Resubmissions
30/07/2024, 12:17
240730-pgdcvasfjf1030/07/2024, 12:17
240730-pf9dwssfjb730/07/2024, 09:41
240730-lnrl9szhjf10Analysis
- max time kernel
46s - max time network
50s - platform
windows7_x64 - resource
win7-20240705-en - resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system - submitted
30/07/2024, 12:17
Behavioral task
behavioral1
Sample
Chrome.exe
Resource
win7-20240705-en
windows7-x64
17 signatures
60 seconds
Behavioral task
behavioral2
Sample
Chrome.exe
Resource
win10-20240611-en
windows10-1703-x64
15 signatures
60 seconds
Behavioral task
behavioral3
Sample
Chrome.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
16 signatures
60 seconds
Behavioral task
behavioral4
Sample
Chrome.exe
Resource
win11-20240729-en
windows11-21h2-x64
15 signatures
60 seconds
General
- Target Chrome.exe
- Size 4.6MB
- Sample240730-pgdcvasfjf
- SHA256 a58b7bd1380f220770408e33f43bdac4ab0bfe336e101484100915bf0518e794
- MD5 d64c8e67eaa9bb5b648f7aa4731c2924
- SHA1 81d7eec4135a2cde0d29bf651eb3b8e1f4093a93
- SHA512 1df2e7066fa804f992edb9f7e15256ab2348a0eb42068de9b987806b220e2ffc6736762fc9b4c37c6277738ca6983e8357d9b8aa6a63317d09a8fac6f54427d4
- SSDEEP 98304:jDN3JGPpKZ9AaI7S2DLpKNbEoH6ErTQyQzPm1XUxIyiVni:jJ34UwF7S2DLpKNEoHj58PDxdii
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
- Fatal Rat payload 1 IoCs
resource yara_rule behavioral1/memory/2960-81-0x0000000010000000-0x000000001002A000-memory.dmp fatalrat -
resource yara_rule behavioral1/files/0x0008000000015e21-6.dat aspack_v212_v242 - Deletes itself 1 IoCs
pid Process 1580 cmd.exe - Executes dropped EXE 5 IoCs
pid Process 2084 uzj.exe 2824 PTvrst.exe 2616 spolsvt.exe 2960 spolsvt.exe 1860 svcoth.exe - Loads dropped DLL 5 IoCs
pid Process 2068 Chrome.exe 2084 uzj.exe 2824 PTvrst.exe 2616 spolsvt.exe 2616 spolsvt.exe -
resource yara_rule behavioral1/memory/2068-0-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2068-95-0x0000000000400000-0x000000000042D000-memory.dmp upx - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\sougoupinyin = "C:\\Users\\Public\\Documents\\sougou\\PTvrst.exe" uzj.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA uzj.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2824 set thread context of 2616 2824 PTvrst.exe 34 PID 2616 set thread context of 2960 2616 spolsvt.exe 35 PID 2616 set thread context of 1860 2616 spolsvt.exe 39 - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Esl\AiodLite.dll Chrome.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\ACE.dll Chrome.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\JSByteCodeWin.bin Chrome.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\reflow.api Chrome.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome Chrome.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\bl.gif Chrome.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_shared.gif Chrome.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\DigSig.api Chrome.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia.api Chrome.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\VDK10.SYD Chrome.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d Chrome.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_received.gif Chrome.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOffNotificationInTray.gif Chrome.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Acrofx32.dll Chrome.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annots.api Chrome.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP Chrome.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\PDDom.api Chrome.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\ahclient.dll Chrome.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AXSLE.dll Chrome.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser Chrome.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOffNotificationInAcrobat.gif Chrome.exe File opened for modification C:\Program Files (x86)\ChromeSetup.exe Chrome.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroTextExtractor.exe Chrome.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\BIB.dll Chrome.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\icudt36.dll Chrome.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\AdobeID.pdf Chrome.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\DefaultID.pdf Chrome.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\SendMail.api Chrome.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\VDK10.CMP Chrome.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\add_reviewer.gif Chrome.