Overview

overview

10

Static

static

7

letsvpn-latest.exe

windows7-x64

10

letsvpn-latest.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    141s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-07-2024 09:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    letsvpn-latest.exe

  • Size

    17.8MB

  • MD5

    982df76237c9ff52ad1d2cda5176fbc3

  • SHA1

    fc7b82b2c3d4d15d50244a4352dce0ff9efa8f35

  • SHA256

    8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419

  • SHA512

    7cf4db29571fdb290294655d90448e5eccc8260bfee488721170aeb060d6a79ef55113b4b8df3c428c6329dcbabd1322f12dec25309a1acea7903e57293fc8c2

  • SSDEEP

    393216:Y1X6WuA5qyz6CAx8HUtClFqxMzohB2OOvz9S/RjePL/B24fvI:Y9T5R6XrtMNohXez9/DQsI

Score
10/10
fatalrataspackv2evasioninfostealerpersistencerattrojanupx

Malware Config

Signatures

  • FatalRat

    FatalRat is a modular infostealer family written in C++ first appearing in June 2021.

    infostealerratfatalrat
  • Fatal Rat payload 1 IoCs
    ratinfostealer
  • ASPack v2.12-2.42 1 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 35 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\letsvpn-latest.exe
    "C:\Users\Admin\AppData\Local\Temp\letsvpn-latest.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:4528
    • C:\Program Files (x86)\uzj.exe
      "C:\Program Files (x86)\uzj.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3952
      • C:\Users\Public\Documents\sougou\PTvrst.exe
        C:\Users\Public\Documents\sougou\PTvrst.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1120
        • C:\Users\Public\Documents\sougou\spolsvt.exe
          C:\Users\Public\Documents\sougou\spolsvt.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:1840
          • C:\Users\Public\Documents\dd\spolsvt.exe
            C:\Users\Public\Documents\dd\spolsvt.exe
            5⤵
            • Executes dropped EXE
            • Checks processor information in registry
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3172
          • C:\Users\Public\Documents\uu\svcoth.exe
            C:\Users\Public\Documents\uu\svcoth.exe
            5⤵
            • Executes dropped EXE
            PID:3548
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
      2⤵
        PID:4712

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\uzj.exe
      Filesize

      3.4MB

      MD5

      175d6f3e75b3cecdc5633ae0524ef496

      SHA1

      745459089543ef9e523af038064085b2e4af0fee

      SHA256

      033f23eac17d2a06675459abe2ded52b42f29cfa720c2ccfb507bac2d38988f0

      SHA512

      5f32dba9ad45cbc6845bfe4f25102947c103072a4258e7e10dd94c888c180fa5d23e80091a5e6b43c7aaa5976133ac83ea17656e4b9c0d2ee1eca8ef5dcdc79f

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd
      Filesize

      200B

      MD5

      49392034c34a69a3d76f8b0a73b40279

      SHA1

      65a9e49b2bd4d1af694ef07bf73096c1985a0ff8

      SHA256

      b1a2d0b53be9fc6e3a3a7a394192cc640b08d5b59097624feba6f519072c54a0

      SHA512

      9cd6ab4d4e5e0b2e60b1b9bb7cd382eb66afbb6079d7bf560708a43c1bee662d6fa2a2b491bc316abbaff80b425c2bdb69740cad60d543eeef056800afdc0068

      Download Submit

    • C:\Users\Public\Documents\dd\spolsvt.exe
      Filesize

      16KB

      MD5

      cdce4713e784ae069d73723034a957ff

      SHA1

      9a393a6bab6568f1a774fb753353223f11367e09

      SHA256

      b29e48102ecb3d3614e8980a8b8cc63dd2b993c6346f466479244ec2b47b69d8

      SHA512

      0a3a59a305cc2a6fad4e1315b0bcc5a4129595dfe1e8b703363fa02528d2d7c48d3fd22d365708be84a5557cf1916873df9563c454732f93f94a66e7e3b9fb0f

      Download Submit

    • C:\Users\Public\Documents\sougou\Mpec.mbt
      Filesize

      196KB

      MD5

      e3ed6c93f7296d2716191dc34e4c62b1

      SHA1

      3921c051dc50365d018f5b9cd7cfdc585bfda2f3

      SHA256

      48b700a1c7f950271a2c7a0ef9a3503c50221d7703f7e07b6d2997ae2f67c81c

      SHA512

      dccdd41657f53d0d4746c84271175d4c92b29fc5b86d3a384523dd61645a9239f2666d62568c89aabc77b78dead6c9c9d027a780b90fc9b497ad88580dc90ac1

      Download Submit

    • C:\Users\Public\Documents\sougou\spolsvt.exe
      Filesize

      9KB

      MD5

      523d5c39f9d8d2375c3df68251fa2249

      SHA1

      d4ed365c44bec9246fc1a65a32a7791792647a10

      SHA256

      20e3dc90a3e83b6202e2a7f4603b60e5e859639cb68693426c400b13aaeabd78

      SHA512

      526e1bba30d03f1ac177c6ab7409187a730969c429cebef15da68ffcf44b3b93227781eebc827b2f7a0fa17c391e00a0e532263fd0167aeaeb0456f96cfe3ae4

      Download Submit

    • memory/1120-49-0x0000000000400000-0x0000000000A13000-memory.dmp

      Filesize

      6.1MB

      Download

    • memory/1120-39-0x0000000000400000-0x0000000000A13000-memory.dmp

      Filesize

      6.1MB

      Download

    • memory/1120-33-0x0000000000400000-0x0000000000A13000-memory.dmp

      Filesize

      6.1MB

      Download

    • memory/1840-46-0x0000000000400000-0x0000000000441000-memory.dmp

      Filesize

      260KB

      Download

    • memory/1840-42-0x0000000000400000-0x0000000000441000-memory.dmp

      Filesize

      260KB

      Download

    • memory/1840-41-0x0000000000400000-0x0000000000441000-memory.dmp

      Filesize

      260KB

      Download

    • memory/1840-40-0x0000000000400000-0x0000000000441000-memory.dmp

      Filesize

      260KB

      Download

    • memory/3172-59-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

      Download

    • memory/3172-61-0x0000000010000000-0x000000001002A000-memory.dmp

      Filesize

      168KB

      Download

    • memory/3172-53-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

      Download

    • memory/3172-54-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

      Download

    • memory/3172-56-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

      Download

    • memory/3548-82-0x0000000000400000-0x000000000041C000-memory.dmp

      Filesize

      112KB

      Download

    • memory/3548-78-0x0000000000400000-0x000000000041C000-memory.dmp

      Filesize

      112KB

      Download

    • memory/3548-74-0x0000000000400000-0x000000000041C000-memory.dmp

      Filesize

      112KB

      Download

    • memory/3548-77-0x0000000000400000-0x000000000041C000-memory.dmp

      Filesize

      112KB

      Download

    • memory/3548-75-0x0000000000400000-0x000000000041C000-memory.dmp

      Filesize

      112KB

      Download

    • memory/3548-76-0x0000000000400000-0x000000000041C000-memory.dmp

      Filesize

      112KB

      Download

    • memory/3952-19-0x0000000000401000-0x00000000004C4000-memory.dmp

      Filesize

      780KB

      Download

    • memory/3952-16-0x0000000000400000-0x0000000000A13000-memory.dmp

      Filesize

      6.1MB

      Download

    • memory/3952-66-0x0000000000400000-0x0000000000A13000-memory.dmp

      Filesize

      6.1MB

      Download

    • memory/3952-17-0x0000000000400000-0x0000000000A13000-memory.dmp

      Filesize

      6.1MB

      Download

    • memory/3952-18-0x0000000000400000-0x0000000000A13000-memory.dmp

      Filesize

      6.1MB

      Download

    • memory/3952-15-0x0000000000400000-0x0000000000A13000-memory.dmp

      Filesize

      6.1MB

      Download

    • memory/4528-0-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

      Download

    • memory/4528-87-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

      Download