Overview

overview

10

Static

static

7

0792f3ace4...3a.exe

windows7-x64

10

0792f3ace4...3a.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    121s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    03-09-2024 10:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0792f3ace4712af9047ac5310ff45dd61da83d41b9f75e60a099568aab0bc43a.exe

  • Size

    6.8MB

  • MD5

    e60f2cfa195d7fa2c8fd58e8c0766ceb

  • SHA1

    88c0be4c4289fbca8d7627209e8efc368a5521f5

  • SHA256

    0792f3ace4712af9047ac5310ff45dd61da83d41b9f75e60a099568aab0bc43a

  • SHA512

    85155700124f35d0a53a383383588d4ac20c512a9caa3895962feb460464d728c408f2931d880dbf84dbfd8b9caf11cf0678163d7fb225dded11e325e717c81e

  • SSDEEP

    196608:/GL5LftH/WBqHVTq8ekeuBODngMCx5Tohf5:eLVtHomDsG8nyTif

Score
10/10
fatalratdiscoveryevasioninfostealerpersistencerattrojanupx

Malware Config

Signatures

  • FatalRat

    FatalRat is a modular infostealer family written in C++ first appearing in June 2021.

    infostealerratfatalrat
  • Fatal Rat payload 1 IoCs
    ratinfostealer
  • Deletes itself 1 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 6 IoCs
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 57 IoCs
  • Suspicious use of AdjustPrivilegeToken 35 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 54 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0792f3ace4712af9047ac5310ff45dd61da83d41b9f75e60a099568aab0bc43a.exe
    "C:\Users\Admin\AppData\Local\Temp\0792f3ace4712af9047ac5310ff45dd61da83d41b9f75e60a099568aab0bc43a.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2364
    • C:\Windows\system32\cmd.exe
      cmd.exe /c set
      2⤵
        PID:2056
      • C:\Users\Admin\AppData\Local\Temp\0792f3ace4712af9047ac5310ff45dd61da83d41b9f75e60a099568aab0bc43a.exe
        PECMD**pecmd-cmd* PUTF -dd -skipb=1116160 -len=5998019 "C:\Users\Admin\AppData\Local\Temp\~1386261432914888672.tmp",,C:\Users\Admin\AppData\Local\Temp\0792f3ace4712af9047ac5310ff45dd61da83d41b9f75e60a099568aab0bc43a.exe
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:2932
      • C:\Users\Admin\AppData\Local\Temp\~3572747920556142993~\sg.tmp
        7zG_exe x "C:\Users\Admin\AppData\Local\Temp\~1386261432914888672.tmp" -y -aoa -o"C:\Program Files (x86)\"
        2⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Suspicious use of AdjustPrivilegeToken
        PID:1788
      • C:\Program Files (x86)\uml.exe
        "C:\Program Files (x86)\\uml.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2716
        • C:\Users\Public\Documents\sougou\V4.6.80\Bin\QTalk.exe
          C:\Users\Public\Documents\sougou\V4.6.80\Bin\QTalk.exe
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2756
          • C:\Users\Public\Documents\sougou\spolsvt.exe
            C:\Users\Public\Documents\sougou\spolsvt.exe
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1960
      • C:\Users\Admin\AppData\Local\Temp\0792f3ace4712af9047ac5310ff45dd61da83d41b9f75e60a099568aab0bc43a.exe
        PECMD**pecmd-cmd* EXEC -wd:C: -hide cmd /c "C:\Users\Admin\AppData\Local\Temp\~1261988928892469496.cmd"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1780
        • C:\Windows\system32\cmd.exe
          cmd /c "C:\Users\Admin\AppData\Local\Temp\~1261988928892469496.cmd"
          3⤵
            PID:1096
        • C:\Users\Admin\AppData\Local\Temp\0792f3ace4712af9047ac5310ff45dd61da83d41b9f75e60a099568aab0bc43a.exe
          PECMD**pecmd-cmd* EXEC -wd:C: -hide cmd /c "C:\Users\Admin\AppData\Local\Temp\~446158194457302263.cmd"
          2⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:956
          • C:\Windows\system32\cmd.exe
            cmd /c "C:\Users\Admin\AppData\Local\Temp\~446158194457302263.cmd"
            3⤵
            • Deletes itself
            PID:2428

