Analysis
-
max time kernel
120s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
28-08-2024 13:03
General
-
Target
ddeee2e9a961d4ff12575175c679a4b749e4d33f30cd89ef5d8501652af5667a.exe
-
Size
890KB
-
MD5
73cecf8bb89e22975594bbe0e82b6434
-
SHA1
2857da994718d70df5f45ef07764765ec675f06c
-
SHA256
ddeee2e9a961d4ff12575175c679a4b749e4d33f30cd89ef5d8501652af5667a
-
SHA512
0b1ea47b4f3a069ed4d236407992b4b5b3cf244a63d87390743172aa4f4d11e4eecd1414dd3627428ce8ec4d3ac815e5217cc20204762214a4b3e06aa4e630be
-
SSDEEP
12288:dj2X3IO2pAx+DG2AUQeDXk92wDGpcRbOda7MjW53CNTdpa1zUlqpM:dj2oO7t2bGNGpcRbOy53QTdpaDp
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 53 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ddeee2e9a961d4ff12575175c679a4b749e4d33f30cd89ef5d8501652af5667a.exe"C:\Users\Admin\AppData\Local\Temp\ddeee2e9a961d4ff12575175c679a4b749e4d33f30cd89ef5d8501652af5667a.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\taskeng.exetaskeng.exe {0D045029-BF3D-48CE-A350-53E0B5F2863F} S-1-5-21-1385883288-3042840365-2734249351-1000:RPXOCQRF\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\9S9SCS\K4N4N3a.exeC:\ProgramData\9S9SCS\K4N4N3a.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
65KB
MD59948fb3376da6f0b1901f359dc706f69
SHA191924e511c3918ecc76683390e53d6a2968e17ff
SHA2566114cbd3b89aa0e1c061b2b5c38913b43093b8287340e40d49f764e1f7bc6e1f
SHA512382c8487af872ebc7eeb9cd07e3ea979a4ed4f7d2947916b1ed7131c5f0d220604cfb4f6cf898c02b88d0facde51d5b3cae1dcc6420eaa0b04748e48650693bf
-
Filesize
4.0MB
MD599cfb22d825354570755757262ca4df3
SHA17ed8df785e31deb941d50ea6dab8a6811e511492
SHA25664e6cbdd788bbd36116588e5742a01547b4224c3fc1f804cf9203cb701625408
SHA5129623ce1bd5da201e3fc8d14802c6a54ed0464c4508491e23b113680d773b7a67a7705aa8157e25b2d33a9a70e4b99d889b074f2c50db00c8a51fd68f67dd2718
-
Filesize
1.0MB
MD593e64abcdd4d337ecb72595b472da3f5
SHA16e98f60aeaefa20263cd1005e64fe4db40203997
SHA256db4055a7e6e90975346e777a3a751f30563bd0fe1c9ea562785d2906e46097c5
SHA512f5b5948951fbe5a0cdabaf8d35406a8f9d452d4f0a47cb4de2f4272bc653bd1164fb115fe8558545cdc36893e36a3463a96fc7091658cf87425e2d16aa7ee76c
-
Filesize
756B
MD5c055a19b57f213fb1671bcb1d31c320b
SHA1bff65ba501a46fb8fe42ece836ef1e9b476cb6d6
SHA2560eed5210d8bbfa064d006c12b45f5626381ca9b62b8eb004dafe3a50a621a0c5
SHA51296a3e69bcdb0e8242b1fbe512a7c50cbda9cf279a743f31dbf92f0cd5a9951b85beeaf6b0827c017d7b299f27569c4443aae414e65c9db885b63468dcd504c57
-
Filesize
142KB
MD5bbaea75e78b80434b7cd699749b93a97
SHA1c7d151758cb88dee39dbb5f4cd30e7d226980dde
SHA256c9a1c52f5f5c8deef76b8e989c6a377f00061fa369cbd1cee7f53f8f03295f5c
SHA5127f41846d61452c73566554ba5f6ef356e757ff4c292ad68bbcc1b84f736c02c6b0bc52e13270e5d7be4cde743d40cfc281028d4a0e322fbeecd9b786d08bac3d
-
Filesize
3.3MB
MD58516c251cc84c68317e8b7b7e934b583
SHA1e9f91703ddeaa3b7b5cb16658f200df59b995d2d
SHA25654b61b516f187924816b116ba53fafa11d140708d0f7c815954c621a464e6a82
SHA51292243478f5948cdc2f49ac70013a49e100080890d5ff3260d9afa388546bc962368bacc7c855cf356bf00e1730010f7ab6743f41328f128138c64b8ff27377e3
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
320KB
-
Filesize
196KB
-
Filesize
168KB