Analysis
-
max time kernel
211s -
max time network
209s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
28-07-2024 14:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Microsoft/MF/thelper.exe
Resource
win7-20240708-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
Microsoft/MF/thelper.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
15 signatures
150 seconds
General
-
Target
Microsoft/MF/thelper.exe
-
Size
226KB
-
MD5
ffbed32e4009acd7fadcaa4bf1bdd898
-
SHA1
7485fcf366f7b3e61afc02130f296e0016d342c3
-
SHA256
79b496701e7a68dea3406f01b81e4d05fa484597a5a711889875f1cfb743822a
-
SHA512
320006a900494d77c82013a683b6300f7d578b0a9c6a1597af1a2ba877f61eb546ee85a5e2b640b5944b36f4c8e27ca75e77744e6eb087f51bba2dc64e4cc29f
-
SSDEEP
6144:YVjUqyblKOrj8xp2UTakqtkJ9qqD/l6DLxYOnHwjiY3DmzhIaZUNah:Sj7ywi8xJTaP4Aqrl6JpYTUh5ZUi
Score
10/10
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload 1 IoCs
resource yara_rule behavioral2/memory/2528-69-0x00000000025A0000-0x00000000025CA000-memory.dmp fatalrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Control Panel\International\Geo\Nation thelper.exe -
Executes dropped EXE 1 IoCs
pid Process 3588 thelper.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 4236 1336 WerFault.exe 83 4804 2508 WerFault.exe 106 -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thelper.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thelper.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thelper.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thelper.exe -
Checks SCSI registry key(s) 3 TTPs 9 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 14 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 perfmon.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 perfmon.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz perfmon.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz perfmon.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 perfmon.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz thelper.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz perfmon.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 thelper.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 1760 perfmon.exe 1760 perfmon.exe 3028 taskmgr.exe 1760 perfmon.exe 3028 taskmgr.exe 1760 perfmon.exe 3028 taskmgr.exe 1760 perfmon.exe 3028 taskmgr.exe 1760 perfmon.exe 3028 taskmgr.exe 1760 perfmon.exe 3028 taskmgr.exe 1760 perfmon.exe 3028 taskmgr.exe 3484 taskmgr.exe 3484 taskmgr.exe 3484 taskmgr.exe 3484 taskmgr.exe 3484 taskmgr.exe 3484 taskmgr.exe 3484 taskmgr.exe 3484 taskmgr.exe 3484 taskmgr.exe 3484 taskmgr.exe 3484 taskmgr.exe 3484 taskmgr.exe 3484 taskmgr.exe 3484 taskmgr.exe 3484 taskmgr.exe 3484 taskmgr.exe 3484 taskmgr.exe 3484 taskmgr.exe 3484 taskmgr.exe 5096 perfmon.exe 5096 perfmon.exe 3484 taskmgr.exe 5096 perfmon.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 5096 perfmon.exe 3316 perfmon.exe -
Suspicious use of AdjustPrivilegeToken 28 IoCs
description pid Process Token: SeDebugPrivilege 3028 taskmgr.exe Token: SeSystemProfilePrivilege 3028 taskmgr.exe Token: SeCreateGlobalPrivilege 3028 taskmgr.exe Token: SeDebugPrivilege 1760 perfmon.exe Token: SeSystemProfilePrivilege 1760 perfmon.exe Token: SeCreateGlobalPrivilege 1760 perfmon.exe Token: 33 1760 perfmon.exe Token: SeIncBasePriorityPrivilege 1760 perfmon.exe Token: 33 3028 taskmgr.exe Token: SeIncBasePriorityPrivilege 3028 taskmgr.exe Token: SeDebugPrivilege 3484 taskmgr.exe Token: SeSystemProfilePrivilege 3484 taskmgr.exe Token: SeCreateGlobalPrivilege 3484 taskmgr.exe Token: SeDebugPrivilege 5096 perfmon.exe Token: SeSystemProfilePrivilege 5096 perfmon.exe Token: SeCreateGlobalPrivilege 5096 perfmon.exe Token: 33 5096 perfmon.exe Token: SeIncBasePriorityPrivilege 5096 perfmon.exe Token: 33 3484 taskmgr.exe Token: SeIncBasePriorityPrivilege 3484 taskmgr.exe Token: SeDebugPrivilege 4016 taskmgr.exe Token: SeSystemProfilePrivilege 4016 taskmgr.exe Token: SeCreateGlobalPrivilege 4016 taskmgr.exe Token: SeDebugPrivilege 3316 perfmon.exe Token: SeSystemProfilePrivilege 3316 perfmon.exe Token: SeCreateGlobalPrivilege 3316 perfmon.exe Token: SeDebugPrivilege 2528 thelper.exe Token: SeDebugPrivilege 3588 thelper.