Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
24-09-2024 21:21
General
-
Target
ae74cae9f7949ea19ea6c891726755e76f15fcc5eef5107ad70dc9f7f797456b.exe
-
Size
2.2MB
-
MD5
8697cd1ff14060f9ae30865c5539c5df
-
SHA1
1a76db7782af48e882c933156cba179882ffd580
-
SHA256
ae74cae9f7949ea19ea6c891726755e76f15fcc5eef5107ad70dc9f7f797456b
-
SHA512
e0cc09823f450794e7d5bbf40cce7bf8476a3da591f28102dd253f5bf06fe88f74cd1707cf0bfa912c32af91dc7ba64c8f8503dd92176a17b2935b62b8aa6b65
-
SSDEEP
24576:M25Jj/b0QGaUiB1NM4LPl0L4aV8G705GU3z1Y3Ri5yJHWkl:MQJj/b0sNM4LPlHepm5WHx
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ae74cae9f7949ea19ea6c891726755e76f15fcc5eef5107ad70dc9f7f797456b.exe"C:\Users\Admin\AppData\Local\Temp\ae74cae9f7949ea19ea6c891726755e76f15fcc5eef5107ad70dc9f7f797456b.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\ProgramData\5L5O5O\JF_FYFb.exeC:\ProgramData\5L5O5O\JF_FYFb.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
176KB
MD5f0b2a45cdf3a772d2f932fa2e9323206
SHA18926be096554e021b410b767fdda341340002573
SHA256503f783c23e9211488e569d124dda5da0e52de1d51f088e4e3fde94d8a26c06b
SHA5124079a23f65135580d1daf88f2fa346c2e6c8287ed5bdf0753e52717e179b04769f7f6e0730e7106d119d2772bae702c4cde324e4422e2897764c95af68f26d2e
-
Filesize
696KB
MD52d0bc28e3dddf732d7277ef4b7410d89
SHA1b788799536b2ab14644265431e3566e2dbb90f9c
SHA25690223b74b727514e30a46544d8c597547aded4ae457d6247ef8de37b4c926124
SHA512b5e5086a076889d98d24da431521cf5cc6886b124f4937f102d4bda002cd25a185641a98c887a2265e73703bb55076f90f1562cfd76d4e81f8323aa437424448
-
Filesize
1.2MB
MD5c4625ad46bb9c1cb6b0c0cab5f6d88d1
SHA1b9faa59e7bdd613a8a0448f70b5e01bcf7fc04b6
SHA2569cfb6fb96968fd78f6c932fb499392a0e14eafac23dbfca5b4486008f66d5f1b
SHA5129f1a39d4d15298e64e53003fda2933fb81cf781c1457beab57ba74756f7f40408eba7e0bc9734d42a2b5a28b96fd107904e87beacbba7aaae9d6d39e6f4db10b
-
Filesize
142KB
MD5bbaea75e78b80434b7cd699749b93a97
SHA1c7d151758cb88dee39dbb5f4cd30e7d226980dde
SHA256c9a1c52f5f5c8deef76b8e989c6a377f00061fa369cbd1cee7f53f8f03295f5c
SHA5127f41846d61452c73566554ba5f6ef356e757ff4c292ad68bbcc1b84f736c02c6b0bc52e13270e5d7be4cde743d40cfc281028d4a0e322fbeecd9b786d08bac3d
-
Filesize
797B
MD5459583c12c4941e64bf2ffabd9f78f7d
SHA12ad26d0a4263c7eb8bfe4c295b4c7c77b76a76a8
SHA256318eea8d2bd888f3cb495936cde2f00754efea6bb8305ef8671d6de2fe16aba2
SHA512d87d2fdfd127e15fe08c55094dc0b5c15b6fe69e12cff570b2a62155fb67b9b84614e06fe9d573c9fc21faea04471148fc6b65fcd2d7df0cf142148e8bf0dbba
-
Filesize
462KB
MD5cc227d38b4ded7fc4312c0a20ebf752a
SHA1f85c1cebab52d8a813c85d38f60f5528d91c7663
SHA2560b28763006d53b70dce1aaa54c7c84d7982107b6a76383d10cd674e097e047df
SHA5126fef8b8142de89e8f0ff90380fc1648717eefe77bbe9a15c2fe9e5e668cafab74b7efb781a52c16a8885693a4019367a925cfb0105b65151374459db9d3d14a1
-
Filesize
180KB
-
Filesize
168KB
-
Filesize
180KB
-
Filesize
180KB
-
Filesize
156KB
-
Filesize
200KB
-
Filesize
196KB
-
Filesize
3.0MB
-
Filesize
3.0MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
3.0MB