Analysis
-
max time kernel
146s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
15-10-2024 08:26
General
-
Target
名单助手PDF.exe
-
Size
6.3MB
-
MD5
3ac0bdbd6f5c90b94980e3559ae419f5
-
SHA1
6b01a0ced6191140830dcc8478f5a7a19d799fa5
-
SHA256
6dc0f4a97c3f5e12b4de8b3b2d74afe5298679604077a0a9d62ac479c4b24923
-
SHA512
14e9bbd5467f7e4f0aa9d69362a3763bb731c147a661ca4294d11a4704d58ca3b53f28023efbcc0051bc1c2518a917a12b9a64135b08abc4cded85676752846c
-
SSDEEP
98304:6YYX5YQmdT8PRv0J0hx09BSpKki9jBGrisYdMLU9V09DsL2qEKqjbS:piby94pFKjBGr97eLT
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload 2 IoCs
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 53 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\名单助手PDF.exe"C:\Users\Admin\AppData\Local\Temp\名单助手PDF.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\taskeng.exetaskeng.exe {BB95505D-D8C9-4C00-97BE-EFB060FC755C} S-1-5-21-3551809350-4263495960-1443967649-1000:NNYJZAHP\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\S9SCSB\0K0K3KF.exeC:\ProgramData\S9SCSB\0K0K3KF.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
179KB
MD57e52644fee7705b81725a99e58e9f26c
SHA15650a086edca287a7881beab9ee3630e069b0ba7
SHA256b9d12baf19a0c261398a89bb6db6600756cb9122ad08b70534ad70a245d61933
SHA512d8f063ad6e077f348f0c80a6bd214d063ff108e9432b33cb3a56196aebcda8888a55bd65ff2cce2dd68f9783181b9293f01f02fbcecdda9dade793a248aacb90
-
Filesize
1.6MB
MD5e603041002b66bcd011876f1f73ef712
SHA10f14e961f06a3667eac666e490adb096db13c694
SHA256209c382b56c1bcb6ef5337c94ebe7d9ce38a9286567a463cce679e476d250c00
SHA512ec879c200e6ec5f305be4404d5a95b6651729716a94e553e86f7600170c876d1298623813e264e96cf852cc10beb7bc90926957399b8fdab686ab406f957ecfa
-
Filesize
1.2MB
MD5eab35abc0ae31018b3f0c64fb93b785b
SHA1be2468ea6292889e8c58306aacbc875147e29a00
SHA2565b8e39728ad4b2ec68d5b3e0af4dfa914a26812bbdca20198d3fe0d40397126a
SHA512c1555252c93c314a8d26ef018afcb54937abc0b5e755fbc3d6a3bcda7ec796fddca48ffb215cdcb1a92edb2361122d273b1c40987cd2f4c2fe754a2be8f6ae06
-
Filesize
142KB
MD5bbaea75e78b80434b7cd699749b93a97
SHA1c7d151758cb88dee39dbb5f4cd30e7d226980dde
SHA256c9a1c52f5f5c8deef76b8e989c6a377f00061fa369cbd1cee7f53f8f03295f5c
SHA5127f41846d61452c73566554ba5f6ef356e757ff4c292ad68bbcc1b84f736c02c6b0bc52e13270e5d7be4cde743d40cfc281028d4a0e322fbeecd9b786d08bac3d
-
Filesize
756B
MD530268fe49a6a4a038dc1a102257e5664
SHA14a0798c24511c4ebfff2135c8f3b3917bf3d79a3
SHA256a2ce05a9fec8ad0f8e2270b564d8356f180f441e20f0560303151d88f193fd3c
SHA51257e9a2dcb7c45e4013f4544ffb902024fde98acdad1eadd0eac0620b185c64b7a653c6be042d2f048b6d4bbd3b856f387ea63c4a579570f43d73a78e072cbc96
-
Filesize
907KB
MD5849ee4e102ea0c004ba2dbd79d3303d9
SHA10164557eb9e10e90b5f71adf414b38ea437d5911
SHA256c283cd4c2fa9a5bd67df2987555fe90d3fd46effbec5cdc1d67eac25b195e18c
SHA51214a7f4e9467b6f15d91ebb8ab3074b63afbb3f3ecbd2b134f6e09c56e977a6d9520a3a546e028cad89fc4292d0fa1ee078bbaad5cf815f3173cd0aff477c531f
-
Filesize
200KB
-
Filesize
236KB
-
Filesize
168KB
-
Filesize
200KB
-
Filesize
236KB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
5.9MB
-
Filesize
2.8MB