 6827b4967ac2ae69421ec2ac465d7cf5034ae7c32ce5cb29b0b1398a45468efb

Analysis

max time kernel
118s
max time network
136s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-03-2024 15:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6827b4967ac2ae69421ec2ac465d7cf5034ae7c32ce5cb29b0b1398a45468efb.exe
Size

220KB
MD5

dce8d927b4f3833acff622eb7e16da95
SHA1

7816fc514254ee0193de4c1c030a1bee228d5615
SHA256

6827b4967ac2ae69421ec2ac465d7cf5034ae7c32ce5cb29b0b1398a45468efb
SHA512

1b2e9d6ddb88259a593a10884801ec19a16de9e2d5810cf2690a0e8e8eb49ab76b034c5282a2925731199e6414cc5d1081bcaf9749662d46f0edf7efdc319cbf
SSDEEP

3072:Y1ltd5LZseWDzoPZ6WS6BLfvgaSlpcD+05f7OD6Zck:sSzkPDNGEfY6Zl

Score

10^/10

fatalrat infostealer rat

Malware Config

Signatures

FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
infostealer rat fatalrat

Fatal Rat payload 2 IoCs

rat infostealer

Processes:

resource	yara_rule
behavioral1/memory/1940-0-0x0000000010000000-0x000000001002A000-memory.dmp	fatalrat
behavioral1/memory/2968-15-0x0000000010000000-0x000000001002A000-memory.dmp	fatalrat

Executes dropped EXE 1 IoCs

Processes:

6827b4967ac2ae69421ec2ac465d7cf5034ae7c32ce5cb29b0b1398a45468efb.exe

pid	Process
2968	6827b4967ac2ae69421ec2ac465d7cf5034ae7c32ce5cb29b0b1398a45468efb.exe

Loads dropped DLL 2 IoCs

Processes:

6827b4967ac2ae69421ec2ac465d7cf5034ae7c32ce5cb29b0b1398a45468efb.exe

pid	Process
1940	6827b4967ac2ae69421ec2ac465d7cf5034ae7c32ce5cb29b0b1398a45468efb.exe
1940	6827b4967ac2ae69421ec2ac465d7cf5034ae7c32ce5cb29b0b1398a45468efb.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

6827b4967ac2ae69421ec2ac465d7cf5034ae7c32ce5cb29b0b1398a45468efb.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	6827b4967ac2ae69421ec2ac465d7cf5034ae7c32ce5cb29b0b1398a45468efb.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	6827b4967ac2ae69421ec2ac465d7cf5034ae7c32ce5cb29b0b1398a45468efb.exe

Suspicious behavior: EnumeratesProcesses 51 IoCs

Processes:

