Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
30-09-2024 16:05
General
-
Target
票助手PDFm.exe
-
Size
6.3MB
-
MD5
0d3d7ee3d8b1b32311a3f8f6b43d379b
-
SHA1
1c68d872ef070187544d671b45a9f17c0f347f99
-
SHA256
6a6b231182fd8a2df3252d3c8a1ac89054a9721255be8d6245e0fd722b38b40d
-
SHA512
a4dbf8754c435ecae8cbe42680ae8476158e7f16fc11765792fde05f318f861c834a7956ebbfc5e450df088205ef02d435a96a5d1680c9a45db693734810a99d
-
SSDEEP
98304:9iOQYYX5YQmdT8PRv0J0hx09BSpKki9jBGrisYdMLU9V09DsL2qEKqjb:jiby94pFKjBGr97eL
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\票助手PDFm.exe"C:\Users\Admin\AppData\Local\Temp\票助手PDFm.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\ProgramData\TCWSCS\HXH0G0m.exeC:\ProgramData\TCWSCS\HXH0G0m.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
176KB
MD5bada72ab726036ea84eac019bccb8ffc
SHA13f8aa6a04538babde8e6d2b76ab8e83cb7e61d2e
SHA2565c7bd6c227802d6746b15b38360bf2c4ba2f553a250e1c8f7bf84591d97400a5
SHA512bfca87ef43b34bed31990e6780b3c6c4d4072f21daf8e36b1f15033c35b3b36f6fa76d0af30c4f4180012cb98139181943f59ab5f44250452007213a8119b0c7
-
Filesize
1.6MB
MD5e603041002b66bcd011876f1f73ef712
SHA10f14e961f06a3667eac666e490adb096db13c694
SHA256209c382b56c1bcb6ef5337c94ebe7d9ce38a9286567a463cce679e476d250c00
SHA512ec879c200e6ec5f305be4404d5a95b6651729716a94e553e86f7600170c876d1298623813e264e96cf852cc10beb7bc90926957399b8fdab686ab406f957ecfa
-
Filesize
1.2MB
MD50dde2f5fcb760573e79b08ef31f0c9b0
SHA1447f5e59f76e753fa5f092a44248ae1582e6617f
SHA25691f94e74d971a5f8f7732260824cf7a45eb1a7438bd1abec12c6eaddf44f26a8
SHA51284482b5d3ab7180edfa173260b94cbe965790b6130f1f734ab075dc8a8cb440638b39fbc4bd5ab7e8a0082bbdbd1df971f07f3f8bb43a448a7c36dd9cfda5fcf
-
Filesize
142KB
MD5bbaea75e78b80434b7cd699749b93a97
SHA1c7d151758cb88dee39dbb5f4cd30e7d226980dde
SHA256c9a1c52f5f5c8deef76b8e989c6a377f00061fa369cbd1cee7f53f8f03295f5c
SHA5127f41846d61452c73566554ba5f6ef356e757ff4c292ad68bbcc1b84f736c02c6b0bc52e13270e5d7be4cde743d40cfc281028d4a0e322fbeecd9b786d08bac3d
-
Filesize
797B
MD5f81b0ccb99a96f6d339142ab09dbb17c
SHA1a8f10085e751a903acc17ed917fd782c13c8781f
SHA256bf6ab0826e4d97574c0f9ffccc2aa8e24ae56636df9ad0f1b88c1dbfa9374733
SHA5120a92fe79fb38933e64a8b8052f4477e361d8205d698d92bfcc07a9b65ce340b2c4f1c9554209172f7f2d78843a2d4864d1e1c65897ddca3af914935c27e0a8dd
-
Filesize
903KB
MD536dbe670282d5727f0c44b705ff767cc
SHA1a1417e16a602eda333e7d7bfb891f5f694ff01de
SHA2569bf4f07491feaddd822fed4a4019f2da4cf69f20c6549bd182d020860269ae11
SHA512ad72de707609d673d5764390d3d2e30fb9a13da5a55e60e3162e43cb0983daef8519b326c386687ac1b1e8a14c1772989412f36ffdc7b795dd155934294724a7
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
5.9MB
-
Filesize
200KB
-
Filesize
236KB
-
Filesize
168KB
-
Filesize
200KB
-
Filesize
236KB