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\open_original_form.gif Chrome.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\CoolType.dll Chrome.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\HLS.api Chrome.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\MCIMPP.mpp Chrome.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Spelling.api Chrome.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker Chrome.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Onix32.dll Chrome.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Search.api Chrome.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\VDK10.STC Chrome.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc Chrome.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\ended_review_or_form.gif Chrome.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_same_reviewers.gif Chrome.exe File created C:\Program Files (x86)\ChromeSetup.exe Chrome.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe Chrome.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\SaveAsRTF.api Chrome.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\RTC.der Chrome.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_super.gif Chrome.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\pdf.gif Chrome.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\DataMatrix.pmp Chrome.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.pdf Chrome.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prcr.x3d Chrome.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\sqlite.dll Chrome.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\br.gif Chrome.exe File opened for modification C:\Program Files (x86)\uzj.exe Chrome.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeUpdater.dll Chrome.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\DVA.api Chrome.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\2d.x3d Chrome.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.dll Chrome.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\adobepdf.xdc Chrome.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\EScript.api Chrome.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\ReadOutLoud.api Chrome.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\info.gif Chrome.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOnNotificationInTray.gif Chrome.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\vdk150.dll Chrome.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svcoth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Chrome.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uzj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PTvrst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spolsvt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spolsvt.exe - Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2084 uzj.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2960 spolsvt.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2084 uzj.exe 2084 uzj.exe 2824 PTvrst.exe 2824 PTvrst.exe - Suspicious use of WriteProcessMemory 53 IoCs
description pid Process procid_target PID 2068 wrote to memory of 2084 2068 Chrome.exe 30 PID 2068 wrote to memory of 2084 2068 Chrome.exe 30 PID 2068 wrote to memory of 2084 2068 Chrome.exe 30 PID 2068 wrote to memory of 2084 2068 Chrome.exe 30 PID 2084 wrote to memory of 2824 2084 uzj.exe 33 PID 2084 wrote to memory of 2824 2084 uzj.exe 33 PID 2084 wrote to memory of 2824 2084 uzj.exe 33 PID 2084 wrote to memory of 2824 2084 uzj.exe 33 PID 2084 wrote to memory of 2824 2084 uzj.exe 33 PID 2084 wrote to memory of 2824 2084 uzj.exe 33 PID 2084 wrote to memory of 2824 2084 uzj.exe 33 PID 2824 wrote to memory of 2616 2824 PTvrst.exe 34 PID 2824 wrote to memory of 2616 2824 PTvrst.exe 34 PID 2824 wrote to memory of 2616 2824 PTvrst.exe 34 PID 2824 wrote to memory of 2616 2824 PTvrst.exe 34 PID 2824 wrote to memory of 2616 2824 PTvrst.exe 34 PID 2824 wrote to memory of 2616 2824 PTvrst.exe 34 PID 2824 wrote to memory of 2616 2824 PTvrst.exe 34 PID 2824 wrote to memory of 2616 2824 PTvrst.exe 34 PID 2824 wrote to memory of 2616 2824 PTvrst.exe 34 PID 2824 wrote to memory of 2616 2824 PTvrst.exe 34 PID 2824 wrote to memory of 2616 2824 PTvrst.exe 34 PID 2824 wrote to memory of 2616 2824 PTvrst.exe 34 PID 2616 wrote to memory of 2960 2616 spolsvt.exe 35 PID 2616 wrote to memory of 2960 2616 spolsvt.exe 35 PID 2616 wrote to memory of 2960 2616 spolsvt.exe 35 PID 2616 wrote to memory of 2960 2616 spolsvt.exe 35 PID 2616 wrote to memory