Analysis
-
max time kernel
99s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
01-04-2024 06:58
General
-
Target
9dd8f60d4d01d70cfc050880b7fe95e155e98cdf3feeb1191e28ada718fa43cb.exe
-
Size
1.2MB
-
MD5
0c36b554aa3b79ca47f35fce2604e0e1
-
SHA1
f6940665891f5d970f823b5ad1111527e7453105
-
SHA256
9dd8f60d4d01d70cfc050880b7fe95e155e98cdf3feeb1191e28ada718fa43cb
-
SHA512
fd51ec28f8b6ffac5c3ddf0fa370df27d94f17e1248b159c732998bf85fe20ac4fb419591b4512d83f713ef6acdf6434868e605fb7ddc07d81bc9147e6756ca9
-
SSDEEP
24576:sCPiA4TZzM/LGZfnMkDdNOWvqszPUFc9OuQlzE9fzwJVjDKkdog4w+C0YdMpN5VM:otMk/vqszMi9OuQlzE9MJhKkSgv+CLmk
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload 2 IoCs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 2 IoCs
-
UPX packed file 8 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies registry class 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9dd8f60d4d01d70cfc050880b7fe95e155e98cdf3feeb1191e28ada718fa43cb.exe"C:\Users\Admin\AppData\Local\Temp\9dd8f60d4d01d70cfc050880b7fe95e155e98cdf3feeb1191e28ada718fa43cb.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\Pictures\ye\ye.exeC:\Users\Public\Pictures\ye\ye.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Public\Pictures\ye\tem.vbs"3⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\tem.vbs"2⤵
- Deletes itself
-
-
C:\Windows\helppane.exeC:\Windows\helppane.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\mtiynq\Agghosts.exe"C:\mtiynq\Agghosts.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
275B
MD54e1d99002101ddaf1908b4e89e79d3d9
SHA11165e9db06fd9e4eab4c3b2512e74f148042b823
SHA256597e725d58cee67c477ed7e6b565f7190d6f347b5623f18214c8ad6f305021a4
SHA5124d7cc322682499099498277eb18d0764c7dc82ea472c5378d25a5486ed8b55020650faf329f779b828479c21dd3b1a7f75700593b562dd5438c5b825e190d799
-
Filesize
201B
MD503a61e447db87b40bd9d8d40f66a28bd
SHA1fa924cfabe69d433b4e7619414917ac018342d26
SHA256189e8d899489f1b1600a87dca3a81eebb420225a430b49ce32f7d57c48d81963
SHA512a7970d0792c17a386bde3adf0a0ed52ef5a1e07f458ec2d0425c8e7bd1711ac929942681bb1d42eb1788b6fc533e6ecd908117ac77afc82396e479261d498f9a
-
Filesize
618KB
MD5a42deae0974ab7c9122370bfba837fe6
SHA1237ff0b63a56126542a9cb103c7cbfc397ada84b
SHA25636ad631425f128b45e48d26d11e8750f44aa4d4802d60cff4dc7ab9577639b74
SHA5129ea8820f7da135a9188b1cca234cdc7080e7dade8b69b9e8c79569fa9c5c49406d8e3b84bdae0b29aa5f836804f9c855f7c662ceb9d152cff1dd01478996fcad
-
Filesize
23KB
MD55aab297fa8f143bfa67310ad78b76d3f
SHA15db963c2cca1bc8c8c060c52f7df76ccb477f01a
SHA2568ec64bc55e5641d7683288e5e8e27c9391f06eb4da096c3d677d8f25ca4d04df
SHA512c1ee67bd4c6bcfdc4179f905c7abc4ac632c9265b61dd5fdb90eeeec39802abe2cc487a5c8ded8a0748728104170c1b4d3a88904f102e1c3f891fac7702a2256
-
Filesize
157KB
MD56d4775f18b2ee05bb4763d3080d36bbe
SHA1cdf9525b39409515b350d02b91bff61aac3cd55f
SHA25623bb3a8e6cd6be562f57e98441888782f8f0d8d8ce456a9a40bf711a68a34c97
SHA51245368d3468e45324362eded3905d16850136318acf88c9d8d9590f77fb912d423fe52f24ab3b0b4d001605692e2d0627ba1463de533b96724cd25a8548cf9e82
-
Filesize
123KB
MD5daa799b7defab6d9867c5d519b36611f
SHA14020d8587c28df934bd460b4dc953561be61e4ff
SHA2566cec316645c5abc4f31eb25f3f09f462f843fc73b9c1db79c5f580c6773e8d00
SHA51252979cb556129d2efd2615001cfd5dab74066c9ed45d46746c02d71f6418b92a61fc5dc4c182089d2bc66d7d1a5e461b8fa60702f872d63194412bc4fa699777
-
Filesize
77KB
MD5f107a3c7371c4543bd3908ba729dd2db
SHA1af8e7e8f446de74db2f31d532e46eab8bbf41e0a
SHA25600df0901c101254525a219d93ff1830da3a20d3f14bc323354d8d5fee5854ec0
SHA512fd776f8ceaac498f4f44819794c0fa89224712a8c476819ffc76ba4c7ff4caa9b360b9d299d9df7965387e5bbcb330f316f53759b5146a73b27a5f2e964c3530
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
192KB
-
Filesize
164KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