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\WPS_Installer.exe
        Filesize

        2.9MB

        MD5

        b52ba2b99108c496389ae5bb81fa6537

        SHA1

        9073d8c4a1968be24357862015519f2afecd833a

        SHA256

        c6ac7d9add40b913112b265d4f366d9ef80bbd711049db085fc750fcad4e14d8

        SHA512

        6637506ee80d359e729e0011b97e8d827e14356393193247f502b7fcfbbca249dc045b8acfe4b31ce462468f421dc5d9a4e31183bedb66c45a9aa43c01f81397

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\~1261988928892469496.cmd
        Filesize

        280B

        MD5

        42ff656bd4ee3e19a5828940041fdfdb

        SHA1

        2e3c7f0fd42dd48b014e82e9e5edf50664ae5698

        SHA256

        b326705c28abc9947182f84830e0e680d35551157b408a0f9cfd137279a02838

        SHA512

        4ba36b5e44c94df09b91b3557237dae6b74a9fe04da686f157938446cf635c464f616126e937400ee4d577708b3bdcb7f88cec8df23d344bfd7105b75f9ec7b0

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\~1386261432914888672.tmp
        Filesize

        5.7MB

        MD5

        5925978288f2f208b2b6baef7ed88510

        SHA1

        cad94d214f41cbeb9332cac52a532205527179bd

        SHA256

        218bef51c92f02c168999c09200f35e4c59dfdadc857e5110d4d45d2aa8d92fa

        SHA512

        e41e335e6854bb0f0dd7bac975bace1b97301da64be9f17d75303e6d38cf59f98a6c42d3e2f9c827710d96ccdd54f651fb4135018b7f0029a2d5ca86b9b4749b

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\~446158194457302263.cmd
        Filesize

        521B

        MD5

        772479dab0da1f76c9ab78552eeb7283

        SHA1

        b1c841cc73ee75c70582b1c22c98b61740f397b2

        SHA256

        6106761e9f8ad8c6e95f697677f110c2713d78b60c6632f383b0e1bdd87d3ee5

        SHA512

        7d395665d89de581737c8dfa38979a35a90e9694ace81ea6ac9b2229fdaf91887daffcfdd89903b711d5bef748341f36a655ba934eb3ab38d25e07e44fcdb438

        Download Submit

      • C:\Users\Public\Documents\sougou\Mpec.mbt
        Filesize

        92KB

        MD5

        318ef4be770866dbe650f6a09f26dbe4

        SHA1

        e28fce78f7f2dea7ba6dd1e337d766d01627b1c9

        SHA256

        4b9abc5f96d9b4601b989f7f19dbc5de8b53f7eb222904b380fed6c1500ea4de

        SHA512

        364491819d6f3ae3b5f28c66c7dac3d76eb50efef8d5b2176c121af249f52ba5b75dd39aaedfa69ef60ca0f3d546e8fb9184cd5964676b4c714eb6f978137ff3

        Download Submit

      • C:\Users\Public\Documents\sougou\spolsvt.exe
        Filesize

        9KB

        MD5

        523d5c39f9d8d2375c3df68251fa2249

        SHA1

        d4ed365c44bec9246fc1a65a32a7791792647a10

        SHA256

        20e3dc90a3e83b6202e2a7f4603b60e5e859639cb68693426c400b13aaeabd78

        SHA512

        526e1bba30d03f1ac177c6ab7409187a730969c429cebef15da68ffcf44b3b93227781eebc827b2f7a0fa17c391e00a0e532263fd0167aeaeb0456f96cfe3ae4

        Download Submit

      • \Program Files (x86)\uml.exe
        Filesize

        5.6MB

        MD5

        0a6b814ea328c6319cf1d8bee86633cb

        SHA1

        9967a2c1d93888abe499a531b0ab4e472f3916ee

        SHA256

        d8eb5ddf2f6b0b9283f556768ca1def8e0f7dd9c00e286045204e83f8525f74f

        SHA512

        385eefb0f7dc2852d1adf05cbd73908fffd3f99ea29c5c8756ec6a13a7b636e412486d2df46b5e7d289d3f91d5bb2cb4899ca69a57851616221e7fd179189787

