Analysis
-
max time kernel
149s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
15-04-2024 14:08
General
-
Target
8f05b29284b0bf78da28f4591214941d29c7e3c06fc2cf88deec7303499d99df.exe
-
Size
900KB
-
MD5
b453df3dd59b3deb37751908cd8e677f
-
SHA1
645c922c5aa6e9eafdfb3b692962cedc0c567f5d
-
SHA256
8f05b29284b0bf78da28f4591214941d29c7e3c06fc2cf88deec7303499d99df
-
SHA512
e3ca834e05664323d0922d730599521eb5c3334e1775df7263ee1b6b19f3df1db0558f3c85c4b2541292b485f90578ffb160ef53a430439c1cb2e3be8bd8e58b
-
SSDEEP
24576:BIs/LMbqQ0r9BK3eeRAPbuTjBIxkul5AXMxABDsEC/:msDGtALeiwCFY4h/
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 22 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 51 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8f05b29284b0bf78da28f4591214941d29c7e3c06fc2cf88deec7303499d99df.exe"C:\Users\Admin\AppData\Local\Temp\8f05b29284b0bf78da28f4591214941d29c7e3c06fc2cf88deec7303499d99df.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\8f05b29284b0bf78da28f4591214941d29c7e3c06fc2cf88deec7303499d99df.exe"C:\Users\Admin\AppData\Local\8f05b29284b0bf78da28f4591214941d29c7e3c06fc2cf88deec7303499d99df.exe"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
900KB
MD5b453df3dd59b3deb37751908cd8e677f
SHA1645c922c5aa6e9eafdfb3b692962cedc0c567f5d
SHA2568f05b29284b0bf78da28f4591214941d29c7e3c06fc2cf88deec7303499d99df
SHA512e3ca834e05664323d0922d730599521eb5c3334e1775df7263ee1b6b19f3df1db0558f3c85c4b2541292b485f90578ffb160ef53a430439c1cb2e3be8bd8e58b
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
1.1MB
-
Filesize
1.5MB
-
Filesize
984KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
984KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.5MB
-
Filesize
1.1MB
-
Filesize
984KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
284KB