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3484 taskmgr.exe 3484 taskmgr.exe 3484 taskmgr.exe 3484 taskmgr.exe 3484 taskmgr.exe 3484 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3028 taskmgr.exe 3484 taskmgr.exe 3484 taskmgr.exe 3484 taskmgr.exe 3484 taskmgr.exe 3484 taskmgr.exe 3484 taskmgr.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 3028 wrote to memory of 2492 3028 taskmgr.exe 101 PID 3028 wrote to memory of 2492 3028 taskmgr.exe 101 PID 2492 wrote to memory of 1760 2492 resmon.exe 103 PID 2492 wrote to memory of 1760 2492 resmon.exe 103 PID 3484 wrote to memory of 64 3484 taskmgr.exe 112 PID 3484 wrote to memory of 64 3484 taskmgr.exe 112 PID 64 wrote to memory of 5096 64 resmon.exe 113 PID 64 wrote to memory of 5096 64 resmon.exe 113 PID 4016 wrote to memory of 1648 4016 taskmgr.exe 126 PID 4016 wrote to memory of 1648 4016 taskmgr.exe 126 PID 1648 wrote to memory of 3316 1648 resmon.exe 127 PID 1648 wrote to memory of 3316 1648 resmon.exe 127 PID 2528 wrote to memory of 3588 2528 thelper.exe 129 PID 2528 wrote to memory of 3588 2528 thelper.exe 129 PID 2528 wrote to memory of 3588 2528 thelper.exe 129
Processes
-
C:\Users\Admin\AppData\Local\Temp\Microsoft\MF\thelper.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft\MF\thelper.exe"1⤵
- System Location Discovery: System Language Discovery
PID:1336 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1336 -s 5562⤵
- Program crash
PID:4236
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1336 -ip 13361⤵PID:4208
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Windows\system32\resmon.exe"C:\Windows\system32\resmon.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Windows\System32\perfmon.exe"C:\Windows\System32\perfmon.exe" /res3⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1760
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\Microsoft\MF\thelper.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft\MF\thelper.exe"1⤵
- System Location Discovery: System Language Discovery
PID:2508 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2508 -s 5722⤵
- Program crash
PID:4804
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2508 -ip 25081⤵PID:3796
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Windows\system32\resmon.exe"C:\Windows\system32\resmon.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:64 -
C:\Windows\System32\perfmon.exe"C:\Windows\System32\perfmon.exe" /res3⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:5096
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Windows\system32\resmon.exe"C:\Windows\system32\resmon.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Windows\System32\perfmon.exe"C:\Windows\System32\perfmon.exe" /res3⤵
- Checks processor information in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3316
-
-
-
C:\ProgramData\Microsoft\MF\thelper.exe"C:\ProgramData\Microsoft\MF\thelper.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\thelper.exe"C:\Users\Admin\AppData\Local\thelper.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3588
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD5d2fb266b97caff2086bf0fa74eddb6b2
SHA12f0061ce9c51b5b4fbab76b37fc6a540be7f805d
SHA256b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a
SHA512c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8
-
Filesize
4B
MD5f49655f856acb8884cc0ace29216f511
SHA1cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
SHA2567852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
SHA512599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8
-
Filesize
944B
MD56bd369f7c74a28194c991ed1404da30f
SHA10f8e3f8ab822c9374409fe399b6bfe5d68cbd643
SHA256878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d
SHA5128fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93
-
Filesize
7KB
MD5691072068fc91cdfd6b864c1b3f04071
SHA170e37ef4230024a1dba36af15e064e26a3f3b63c
SHA2562eecb2ebb88239816ec494baf496f9a0d82675bc9578efdeeec64eac31c4e84b
SHA512a08229d94cc30a9eeb351243948fec160aa80741cf547709f95c0e70a75347c21faf245730e3796547220cf7833b814ef260ce82402f4036d407ece76e9c65c1
-
Filesize
226KB
MD5ffbed32e4009acd7fadcaa4bf1bdd898
SHA17485fcf366f7b3e61afc02130f296e0016d342c3
SHA25679b496701e7a68dea3406f01b81e4d05fa484597a5a711889875f1cfb743822a
SHA512320006a900494d77c82013a683b6300f7d578b0a9c6a1597af1a2ba877f61eb546ee85a5e2b640b5944b36f4c8e27ca75e77744e6eb087f51bba2dc64e4cc29f