of 2960 2616 spolsvt.exe 35 PID 2616 wrote to memory of 2960 2616 spolsvt.exe 35 PID 2616 wrote to memory of 2960 2616 spolsvt.exe 35 PID 2616 wrote to memory of 2960 2616 spolsvt.exe 35 PID 2616 wrote to memory of 2960 2616 spolsvt.exe 35 PID 2616 wrote to memory of 2960 2616 spolsvt.exe 35 PID 2616 wrote to memory of 2960 2616 spolsvt.exe 35 PID 2616 wrote to memory of 2960 2616 spolsvt.exe 35 PID 2068 wrote to memory of 1580 2068 Chrome.exe 36 PID 2068 wrote to memory of 1580 2068 Chrome.exe 36 PID 2068 wrote to memory of 1580 2068 Chrome.exe 36 PID 2068 wrote to memory of 1580 2068 Chrome.exe 36 PID 2616 wrote to memory of 1860 2616 spolsvt.exe 39 PID 2616 wrote to memory of 1860 2616 spolsvt.exe 39 PID 2616 wrote to memory of 1860 2616 spolsvt.exe 39 PID 2616 wrote to memory of 1860 2616 spolsvt.exe 39 PID 2616 wrote to memory of 1860 2616 spolsvt.exe 39 PID 2616 wrote to memory of 1860 2616 spolsvt.exe 39 PID 2616 wrote to memory of 1860 2616 spolsvt.exe 39 PID 2616 wrote to memory of 1860 2616 spolsvt.exe 39 PID 2616 wrote to memory of 1860 2616 spolsvt.exe 39 PID 2616 wrote to memory of 1860 2616 spolsvt.exe 39 PID 2616 wrote to memory of 1860 2616 spolsvt.exe 39 PID 2616 wrote to memory of 1860 2616 spolsvt.exe 39 PID 2616 wrote to memory of 1860 2616 spolsvt.exe 39 PID 2616 wrote to memory of 1860 2616 spolsvt.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\Chrome.exe"C:\Users\Admin\AppData\Local\Temp\Chrome.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Program Files (x86)\uzj.exe"C:\Program Files (x86)\uzj.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Public\Documents\sougou\PTvrst.exeC:\Users\Public\Documents\sougou\PTvrst.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Public\Documents\sougou\spolsvt.exeC:\Users\Public\Documents\sougou\spolsvt.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Public\Documents\dd\spolsvt.exeC:\Users\Public\Documents\dd\spolsvt.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2960
-
-
C:\Users\Public\Documents\uu\svcoth.exeC:\Users\Public\Documents\uu\svcoth.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1860
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:1580
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd
- Size 184B
- SHA256 b579bef02bd91e9b29bcad36144ba04588585614bfcef60c6feb67bf4982b185
- MD5 a994798dc8a4e132599c71a27a3e5fed
- SHA1 77a1dd9802e75e2a576a7ce7d0205d38ebafda4e
- SHA512 9b398669b1f1a300e609cdfcfd430214dfbe13c0f822e1d34ae9a7171c51e18a3f2781107c7ace5c0dbf47b26a9e70b9fd93acd345ee9ded9c235ac9058ce154
- MD5 SHA1 SHA512
- Path C:\Users\Public\Documents\dd\spolsvt.exe
- Size 16KB
- SHA256 b29e48102ecb3d3614e8980a8b8cc63dd2b993c6346f466479244ec2b47b69d8
- MD5 cdce4713e784ae069d73723034a957ff
- SHA1 9a393a6bab6568f1a774fb753353223f11367e09
- SHA512 0a3a59a305cc2a6fad4e1315b0bcc5a4129595dfe1e8b703363fa02528d2d7c48d3fd22d365708be84a5557cf1916873df9563c454732f93f94a66e7e3b9fb0f
- SSDEEP 384:fnUgXcCS4RI7nHhhZEAd2ouJNYFYPIN/qHMEU8gWmmW:sycC5R8nlEC2BEYPIMHKP
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Public\Documents\sougou\Mpec.mbt
- Size 196KB
- SHA256 48b700a1c7f950271a2c7a0ef9a3503c50221d7703f7e07b6d2997ae2f67c81c
- MD5 e3ed6c93f7296d2716191dc34e4c62b1
- SHA1 3921c051dc50365d018f5b9cd7cfdc585bfda2f3
- SHA512 dccdd41657f53d0d4746c84271175d4c92b29fc5b86d3a384523dd61645a9239f2666d62568c89aabc77b78dead6c9c9d027a780b90fc9b497ad88580dc90ac1
- SSDEEP 3072:mb7cTWC6vfNh1DQEbKTj/jsWBLAQMzV2sFGguWJgpGE8bocTQmrtqCAIOKBGcGHo:ms8fNhtQBT/xBcQMrJUGEaoc8m8CdGdo
- MD5 SHA1 SHA512 SSDEEP
- Path \Program Files (x86)\uzj.exe
- Size 3.4MB
- SHA256 033f23eac17d2a06675459abe2ded52b42f29cfa720c2ccfb507bac2d38988f0
- MD5 175d6f3e75b3cecdc5633ae0524ef496
- SHA1 745459089543ef9e523af038064085b2e4af0fee
- SHA512 5f32dba9ad45cbc6845bfe4f25102947c103072a4258e7e10dd94c888c180fa5d23e80091a5e6b43c7aaa5976133ac83ea17656e4b9c0d2ee1eca8ef5dcdc79f
- SSDEEP 49152:gsd3sdpsHo8wiQBszfjsdXq3VBtEtNIY02h1LOuajyByCZ5X5ExPMyIVfQ:3JsQZwigszfLtEP5F7y2N5X5cMyIV4
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Public\Documents\sougou\spolsvt.exe
- Size 9KB
- SHA256 20e3dc90a3e83b6202e2a7f4603b60e5e859639cb68693426c400b13aaeabd78
- MD5 523d5c39f9d8d2375c3df68251fa2249
- SHA1 d4ed365c44bec9246fc1a65a32a7791792647a10
- SHA512 526e1bba30d03f1ac177c6ab7409187a730969c429cebef15da68ffcf44b3b93227781eebc827b2f7a0fa17c391e00a0e532263fd0167aeaeb0456f96cfe3ae4
- SSDEEP 192:8g+i1VkHYXYxKTUtmPeQpLMFnlI1cTtYiAxHbDq/MR9tpL2OMoUwGCfpAGdDeqVs:LLXYxKTUtmPeQpLMFnCQHAx7D0MnKOMJ
- MD5 SHA1 SHA512 SSDEEP