Analysis
-
max time kernel
141s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
28-08-2024 13:03
General
-
Target
ddeee2e9a961d4ff12575175c679a4b749e4d33f30cd89ef5d8501652af5667a.exe
-
Size
890KB
-
MD5
73cecf8bb89e22975594bbe0e82b6434
-
SHA1
2857da994718d70df5f45ef07764765ec675f06c
-
SHA256
ddeee2e9a961d4ff12575175c679a4b749e4d33f30cd89ef5d8501652af5667a
-
SHA512
0b1ea47b4f3a069ed4d236407992b4b5b3cf244a63d87390743172aa4f4d11e4eecd1414dd3627428ce8ec4d3ac815e5217cc20204762214a4b3e06aa4e630be
-
SSDEEP
12288:dj2X3IO2pAx+DG2AUQeDXk92wDGpcRbOda7MjW53CNTdpa1zUlqpM:dj2oO7t2bGNGpcRbOy53QTdpaDp
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ddeee2e9a961d4ff12575175c679a4b749e4d33f30cd89ef5d8501652af5667a.exe"C:\Users\Admin\AppData\Local\Temp\ddeee2e9a961d4ff12575175c679a4b749e4d33f30cd89ef5d8501652af5667a.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\ProgramData\33J2J2\BRAUAUa.exeC:\ProgramData\33J2J2\BRAUAUa.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
65KB
MD59948fb3376da6f0b1901f359dc706f69
SHA191924e511c3918ecc76683390e53d6a2968e17ff
SHA2566114cbd3b89aa0e1c061b2b5c38913b43093b8287340e40d49f764e1f7bc6e1f
SHA512382c8487af872ebc7eeb9cd07e3ea979a4ed4f7d2947916b1ed7131c5f0d220604cfb4f6cf898c02b88d0facde51d5b3cae1dcc6420eaa0b04748e48650693bf
-
Filesize
4.0MB
MD599cfb22d825354570755757262ca4df3
SHA17ed8df785e31deb941d50ea6dab8a6811e511492
SHA25664e6cbdd788bbd36116588e5742a01547b4224c3fc1f804cf9203cb701625408
SHA5129623ce1bd5da201e3fc8d14802c6a54ed0464c4508491e23b113680d773b7a67a7705aa8157e25b2d33a9a70e4b99d889b074f2c50db00c8a51fd68f67dd2718
-
Filesize
1.0MB
MD593e64abcdd4d337ecb72595b472da3f5
SHA16e98f60aeaefa20263cd1005e64fe4db40203997
SHA256db4055a7e6e90975346e777a3a751f30563bd0fe1c9ea562785d2906e46097c5
SHA512f5b5948951fbe5a0cdabaf8d35406a8f9d452d4f0a47cb4de2f4272bc653bd1164fb115fe8558545cdc36893e36a3463a96fc7091658cf87425e2d16aa7ee76c
-
Filesize
142KB
MD5bbaea75e78b80434b7cd699749b93a97
SHA1c7d151758cb88dee39dbb5f4cd30e7d226980dde
SHA256c9a1c52f5f5c8deef76b8e989c6a377f00061fa369cbd1cee7f53f8f03295f5c
SHA5127f41846d61452c73566554ba5f6ef356e757ff4c292ad68bbcc1b84f736c02c6b0bc52e13270e5d7be4cde743d40cfc281028d4a0e322fbeecd9b786d08bac3d
-
Filesize
797B
MD588b1e690c6af7be274a87b41dfef43eb
SHA1cf2aefdbaf4ef10aff3e05e620450c8138466c58
SHA25657e9e6cda38feeb96570663f8452459698226158dda432ab733f840b2affc4eb
SHA51205be1f73c94e29e88dd72bced62af5a2518052121d9646e9a884a34284a526c02b6002885f0e8c5c268dc64370cc1f243fb6c56309baaafd31575ae9312ae0f6
-
Filesize
3.3MB
MD58516c251cc84c68317e8b7b7e934b583
SHA1e9f91703ddeaa3b7b5cb16658f200df59b995d2d
SHA25654b61b516f187924816b116ba53fafa11d140708d0f7c815954c621a464e6a82
SHA51292243478f5948cdc2f49ac70013a49e100080890d5ff3260d9afa388546bc962368bacc7c855cf356bf00e1730010f7ab6743f41328f128138c64b8ff27377e3
-
Filesize
196KB
-
Filesize
168KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
320KB