        Download Submit

      • \Users\Admin\AppData\Local\Temp\~3572747920556142993~\sg.tmp
        Filesize

        715KB

        MD5

        7c4718943bd3f66ebdb47ccca72c7b1e

        SHA1

        f9edfaa7adb8fa528b2e61b2b251f18da10a6969

        SHA256

        4cc32d00338fc7b206a7c052297acf9ac304ae7de9d61a2475a116959c1524fc

        SHA512

        e18c40d646fa4948f90f7471da55489df431f255041ebb6dcef86346f91078c9b27894e27216a4b2fe2a1c5e501c7953c77893cf696930123d28a322d49e1516

        Download Submit

      • memory/956-117-0x0000000000400000-0x00000000005AE000-memory.dmp

        Filesize

        1.7MB

        Download

      • memory/1780-119-0x0000000000400000-0x00000000005AE000-memory.dmp

        Filesize

        1.7MB

        Download

      • memory/1960-76-0x0000000000400000-0x0000000000430000-memory.dmp

        Filesize

        192KB

        Download

      • memory/1960-72-0x0000000000400000-0x0000000000430000-memory.dmp

        Filesize

        192KB

        Download

      • memory/1960-78-0x0000000010000000-0x0000000010029000-memory.dmp

        Filesize

        164KB

        Download

      • memory/1960-73-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1960-66-0x0000000000400000-0x0000000000430000-memory.dmp

        Filesize

        192KB

        Download

      • memory/1960-67-0x0000000000400000-0x0000000000430000-memory.dmp

        Filesize

        192KB

        Download

      • memory/1960-68-0x0000000000400000-0x0000000000430000-memory.dmp

        Filesize

        192KB

        Download

      • memory/1960-70-0x0000000000400000-0x0000000000430000-memory.dmp

        Filesize

        192KB

        Download

      • memory/2364-36-0x00000000032C0000-0x0000000003886000-memory.dmp

        Filesize

        5.8MB

        Download

      • memory/2364-115-0x0000000000400000-0x00000000005AE000-memory.dmp

        Filesize

        1.7MB

        Download

      • memory/2364-60-0x0000000002C40000-0x0000000002DEE000-memory.dmp

        Filesize

        1.7MB

        Download

      • memory/2364-57-0x0000000000400000-0x00000000005AE000-memory.dmp

        Filesize

        1.7MB

        Download

      • memory/2364-0-0x0000000000400000-0x00000000005AE000-memory.dmp

        Filesize

        1.7MB

        Download

      • memory/2364-7-0x0000000002C40000-0x0000000002DEE000-memory.dmp

        Filesize

        1.7MB

        Download

      • memory/2364-113-0x0000000005320000-0x00000000054CE000-memory.dmp

        Filesize

        1.7MB

        Download

      • memory/2364-112-0x0000000005320000-0x00000000054CE000-memory.dmp

        Filesize

        1.7MB

        Download

      • memory/2364-30-0x0000000002710000-0x0000000002720000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2364-84-0x0000000000400000-0x00000000005AE000-memory.dmp

        Filesize

        1.7MB

        Download

      • memory/2716-83-0x0000000000400000-0x00000000009C6000-memory.dmp

        Filesize

        5.8MB

        Download

      • memory/2716-37-0x0000000000400000-0x00000000009C6000-memory.dmp

        Filesize

        5.8MB

        Download

      • memory/2716-59-0x0000000003CA0000-0x0000000004266000-memory.dmp

        Filesize

        5.8MB

        Download

      • memory/2756-65-0x0000000000400000-0x00000000009C6000-memory.dmp

        Filesize

        5.8MB

        Download

      • memory/2756-77-0x0000000000400000-0x00000000009C6000-memory.dmp

        Filesize

        5.8MB

        Download

      • memory/2932-11-0x0000000000400000-0x00000000005AE000-memory.dmp

        Filesize

        1.7MB

        Download

      • memory/2932-8-0x0000000000400000-0x00000000005AE000-memory.dmp

        Filesize

        1.7MB

        Download