Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
25-07-2024 00:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3dead9a7fad52cd00d189e1849111f80N.exe
Resource
win7-20240708-en
windows7-x64
11 signatures
120 seconds
Behavioral task
behavioral2
Sample
3dead9a7fad52cd00d189e1849111f80N.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
11 signatures
120 seconds
General
-
Target
3dead9a7fad52cd00d189e1849111f80N.exe
-
Size
192KB
-
MD5
3dead9a7fad52cd00d189e1849111f80
-
SHA1
4f5fb10035a572e57f60f4932395ade339ac905f
-
SHA256
5665e5ed2ec2ea1aadc59fcced6c61e968b9973c4bd4fe4d4313d6a1eba89d86
-
SHA512
17ad9e3a0a715d30757a37aeb98abde3bf6a5718f1b70e070b4395ddc11cbc3f2785b1428e9605bc00fdac19d08b6a3de9a692630ce9b2a715e84ef978f99aab
-
SSDEEP
3072:ii3tgN0ys6kzHSVhJqmj+yLKoUsSlRdz/0N+lSm:+zKDmhrTG8+p
Score
10/10
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload 2 IoCs
resource yara_rule behavioral1/memory/2368-0-0x0000000010000000-0x000000001002B000-memory.dmp fatalrat behavioral1/memory/2368-22-0x0000000000400000-0x0000000000431000-memory.dmp fatalrat -
Executes dropped EXE 2 IoCs
pid Process 2052 Svwxya.exe 2096 Svwxya.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\Svwxya.exe 3dead9a7fad52cd00d189e1849111f80N.exe File opened for modification C:\Windows\Svwxya.exe 3dead9a7fad52cd00d189e1849111f80N.exe File opened for modification C:\Windows\Svwxya.exe Svwxya.exe File created C:\Windows\Svwxya.exe Svwxya.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dead9a7fad52cd00d189e1849111f80N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Svwxya.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Svwxya.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Svwxya.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Svwxya.exe -
Modifies data under HKEY_USERS 20 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion Svwxya.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie Svwxya.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Svwxya.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies Svwxya.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableLockWorkstation = "1" Svwxya.exe Key created \REGISTRY\USER\.DEFAULT\SYSTEM Svwxya.exe Set value (str) \REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Services\Stuvwx Abcdefgh\InstallTime = "2024-07-25 00:31" Svwxya.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System Svwxya.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft Svwxya.exe Key created \REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet Svwxya.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft Svwxya.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum\Version = "7" Svwxya.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System Svwxya.exe Key created \REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Services\Stuvwx Abcdefgh Svwxya.exe Key created \REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Services Svwxya.exe Set value (str) \REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Services\Stuvwx Abcdefgh\Group = "Fatal" Svwxya.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum Svwxya.exe Key created \REGISTRY\USER\.DEFAULT\Software Svwxya.exe Key created \REGISTRY\USER\.DEFAULT\Software Svwxya.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableLockWorkstation = "1" Svwxya.exe -
Suspicious behavior: EnumeratesProcesses 54 IoCs
pid Process 2096 Svwxya.exe 2096 Svwxya.exe 2096 Svwxya.exe 2096 Svwxya.exe 2096 Svwxya.exe 2096 Svwxya.exe 2096 Svwxya.exe 2096 Svwxya.exe 2096 Svwxya.exe 2096 Svwxya.exe 2096 Svwxya.exe 2096 Svwxya.exe 2096 Svwxya.exe 2096 Svwxya.exe 2096 Svwxya.exe 2096 Svwxya.exe 2096 Svwxya.exe 2096 Svwxya.exe 2096 Svwxya.exe 2096 Svwxya.exe 2096 Svwxya.exe 2096 Svwxya.exe 2096 Svwxya.exe 2096 Svwxya.exe 2096 Svwxya.exe 2096 Svwxya.exe 2096 Svwxya.exe 2096 Svwxya.exe 2096 Svwxya.exe 2096 Svwxya.exe 2096 Svwxya.exe 2096 Svwxya.exe 2096 Svwxya.exe 2096 Svwxya.exe 2096 Svwxya.exe 2096 Svwxya.exe 2096 Svwxya.exe 2096 Svwxya.exe 2096 Svwxya.exe 2096 Svwxya.exe 2096 Svwxya.exe 2096 Svwxya.exe 2096 Svwxya.exe 2096 Svwxya.exe 2096 Svwxya.exe 2096 Svwxya.exe 2096 Svwxya.exe 2096 Svwxya.exe 2096 Svwxya.exe 2096 Svwxya.exe 2096 Svwxya.exe 2096 Svwxya.exe 2096 Svwxya.exe 2096 Svwxya.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2368 3dead9a7fad52cd00d189e1849111f80N.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2368 3dead9a7fad52cd00d189e1849111f80N.exe Token: SeDebugPrivilege 2052 Svwxya.exe Token: SeDebugPrivilege 2096 Svwxya.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2052 wrote to memory of 2096 2052 Svwxya.exe 31 PID 2052 wrote to memory of 2096 2052 Svwxya.exe 31 PID 2052 wrote to memory of 2096 2052 Svwxya.exe 31 PID 2052 wrote to memory of 2096 2052 Svwxya.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\3dead9a7fad52cd00d189e1849111f80N.exe"C:\Users\Admin\AppData\Local\Temp\3dead9a7fad52cd00d189e1849111f80N.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:2368
-
C:\Windows\Svwxya.exeC:\Windows\Svwxya.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Windows\Svwxya.exeC:\Windows\Svwxya.exe Win72⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2096
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192KB
MD53dead9a7fad52cd00d189e1849111f80
SHA14f5fb10035a572e57f60f4932395ade339ac905f
SHA2565665e5ed2ec2ea1aadc59fcced6c61e968b9973c4bd4fe4d4313d6a1eba89d86
SHA51217ad9e3a0a715d30757a37aeb98abde3bf6a5718f1b70e070b4395ddc11cbc3f2785b1428e9605bc00fdac19d08b6a3de9a692630ce9b2a715e84ef978f99aab