Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
21-05-2024 09:39
General
-
Target
8P8S8Rn.exe
-
Size
792KB
-
MD5
db9ecd1b6cb77dba641e37c43059cd8e
-
SHA1
33f024edbbfcc3b0e6a32a1fb0dd59ebbc892737
-
SHA256
7e77b2c548c942947e6e5dc0ba340d51a90d7888fa63e411cc7293a2b88e1fae
-
SHA512
2814c5908fb7668ac238cf1fc5f7d1ab5e604e4336ca0e000f5adad2e65faa03f2e09163e45696bd93a10991b9035d83466c57f256985fee01b71fe2a99facfe
-
SSDEEP
24576:x+9JilRCA7o2hGAkP+/RG9ek7FvFZTAGeO:x+9JilRVx6P+/RuTdzTAGeO
Score
10/10
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8P8S8Rn.exe"C:\Users\Admin\AppData\Local\Temp\8P8S8Rn.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
196KB
-
Filesize
156KB
-
Filesize
200KB
-
Filesize
180KB
-
Filesize
180KB
-
Filesize
168KB
-
Filesize
180KB