Analysis
-
max time kernel
147s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
23-10-2024 01:43
General
-
Target
名单助手PDF.exe
-
Size
7.7MB
-
MD5
37243b32f39c68f878b420e8cbef07c7
-
SHA1
5ca17ba18e36784f9719d2e54b792cea13385caa
-
SHA256
20863b98be8695cb78b62609caf8717fbac3ed19f3f2a86ce3f2a96a7adced19
-
SHA512
1ddaa38dfce588d014e1587559f103b4bda799feb2fbdcb5bcea730b61e5412e654116ec0b490620c58efab49926c45a75b5d6b7e83db53376f78e025fb24cd5
-
SSDEEP
98304:AF3+NYYX5YQmdT8PRv0J0hx09BSpKki9jBGrisYdMLU9V09DsL2qEKqjbbqqIpf7:AFFiby94pFKjBGr97eLd
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload 2 IoCs
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\名单助手PDF.exe"C:\Users\Admin\AppData\Local\Temp\名单助手PDF.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\ProgramData\1H0K0K\2I2L1LF.exeC:\ProgramData\1H0K0K\2I2L1LF.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
233KB
MD54f9c6e1a88e9a25dff08db5c05b07a15
SHA1c6375b4ac7fa362064e4eeba9442c12b9bfb7238
SHA2569714e568328990ce76669b10573032c34b8617d6c292dafbf509bb59de9d86bc
SHA5123c0faac411137c73fa5e1dffd2c696ced0ccc221b9974fed3bd158b7b6bf4e002162c4f0d4f41105483eb16c6220e20fe48a65adf8f6278882d0d0ff0727726b
-
Filesize
2.2MB
MD56763be58feb53c3b430c94277b99adcb
SHA194008b6cd06888df63542969f3b1007a85d2fa1b
SHA256c072f5f0e28cbc8cb347a7736371b57d6a9192667122fbb83fd4f436529f96ef
SHA5124aa0814c5f296adf7dfdc8bb7879b447d6d404e3fe54af5293bfe6db55d1329bb87ccee6bc415b310f9e49e32f789fe3549d6a99045cd036362a8a4f2945c1a1
-
Filesize
1.2MB
MD5eab35abc0ae31018b3f0c64fb93b785b
SHA1be2468ea6292889e8c58306aacbc875147e29a00
SHA2565b8e39728ad4b2ec68d5b3e0af4dfa914a26812bbdca20198d3fe0d40397126a
SHA512c1555252c93c314a8d26ef018afcb54937abc0b5e755fbc3d6a3bcda7ec796fddca48ffb215cdcb1a92edb2361122d273b1c40987cd2f4c2fe754a2be8f6ae06
-
Filesize
142KB
MD5bbaea75e78b80434b7cd699749b93a97
SHA1c7d151758cb88dee39dbb5f4cd30e7d226980dde
SHA256c9a1c52f5f5c8deef76b8e989c6a377f00061fa369cbd1cee7f53f8f03295f5c
SHA5127f41846d61452c73566554ba5f6ef356e757ff4c292ad68bbcc1b84f736c02c6b0bc52e13270e5d7be4cde743d40cfc281028d4a0e322fbeecd9b786d08bac3d
-
Filesize
797B
MD5a998c8fe87f4d7176345172fbfb08f5d
SHA170f94f44b8d5d2fafacbe396bca9a0b140c30d14
SHA25611fb31494899a7a8afa91933c47779c8e0f311883819198d98553da543ac7b2b
SHA512e065d8275473c728afc17eb53e1fb2b2369f43ee0387085b919415d368f595e70a3bc44602a63d83fd829f0c474399020a4ebf45afc304c0be37354e7460e43e
-
Filesize
1.1MB
MD59bfaab258ac336e40145a0e98c4d0639
SHA11bbab07dddf56f3fd43c1c61d38b11dd121795c6
SHA25653a844c36f87b391260bfca420e9cdb46770e42a4b2a4ad4be925ad381830eb7
SHA5125adc1903d385943fa999aa1541ee101ca0d38d9bb602c4a36e690f9099eb3b3df99b2d65c4f97f3abfcd8f8a5767d1493b59b88f9b68dc8c09205b380e782c19
-
Filesize
2.8MB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
2.8MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
5.9MB
-
Filesize
2.8MB
-
Filesize
200KB
-
Filesize
236KB
-
Filesize
168KB
-
Filesize
200KB
-
Filesize
236KB