Analysis
-
max time kernel
149s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
13-09-2024 19:02
General
-
Target
756667b99c18e6c13fdc86d30868e90581b53dab4230daaba2b8261a0f4ece0f.exe
-
Size
713KB
-
MD5
0b7df39ea0e4d0a980ff69d34c6255cc
-
SHA1
fdda6465d415b9e146f55480a0831166c8a2e234
-
SHA256
756667b99c18e6c13fdc86d30868e90581b53dab4230daaba2b8261a0f4ece0f
-
SHA512
ca2d86eb519bf346c00499bf5788bc499fae23519492f32914531ec03f8c66253fa9195224206d0ad95ab7d0347c1e5e33fa35196f46064efd49aee247c67ad8
-
SSDEEP
6144:qcNrqbprPopMFVJnsdPq0TYU4bWmb8pRYp9HtfqQnHlETCf/MiO7OhQPdVw1iied:qcNGPlnsdPhTYUDvU9nHWTFPdxJVQX
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload 1 IoCs
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in System32 directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\756667b99c18e6c13fdc86d30868e90581b53dab4230daaba2b8261a0f4ece0f.exe"C:\Users\Admin\AppData\Local\Temp\756667b99c18e6c13fdc86d30868e90581b53dab4230daaba2b8261a0f4ece0f.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\ProgramData\XEXHXG\G0G_G_f.exeC:\ProgramData\XEXHXG\G0G_G_f.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
86KB
MD503706618a4b880538f086fae374b06cd
SHA187af405c4ed70d56f555bc0c781f7f1fdd0c9b68
SHA25604db5fd77a016d339c642639cd5338e7c7777d9b66344c04c325f1e4c57fa00f
SHA512da5c6744f1fd5fde838af7635a48971910b08a7ca06018e05df85891e3bfbca59b65c4341763480c638ad3ddbae431a2419ac3b3c55135486b68b3e686acb682
-
Filesize
1.2MB
MD51eaf8e0901eb3c862a865def25820db7
SHA198eb757704afc7be53d5dd9da9c802fc30650d54
SHA2562f7b69ed3ae26ba8afb5d33f67a409232ce8d05c789e862dbbdd047e90b805ef
SHA512e6eee6009ed1d3a92fa08fe1b791b499eeab2b36228d8f56174edaaf1c53596fc5644210dfc8aeac68333ed6db1d9792e410b2faad12d6958765bcf2ab740bf3
-
Filesize
807KB
MD548828df7be1cfbadf55ceb757101d2c0
SHA1fec86693a2e680791fa38517570a0185d5728cdc
SHA25686cf458d7330b5c564ea6d858517072095d78234009d69c2411db08af44f5b47
SHA512348c6a7256a7b309fc5493e6f306ce2a137faffd8cedd859d97bd5bc9def3d4125f2507349cb3f2e59a1cc018d401ec36cccf01a28dba9cf06a70b11afb80b41
-
Filesize
755KB
MD50e37fbfa79d349d672456923ec5fbbe3
SHA14e880fc7625ccf8d9ca799d5b94ce2b1e7597335
SHA2568793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
SHA5122bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630
-
Filesize
142KB
MD5bbaea75e78b80434b7cd699749b93a97
SHA1c7d151758cb88dee39dbb5f4cd30e7d226980dde
SHA256c9a1c52f5f5c8deef76b8e989c6a377f00061fa369cbd1cee7f53f8f03295f5c
SHA5127f41846d61452c73566554ba5f6ef356e757ff4c292ad68bbcc1b84f736c02c6b0bc52e13270e5d7be4cde743d40cfc281028d4a0e322fbeecd9b786d08bac3d
-
Filesize
797B
MD5377146b040c8dfddeaa7e0c449c2461e
SHA1c0bc961be48e2cb93c1dca56e61a2257053d0358
SHA25601b0d31cc799dd62443fc6597f4580b82facbbec71ca360a91c81d42b2718633
SHA512190e73a4281ec523b0e08233143eaf645de83d47fdf10432284f7333fa5bc13e495e8e98e9199330f2543ebf10b9768d925f3e42794237e841c77ffb24fab9a0
-
Filesize
1.3MB
MD5adb876923a9a22fca4a2cbbaca8fb4fd
SHA17e6b5306880e5b2c13ec84f2dffddbbafbf58e01
SHA2568ff46d56ec8df149fdc77b62d2103c2300b71a34bc9c50d93a4116976a15351d
SHA51265f8b9f028ea30f67b174c511ed61a4ae5755037d4ed6ca28208d3716858137b9637e9a504533055778634aea568f5f99754d58ca0fa019420b01ecc2fbbfac4
-
Filesize
536KB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
2.4MB
-
Filesize
180KB
-
Filesize
180KB
-
Filesize
168KB
-
Filesize
180KB
-
Filesize
156KB
-
Filesize
200KB
-
Filesize
196KB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB