fatalrat | 20863b98be8695cb78b62609caf8717fbac3ed19f3f2a86ce3f2a96a7adced19

Analysis

max time kernel
147s
max time network
147s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
23-10-2024 01:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

名单助手PDF.exe
Size

7.7MB
MD5

37243b32f39c68f878b420e8cbef07c7
SHA1

5ca17ba18e36784f9719d2e54b792cea13385caa
SHA256

20863b98be8695cb78b62609caf8717fbac3ed19f3f2a86ce3f2a96a7adced19
SHA512

1ddaa38dfce588d014e1587559f103b4bda799feb2fbdcb5bcea730b61e5412e654116ec0b490620c58efab49926c45a75b5d6b7e83db53376f78e025fb24cd5
SSDEEP

98304:AF3+NYYX5YQmdT8PRv0J0hx09BSpKki9jBGrisYdMLU9V09DsL2qEKqjbbqqIpf7:AFFiby94pFKjBGr97eLd

Score

10^/10

fatalrat discovery infostealer rat

Malware Config

Signatures

FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
infostealer rat fatalrat

Fatal Rat payload 2 IoCs

rat infostealer

Processes:

resource	yara_rule
behavioral1/memory/2504-66-0x0000000000570000-0x000000000059A000-memory.dmp	fatalrat
behavioral1/memory/2504-73-0x0000000000530000-0x0000000000562000-memory.dmp	fatalrat

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

Processes:

5M5L5OF.exe

pid	Process
2504	5M5L5OF.exe

Loads dropped DLL 1 IoCs

Processes:

5M5L5OF.exe

pid	Process
2504	5M5L5OF.exe

Drops file in System32 directory 1 IoCs

Processes:

5M5L5OF.exe

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\5M5L5OF.exe	5M5L5OF.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

5M5L5OF.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5M5L5OF.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

5M5L5OF.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	5M5L5OF.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	5M5L5OF.exe

Suspicious behavior: EnumeratesProcesses 53 IoCs

Processes:

名单助手PDF.exe5M5L5OF.exe

pid	Process
2232	名单助手PDF.exe
2232	名单助手PDF.exe
2504	5M5L5OF.exe
2504	5M5L5OF.exe
2504	5M5L5OF.exe
2504	5M5L5OF.exe
2504	5M5L5OF.exe
2504	5M5L5OF.exe
2504	5M5L5OF.exe
2504	5M5L5OF.exe
2504	5M5L5OF.exe
2504	5M5L5OF.exe
2504	5M5L5OF.exe
2504	5M5L5OF.exe
2504	5M5L5OF.exe
2504	5M5L5OF.exe
2504	5M5L5OF.exe
2504	5M5L5OF.exe
2504	5M5L5OF.exe
2504	5M5L5OF.exe
2504	5M5L5OF.exe
2504	5M5L5OF.exe
2504	5M5L5OF.exe
2504	5M5L5OF.exe
2504	5M5L5OF.exe
2504	5M5L5OF.exe
2504	5M5L5OF.exe
2504	5M5L5OF.exe
2504	5M5L5OF.exe
2504	5M5L5OF.exe
2504	5M5L5OF.exe
2504	5M5L5OF.exe
2504	5M5L5OF.exe
2504	5M5L5OF.exe
2504	5M5L5OF.exe
2504	5M5L5OF.exe
2504	5M5L5OF.exe
2504	5M5L5OF.exe
2504	5M5L5OF.exe
2504	5M5L5OF.exe
2504	5M5L5OF.exe
2504	5M5L5OF.exe
2504	5M5L5OF.exe
2504	5M5L5OF.exe
2504	5M5L5OF.exe
2504	5M5L5OF.exe
2504	5M5L5OF.exe
2504	5M5L5OF.exe
2504	5M5L5OF.exe
2504	5M5L5OF.exe
2504	5M5L5OF.exe
2504	5M5L5OF.exe
2504	5M5L5OF.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

5M5L5OF.exe

description	pid	Process
Token: SeDebugPrivilege	2504	5M5L5OF.exe
Token: SeDebugPrivilege	2504	5M5L5OF.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

taskeng.exe

description	pid	Process	procid_target
PID 2404 wrote to memory of 2504	2404	taskeng.exe	33
PID 2404 wrote to memory of 2504	2404	taskeng.exe	33
PID 2404 wrote to memory of 2504	2404	taskeng.exe	33
PID 2404 wrote to memory of 2504	2404	taskeng.exe	33

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\名单助手PDF.exe
"C:\Users\Admin\AppData\Local\Temp\名单助手PDF.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2232

C:\Windows\system32\taskeng.exe
taskeng.exe {B7E254FF-6907-4202-ADDE-DF28AF63AC7F} S-1-5-21-3533259084-2542256011-65585152-1000:XPAJOTIY\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2404
- C:\ProgramData\9P8P8S\5M5L5OF.exe
  C:\ProgramData\9P8P8S\5M5L5OF.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\9P8P8S\5M5L5OF.exe

Filesize
233KB

MD5
4f9c6e1a88e9a25dff08db5c05b07a15

SHA1
c6375b4ac7fa362064e4eeba9442c12b9bfb7238

SHA256
9714e568328990ce76669b10573032c34b8617d6c292dafbf509bb59de9d86bc

SHA512
3c0faac411137c73fa5e1dffd2c696ced0ccc221b9974fed3bd158b7b6bf4e002162c4f0d4f41105483eb16c6220e20fe48a65adf8f6278882d0d0ff0727726b

Download Submit
C:\ProgramData\9P8P8S\longlq.cl

Filesize
1.2MB

MD5
eab35abc0ae31018b3f0c64fb93b785b

SHA1
be2468ea6292889e8c58306aacbc875147e29a00

SHA256
5b8e39728ad4b2ec68d5b3e0af4dfa914a26812bbdca20198d3fe0d40397126a

SHA512
c1555252c93c314a8d26ef018afcb54937abc0b5e755fbc3d6a3bcda7ec796fddca48ffb215cdcb1a92edb2361122d273b1c40987cd2f4c2fe754a2be8f6ae06

Download Submit
C:\Users\Admin\AppData\Roaming\3J2J2\EUDX.exe

Filesize
142KB

MD5
bbaea75e78b80434b7cd699749b93a97

SHA1
c7d151758cb88dee39dbb5f4cd30e7d226980dde

SHA256
c9a1c52f5f5c8deef76b8e989c6a377f00061fa369cbd1cee7f53f8f03295f5c

SHA512
7f41846d61452c73566554ba5f6ef356e757ff4c292ad68bbcc1b84f736c02c6b0bc52e13270e5d7be4cde743d40cfc281028d4a0e322fbeecd9b786d08bac3d

Download Submit
C:\Users\Admin\AppData\Roaming\3J2J2\Microsoft\Windows\Start Menu\Programs\startup\website_secure_lnk.lnk

Filesize
756B

MD5
ccef3715cad97bb9828c195d10a91cd4

SHA1
1ffacd020ad40d4aa0f5dfb07dbcb0b5b661a919

SHA256
48c3f083c8146d6ebd2b1b8b9006321453cf41ba7a7cdcaa641a035a25486655

SHA512
014b760eb0f0c9e26c2b47b087a253b22e27a20a4b67da50bf695f746658750a127172ad4f8c5a26539be3d9b5ddb87035d81d80eefda7d918819f5e8a8c0e44

Download Submit
C:\Users\Public\O8O8R7

Filesize
1.1MB

MD5
9bfaab258ac336e40145a0e98c4d0639

SHA1
1bbab07dddf56f3fd43c1c61d38b11dd121795c6

SHA256
53a844c36f87b391260bfca420e9cdb46770e42a4b2a4ad4be925ad381830eb7

SHA512
5adc1903d385943fa999aa1541ee101ca0d38d9bb602c4a36e690f9099eb3b3df99b2d65c4f97f3abfcd8f8a5767d1493b59b88f9b68dc8c09205b380e782c19

Download Submit
\ProgramData\9P8P8S\PBVM90.dll

Filesize
2.2MB

MD5
6763be58feb53c3b430c94277b99adcb

SHA1
94008b6cd06888df63542969f3b1007a85d2fa1b

SHA256
c072f5f0e28cbc8cb347a7736371b57d6a9192667122fbb83fd4f436529f96ef

SHA512
4aa0814c5f296adf7dfdc8bb7879b447d6d404e3fe54af5293bfe6db55d1329bb87ccee6bc415b310f9e49e32f789fe3549d6a99045cd036362a8a4f2945c1a1

Download Submit
memory/2232-56-0x0000000004BE0000-0x0000000004EAD000-memory.dmp

Filesize
2.8MB

Download
memory/2232-38-0x00000000023D0000-0x00000000029B9000-memory.dmp

Filesize
5.9MB

Download
memory/2232-0-0x00000000023D0000-0x00000000029B9000-memory.dmp

Filesize
5.9MB

Download
memory/2232-3-0x0000000000400000-0x0000000000AE8000-memory.dmp

Filesize
6.9MB

Download
memory/2232-1-0x0000000004BE0000-0x0000000004EAD000-memory.dmp

Filesize
2.8MB

Download
memory/2232-83-0x00000000023D0000-0x00000000029B9000-memory.dmp

Filesize
5.9MB

Download
memory/2232-82-0x0000000000400000-0x0000000000AE8000-memory.dmp

Filesize
6.9MB

Download
memory/2232-84-0x0000000004BE0000-0x0000000004EAD000-memory.dmp

Filesize
2.8MB

Download
memory/2504-64-0x00000000003F0000-0x000000000042B000-memory.dmp

Filesize
236KB

Download
memory/2504-65-0x0000000000530000-0x0000000000562000-memory.dmp

Filesize
200KB

Download
memory/2504-66-0x0000000000570000-0x000000000059A000-memory.dmp

Filesize
168KB

Download
memory/2504-72-0x00000000003F0000-0x000000000042B000-memory.dmp

Filesize
236KB

Download
memory/2504-73-0x0000000000530000-0x0000000000562000-memory.dmp

Filesize
200KB

Download