Overview

overview

10

Static

static

7

letsvpn-latest.exe

windows7-x64

10

letsvpn-latest.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    94s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-08-2024 14:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    letsvpn-latest.exe

  • Size

    15.1MB

  • MD5

    9955837b547b049e589b4c6bcb663b3d

  • SHA1

    1547ee7757789f420268245adae70f6224548515

  • SHA256

    d972127893bdc4523b0f63ca4f8a3d55db64a52a86dcae0db523f339f4d0a723

  • SHA512

    31cf10306d5e1ea2f7beed8a1718fbbcb08b4a1965a93ab78716c5f7e06fa04772288c37a36340098fdd1b9a15cbfe164df0b30f4c796326e56cb814661e1d6d

  • SSDEEP

    393216:hVhKO2IhWbf5F7Dt5KOZAMIXVyZtXrBuMgpx1W+k0yn:hf2Iy5F7DmOCMPtBuPzW+kn

Score
10/10
fatalrataspackv2discoveryevasioninfostealerpersistencerattrojanupx

Malware Config

Signatures

  • FatalRat

    FatalRat is a modular infostealer family written in C++ first appearing in June 2021.

    infostealerratfatalrat
  • Fatal Rat payload 1 IoCs
    ratinfostealer
  • ASPack v2.12-2.42 1 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 35 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\letsvpn-latest.exe
    "C:\Users\Admin\AppData\Local\Temp\letsvpn-latest.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4544
    • C:\Program Files (x86)\ubc.exe
      "C:\Program Files (x86)\ubc.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3832
      • C:\Users\Public\Documents\sougou\V4.6.80\Bin\QTalk.exe
        C:\Users\Public\Documents\sougou\V4.6.80\Bin\QTalk.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3696
        • C:\Users\Public\Documents\sougou\spolsvt.exe
          C:\Users\Public\Documents\sougou\spolsvt.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3316
          • C:\Users\Public\Documents\dd\spolsvt.exe
            C:\Users\Public\Documents\dd\spolsvt.exe
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Checks processor information in registry
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2304
          • C:\Users\Public\Documents\uu\svcoth.exe
            C:\Users\Public\Documents\uu\svcoth.exe
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3568
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4892

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\ubc.exe
    Filesize

    786KB

    MD5

    4f927a44963d8b315693cdf2c4695dd3

    SHA1

    71aa9de5a5882f0f5d8c4bb7ba980f9b3c68e11d

    SHA256

    73f4ea90010122716aa80f43a9d40bf2d5b38f023199f26ec04d4a866e113d3d

    SHA512

    4cbb156404badcd37d8a2c1a1e57017e63ea7b498c6b913685026ce175eca683724956b691ee31b944f4aa5b752aa6a8d21b45391ca65ba76811debd8efe7f9c

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd
    Filesize

    200B

    MD5

    49392034c34a69a3d76f8b0a73b40279

    SHA1

    65a9e49b2bd4d1af694ef07bf73096c1985a0ff8

    SHA256

    b1a2d0b53be9fc6e3a3a7a394192cc640b08d5b59097624feba6f519072c54a0

    SHA512

    9cd6ab4d4e5e0b2e60b1b9bb7cd382eb66afbb6079d7bf560708a43c1bee662d6fa2a2b491bc316abbaff80b425c2bdb69740cad60d543eeef056800afdc0068

    Download Submit

  • C:\Users\Public\Documents\dd\spolsvt.exe
    Filesize

    16KB

    MD5

    cdce4713e784ae069d73723034a957ff

    SHA1

    9a393a6bab6568f1a774fb753353223f11367e09

    SHA256

    b29e48102ecb3d3614e8980a8b8cc63dd2b993c6346f466479244ec2b47b69d8

    SHA512

    0a3a59a305cc2a6fad4e1315b0bcc5a4129595dfe1e8b703363fa02528d2d7c48d3fd22d365708be84a5557cf1916873df9563c454732f93f94a66e7e3b9fb0f

    Download Submit

  • C:\Users\Public\Documents\sougou\Mpec.mbt
    Filesize

    196KB

    MD5

    fc51b596793d77c284e29c7b1371c1e9

    SHA1

    af3bec0adbcb9ec9b10ed7c4f826fc5137d6db3f

    SHA256

    157507c0e3aaababdb6087104a9841995c1cd5b06991bccf192cba68cbfb2281

    SHA512

    e160812d3d8d33d2ca4df4177073e7a8dedfad443f49cd87316d049b1a9efcfe5de14d8aabb7c900a6b484181fe34a71f4ca70c31f7fcaf76679b649fffaa73d

    Download Submit

  • C:\Users\Public\Documents\sougou\spolsvt.exe
    Filesize

    9KB

    MD5

    523d5c39f9d8d2375c3df68251fa2249

    SHA1

    d4ed365c44bec9246fc1a65a32a7791792647a10

    SHA256

    20e3dc90a3e83b6202e2a7f4603b60e5e859639cb68693426c400b13aaeabd78

    SHA512

    526e1bba30d03f1ac177c6ab7409187a730969c429cebef15da68ffcf44b3b93227781eebc827b2f7a0fa17c391e00a0e532263fd0167aeaeb0456f96cfe3ae4

    Download Submit

  • memory/2304-57-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

    Download

  • memory/2304-53-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

    Download

  • memory/2304-51-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

    Download

  • memory/2304-52-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

    Download

  • memory/2304-58-0x0000000010000000-0x000000001002A000-memory.dmp

    Filesize

    168KB

    Download

  • memory/3316-39-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

    Download

  • memory/3316-45-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

    Download

  • memory/3316-41-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

    Download

  • memory/3316-40-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

    Download

  • memory/3568-72-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/3568-79-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/3568-75-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/3568-74-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/3568-73-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/3568-71-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/3696-35-0x0000000000400000-0x0000000000606000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/3696-47-0x0000000000400000-0x0000000000606000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/3696-34-0x0000000000400000-0x0000000000606000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/3696-36-0x0000000000400000-0x0000000000606000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/3696-33-0x0000000000400000-0x0000000000606000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/3832-63-0x0000000000400000-0x0000000000606000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/3832-16-0x0000000000400000-0x0000000000606000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/3832-17-0x0000000000400000-0x0000000000606000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/3832-19-0x0000000000401000-0x00000000004C1000-memory.dmp

    Filesize

    768KB

    Download

  • memory/3832-18-0x0000000000400000-0x0000000000606000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/3832-15-0x0000000000400000-0x0000000000606000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/4544-0-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

    Download

  • memory/4544-84-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

    Download