6827b4967ac2ae69421ec2ac465d7cf5034ae7c32ce5cb29b0b1398a45468efb.exe

pid	Process
2968	6827b4967ac2ae69421ec2ac465d7cf5034ae7c32ce5cb29b0b1398a45468efb.exe
2968	6827b4967ac2ae69421ec2ac465d7cf5034ae7c32ce5cb29b0b1398a45468efb.exe
2968	6827b4967ac2ae69421ec2ac465d7cf5034ae7c32ce5cb29b0b1398a45468efb.exe
2968	6827b4967ac2ae69421ec2ac465d7cf5034ae7c32ce5cb29b0b1398a45468efb.exe
2968	6827b4967ac2ae69421ec2ac465d7cf5034ae7c32ce5cb29b0b1398a45468efb.exe
2968	6827b4967ac2ae69421ec2ac465d7cf5034ae7c32ce5cb29b0b1398a45468efb.exe
2968	6827b4967ac2ae69421ec2ac465d7cf5034ae7c32ce5cb29b0b1398a45468efb.exe
2968	6827b4967ac2ae69421ec2ac465d7cf5034ae7c32ce5cb29b0b1398a45468efb.exe
2968	6827b4967ac2ae69421ec2ac465d7cf5034ae7c32ce5cb29b0b1398a45468efb.exe
2968	6827b4967ac2ae69421ec2ac465d7cf5034ae7c32ce5cb29b0b1398a45468efb.exe
2968	6827b4967ac2ae69421ec2ac465d7cf5034ae7c32ce5cb29b0b1398a45468efb.exe
2968	6827b4967ac2ae69421ec2ac465d7cf5034ae7c32ce5cb29b0b1398a45468efb.exe
2968	6827b4967ac2ae69421ec2ac465d7cf5034ae7c32ce5cb29b0b1398a45468efb.exe
2968	6827b4967ac2ae69421ec2ac465d7cf5034ae7c32ce5cb29b0b1398a45468efb.exe
2968	6827b4967ac2ae69421ec2ac465d7cf5034ae7c32ce5cb29b0b1398a45468efb.exe
2968	6827b4967ac2ae69421ec2ac465d7cf5034ae7c32ce5cb29b0b1398a45468efb.exe
2968	6827b4967ac2ae69421ec2ac465d7cf5034ae7c32ce5cb29b0b1398a45468efb.exe
2968	6827b4967ac2ae69421ec2ac465d7cf5034ae7c32ce5cb29b0b1398a45468efb.exe
2968	6827b4967ac2ae69421ec2ac465d7cf5034ae7c32ce5cb29b0b1398a45468efb.exe
2968	6827b4967ac2ae69421ec2ac465d7cf5034ae7c32ce5cb29b0b1398a45468efb.exe
2968	6827b4967ac2ae69421ec2ac465d7cf5034ae7c32ce5cb29b0b1398a45468efb.exe
2968	6827b4967ac2ae69421ec2ac465d7cf5034ae7c32ce5cb29b0b1398a45468efb.exe
2968	6827b4967ac2ae69421ec2ac465d7cf5034ae7c32ce5cb29b0b1398a45468efb.exe
2968	6827b4967ac2ae69421ec2ac465d7cf5034ae7c32ce5cb29b0b1398a45468efb.exe
2968	6827b4967ac2ae69421ec2ac465d7cf5034ae7c32ce5cb29b0b1398a45468efb.exe
2968	6827b4967ac2ae69421ec2ac465d7cf5034ae7c32ce5cb29b0b1398a45468efb.exe
2968	6827b4967ac2ae69421ec2ac465d7cf5034ae7c32ce5cb29b0b1398a45468efb.exe
2968	6827b4967ac2ae69421ec2ac465d7cf5034ae7c32ce5cb29b0b1398a45468efb.exe
2968	6827b4967ac2ae69421ec2ac465d7cf5034ae7c32ce5cb29b0b1398a45468efb.exe
2968	6827b4967ac2ae69421ec2ac465d7cf5034ae7c32ce5cb29b0b1398a45468efb.exe
2968	6827b4967ac2ae69421ec2ac465d7cf5034ae7c32ce5cb29b0b1398a45468efb.exe
2968	6827b4967ac2ae69421ec2ac465d7cf5034ae7c32ce5cb29b0b1398a45468efb.exe
2968	6827b4967ac2ae69421ec2ac465d7cf5034ae7c32ce5cb29b0b1398a45468efb.exe
2968	6827b4967ac2ae69421ec2ac465d7cf5034ae7c32ce5cb29b0b1398a45468efb.exe
2968	6827b4967ac2ae69421ec2ac465d7cf5034ae7c32ce5cb29b0b1398a45468efb.exe
2968	6827b4967ac2ae69421ec2ac465d7cf5034ae7c32ce5cb29b0b1398a45468efb.exe
2968	6827b4967ac2ae69421ec2ac465d7cf5034ae7c32ce5cb29b0b1398a45468efb.exe
2968	6827b4967ac2ae69421ec2ac465d7cf5034ae7c32ce5cb29b0b1398a45468efb.exe
2968	6827b4967ac2ae69421ec2ac465d7cf5034ae7c32ce5cb29b0b1398a45468efb.exe
2968	6827b4967ac2ae69421ec2ac465d7cf5034ae7c32ce5cb29b0b1398a45468efb.exe
2968	6827b4967ac2ae69421ec2ac465d7cf5034ae7c32ce5cb29b0b1398a45468efb.exe
2968	6827b4967ac2ae69421ec2ac465d7cf5034ae7c32ce5cb29b0b1398a45468efb.exe
2968	6827b4967ac2ae69421ec2ac465d7cf5034ae7c32ce5cb29b0b1398a45468efb.exe
2968	6827b4967ac2ae69421ec2ac465d7cf5034ae7c32ce5cb29b0b1398a45468efb.exe
2968	6827b4967ac2ae69421ec2ac465d7cf5034ae7c32ce5cb29b0b1398a45468efb.exe
2968	6827b4967ac2ae69421ec2ac465d7cf5034ae7c32ce5cb29b0b1398a45468efb.exe
2968	6827b4967ac2ae69421ec2ac465d7cf5034ae7c32ce5cb29b0b1398a45468efb.exe
2968	6827b4967ac2ae69421ec2ac465d7cf5034ae7c32ce5cb29b0b1398a45468efb.exe
2968	6827b4967ac2ae69421ec2ac465d7cf5034ae7c32ce5cb29b0b1398a45468efb.exe
2968	6827b4967ac2ae69421ec2ac465d7cf5034ae7c32ce5cb29b0b1398a45468efb.exe
2968	6827b4967ac2ae69421ec2ac465d7cf5034ae7c32ce5cb29b0b1398a45468efb.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

