Analysis
-
max time kernel
99s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
22-08-2024 13:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
505fce87b24c97ae2d5bd31570c68140N.exe
Resource
win7-20240704-en
windows7-x64
6 signatures
120 seconds
Behavioral task
behavioral2
Sample
505fce87b24c97ae2d5bd31570c68140N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
6 signatures
120 seconds
General
-
Target
505fce87b24c97ae2d5bd31570c68140N.exe
-
Size
192KB
-
MD5
505fce87b24c97ae2d5bd31570c68140
-
SHA1
73d95f746cd161ee7707f466a25db7e07f5ab086
-
SHA256
6baa1f26db81fbdd89d0d0df039b738e9bbb72141d3f270e16c248be390e9025
-
SHA512
25531319788362569a4cec2847853227269364e7b83505ee2c1047e4612b0401e15c8aa45f750b741c8956f3f6366562d7fd2d9d5f1c8ed7f748340420e38bec
-
SSDEEP
3072:Twixt0EbxotGf0LkM/GefzJLiMgnSl0O7180tf:c6biy0gM/1EGNf
Score
10/10
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/452-0-0x0000000010000000-0x000000001002A000-memory.dmp fatalrat -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
505fce87b24c97ae2d5bd31570c68140N.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 505fce87b24c97ae2d5bd31570c68140N.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
505fce87b24c97ae2d5bd31570c68140N.exedescription ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 505fce87b24c97ae2d5bd31570c68140N.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz 505fce87b24c97ae2d5bd31570c68140N.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
505fce87b24c97ae2d5bd31570c68140N.exepid Process 452 505fce87b24c97ae2d5bd31570c68140N.exe 452 505fce87b24c97ae2d5bd31570c68140N.exe 452 505fce87b24c97ae2d5bd31570c68140N.exe 452 505fce87b24c97ae2d5bd31570c68140N.exe 452 505fce87b24c97ae2d5bd31570c68140N.exe 452 505fce87b24c97ae2d5bd31570c68140N.exe 452 505fce87b24c97ae2d5bd31570c68140N.exe 452 505fce87b24c97ae2d5bd31570c68140N.exe 452 505fce87b24c97ae2d5bd31570c68140N.exe 452 505fce87b24c97ae2d5bd31570c68140N.exe 452 505fce87b24c97ae2d5bd31570c68140N.exe 452 505fce87b24c97ae2d5bd31570c68140N.exe 452 505fce87b24c97ae2d5bd31570c68140N.exe 452 505fce87b24c97ae2d5bd31570c68140N.exe 452 505fce87b24c97ae2d5bd31570c68140N.exe 452 505fce87b24c97ae2d5bd31570c68140N.exe 452 505fce87b24c97ae2d5bd31570c68140N.exe 452 505fce87b24c97ae2d5bd31570c68140N.exe 452 505fce87b24c97ae2d5bd31570c68140N.exe 452 505fce87b24c97ae2d5bd31570c68140N.exe 452 505fce87b24c97ae2d5bd31570c68140N.exe 452 505fce87b24c97ae2d5bd31570c68140N.exe 452 505fce87b24c97ae2d5bd31570c68140N.exe 452 505fce87b24c97ae2d5bd31570c68140N.exe 452 505fce87b24c97ae2d5bd31570c68140N.exe 452 505fce87b24c97ae2d5bd31570c68140N.exe 452 505fce87b24c97ae2d5bd31570c68140N.exe 452 505fce87b24c97ae2d5bd31570c68140N.exe 452 505fce87b24c97ae2d5bd31570c68140N.exe 452 505fce87b24c97ae2d5bd31570c68140N.exe 452 505fce87b24c97ae2d5bd31570c68140N.exe 452 505fce87b24c97ae2d5bd31570c68140N.exe 452 505fce87b24c97ae2d5bd31570c68140N.exe 452 505fce87b24c97ae2d5bd31570c68140N.exe 452 505fce87b24c97ae2d5bd31570c68140N.exe 452 505fce87b24c97ae2d5bd31570c68140N.exe 452 505fce87b24c97ae2d5bd31570c68140N.exe 452 505fce87b24c97ae2d5bd31570c68140N.exe 452 505fce87b24c97ae2d5bd31570c68140N.exe 452 505fce87b24c97ae2d5bd31570c68140N.exe 452 505fce87b24c97ae2d5bd31570c68140N.exe 452 505fce87b24c97ae2d5bd31570c68140N.exe 452 505fce87b24c97ae2d5bd31570c68140N.exe 452 505fce87b24c97ae2d5bd31570c68140N.exe 452 505fce87b24c97ae2d5bd31570c68140N.exe 452 505fce87b24c97ae2d5bd31570c68140N.exe 452 505fce87b24c97ae2d5bd31570c68140N.exe 452 505fce87b24c97ae2d5bd31570c68140N.exe 452 505fce87b24c97ae2d5bd31570c68140N.exe 452 505fce87b24c97ae2d5bd31570c68140N.exe 452 505fce87b24c97ae2d5bd31570c68140N.exe 452 505fce87b24c97ae2d5bd31570c68140N.exe 452 505fce87b24c97ae2d5bd31570c68140N.exe 452 505fce87b24c97ae2d5bd31570c68140N.exe 452 505fce87b24c97ae2d5bd31570c68140N.exe 452 505fce87b24c97ae2d5bd31570c68140N.exe 452 505fce87b24c97ae2d5bd31570c68140N.exe 452 505fce87b24c97ae2d5bd31570c68140N.exe 452 505fce87b24c97ae2d5bd31570c68140N.exe 452 505fce87b24c97ae2d5bd31570c68140N.exe 452 505fce87b24c97ae2d5bd31570c68140N.exe 452 505fce87b24c97ae2d5bd31570c68140N.exe 452 505fce87b24c97ae2d5bd31570c68140N.exe 452 505fce87b24c97ae2d5bd31570c68140N.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
505fce87b24c97ae2d5bd31570c68140N.exedescription pid Process Token: SeDebugPrivilege 452 505fce87b24c97ae2d5bd31570c68140N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\505fce87b24c97ae2d5bd31570c68140N.exe"C:\Users\Admin\AppData\Local\Temp\505fce87b24c97ae2d5bd31570c68140N.exe"1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:452