Analysis
-
max time kernel
117s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
23-08-2024 01:18
General
-
Target
9abb0c43b762a7a7fce2ffbd50e33ba8ef631ccea6548f62f583ff82c96ad51a.exe
-
Size
996KB
-
MD5
66f4b1bafae9614dcec396d5047b212b
-
SHA1
e01e6e0bb5377cb05c36b87c015d4933bd42ec58
-
SHA256
9abb0c43b762a7a7fce2ffbd50e33ba8ef631ccea6548f62f583ff82c96ad51a
-
SHA512
03b017eff362519ef0859dfaae824d7da8e4dfe6846b203b6aa83da0ea09bf9cd5dabe990fde565ab7d373a261cfd5382783e3e2a08b903ae2404798bcd2e2f9
-
SSDEEP
12288:WOcJNQ/mr508KOtnlvBOR6amXUQOgJjVcn+RN:WOlV8BvgRQXNVc+7
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 55 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\9abb0c43b762a7a7fce2ffbd50e33ba8ef631ccea6548f62f583ff82c96ad51a.exe"C:\Users\Admin\AppData\Local\Temp\9abb0c43b762a7a7fce2ffbd50e33ba8ef631ccea6548f62f583ff82c96ad51a.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\taskeng.exetaskeng.exe {2AD52723-F3F2-4385-9457-56534B2472B4} S-1-5-21-2212144002-1172735686-1556890956-1000:MVFYZPLM\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\Documents\M2M5L5\SCSBSBa.exeC:\Users\Public\Documents\M2M5L5\SCSBSBa.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5f1309d6a74d81fe600229cdbff2207c2
SHA1e9b990bce15f409feb819e7bc6ccb7737805b405
SHA25652691324e6aed1a97822355051c263cf7e3725355b7bb9df9e31b8b74b0d4df2
SHA5128bc18c6818ae871ba92556090b853e4dde2802b3c97b570da4b9608e6007adf78e385b94411c90637e763ad523647333eaeb9d3ffaebd9185291baab9a5b767a
-
Filesize
142KB
MD5bbaea75e78b80434b7cd699749b93a97
SHA1c7d151758cb88dee39dbb5f4cd30e7d226980dde
SHA256c9a1c52f5f5c8deef76b8e989c6a377f00061fa369cbd1cee7f53f8f03295f5c
SHA5127f41846d61452c73566554ba5f6ef356e757ff4c292ad68bbcc1b84f736c02c6b0bc52e13270e5d7be4cde743d40cfc281028d4a0e322fbeecd9b786d08bac3d
-
Filesize
3.3MB
MD58516c251cc84c68317e8b7b7e934b583
SHA1e9f91703ddeaa3b7b5cb16658f200df59b995d2d
SHA25654b61b516f187924816b116ba53fafa11d140708d0f7c815954c621a464e6a82
SHA51292243478f5948cdc2f49ac70013a49e100080890d5ff3260d9afa388546bc962368bacc7c855cf356bf00e1730010f7ab6743f41328f128138c64b8ff27377e3
-
Filesize
4.0MB
MD599cfb22d825354570755757262ca4df3
SHA17ed8df785e31deb941d50ea6dab8a6811e511492
SHA25664e6cbdd788bbd36116588e5742a01547b4224c3fc1f804cf9203cb701625408
SHA5129623ce1bd5da201e3fc8d14802c6a54ed0464c4508491e23b113680d773b7a67a7705aa8157e25b2d33a9a70e4b99d889b074f2c50db00c8a51fd68f67dd2718
-
Filesize
65KB
MD59948fb3376da6f0b1901f359dc706f69
SHA191924e511c3918ecc76683390e53d6a2968e17ff
SHA2566114cbd3b89aa0e1c061b2b5c38913b43093b8287340e40d49f764e1f7bc6e1f
SHA512382c8487af872ebc7eeb9cd07e3ea979a4ed4f7d2947916b1ed7131c5f0d220604cfb4f6cf898c02b88d0facde51d5b3cae1dcc6420eaa0b04748e48650693bf
-
Filesize
1.0MB
MD593e64abcdd4d337ecb72595b472da3f5
SHA16e98f60aeaefa20263cd1005e64fe4db40203997
SHA256db4055a7e6e90975346e777a3a751f30563bd0fe1c9ea562785d2906e46097c5
SHA512f5b5948951fbe5a0cdabaf8d35406a8f9d452d4f0a47cb4de2f4272bc653bd1164fb115fe8558545cdc36893e36a3463a96fc7091658cf87425e2d16aa7ee76c
-
Filesize
196KB
-
Filesize
168KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
320KB