6827b4967ac2ae69421ec2ac465d7cf5034ae7c32ce5cb29b0b1398a45468efb.exe6827b4967ac2ae69421ec2ac465d7cf5034ae7c32ce5cb29b0b1398a45468efb.exe

description	pid	Process
Token: SeDebugPrivilege	1940	6827b4967ac2ae69421ec2ac465d7cf5034ae7c32ce5cb29b0b1398a45468efb.exe
Token: SeDebugPrivilege	2968	6827b4967ac2ae69421ec2ac465d7cf5034ae7c32ce5cb29b0b1398a45468efb.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

6827b4967ac2ae69421ec2ac465d7cf5034ae7c32ce5cb29b0b1398a45468efb.exe

description	pid	Process	procid_target
PID 1940 wrote to memory of 2968	1940	6827b4967ac2ae69421ec2ac465d7cf5034ae7c32ce5cb29b0b1398a45468efb.exe	28
PID 1940 wrote to memory of 2968	1940	6827b4967ac2ae69421ec2ac465d7cf5034ae7c32ce5cb29b0b1398a45468efb.exe	28
PID 1940 wrote to memory of 2968	1940	6827b4967ac2ae69421ec2ac465d7cf5034ae7c32ce5cb29b0b1398a45468efb.exe	28
PID 1940 wrote to memory of 2968	1940	6827b4967ac2ae69421ec2ac465d7cf5034ae7c32ce5cb29b0b1398a45468efb.exe	28

C:\Users\Admin\AppData\Local\Temp\6827b4967ac2ae69421ec2ac465d7cf5034ae7c32ce5cb29b0b1398a45468efb.exe
"C:\Users\Admin\AppData\Local\Temp\6827b4967ac2ae69421ec2ac465d7cf5034ae7c32ce5cb29b0b1398a45468efb.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Users\Admin\AppData\Local\6827b4967ac2ae69421ec2ac465d7cf5034ae7c32ce5cb29b0b1398a45468efb.exe
  "C:\Users\Admin\AppData\Local\6827b4967ac2ae69421ec2ac465d7cf5034ae7c32ce5cb29b0b1398a45468efb.exe"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\6827b4967ac2ae69421ec2ac465d7cf5034ae7c32ce5cb29b0b1398a45468efb.exe

Filesize
220KB

MD5
dce8d927b4f3833acff622eb7e16da95

SHA1
7816fc514254ee0193de4c1c030a1bee228d5615

SHA256
6827b4967ac2ae69421ec2ac465d7cf5034ae7c32ce5cb29b0b1398a45468efb

SHA512
1b2e9d6ddb88259a593a10884801ec19a16de9e2d5810cf2690a0e8e8eb49ab76b034c5282a2925731199e6414cc5d1081bcaf9749662d46f0edf7efdc319cbf

Download Submit
memory/1940-0-0x0000000010000000-0x000000001002A000-memory.dmp

Filesize
168KB

Download
memory/2968-15-0x0000000010000000-0x000000001002A000-memory.dmp

Filesize
168KB

Download