Analysis
-
max time kernel
149s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
23-10-2024 20:42
General
-
Target
d2caeb6d90e3240fd087e2180e28219651dc9f6c5ee7c2f18bd59e5b98dcfd6f.exe
-
Size
6.1MB
-
MD5
f24efc53f425d85f86e7d4e2000dbc2a
-
SHA1
3d29c3ea01714fe3f757c104f44281e2335d278b
-
SHA256
d2caeb6d90e3240fd087e2180e28219651dc9f6c5ee7c2f18bd59e5b98dcfd6f
-
SHA512
ad88e648c3124fc379784887e7d6cbb3576eb9bae9cc8400c9d1ed7b093c1c8c691bd98f9a43f8a6a8cd33db403888f4106fef70697b90a8670227fd334a1813
-
SSDEEP
98304:4YYX5YQmdT8PRv0J0hx09BSpKki9jBGrisYdMLU9V09DsL2qEKqjb:niby94pFKjBGr97eL
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload 2 IoCs
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\d2caeb6d90e3240fd087e2180e28219651dc9f6c5ee7c2f18bd59e5b98dcfd6f.exe"C:\Users\Admin\AppData\Local\Temp\d2caeb6d90e3240fd087e2180e28219651dc9f6c5ee7c2f18bd59e5b98dcfd6f.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\ProgramData\J_J2I2\N3M6M6f.exeC:\ProgramData\J_J2I2\N3M6M6f.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
35KB
MD5fb22835bd4e35467ea252532e27048f5
SHA128c0d46a124bf80c19610477c319ce4c00cf327f
SHA25652eae07a2529d9fd994f2a8bd59474f7ec9a4e2073d852c0fca4853d193c0ec3
SHA512d8bc2c1b9ddb3aea4f28fe0075475f9bfc2784a08f23daae3420cc6e3d3a58243f1db90ac5029a471861e004ca3b70135f8f1eccd6341b80052dd2e9658e2c04
-
Filesize
2.2MB
MD56763be58feb53c3b430c94277b99adcb
SHA194008b6cd06888df63542969f3b1007a85d2fa1b
SHA256c072f5f0e28cbc8cb347a7736371b57d6a9192667122fbb83fd4f436529f96ef
SHA5124aa0814c5f296adf7dfdc8bb7879b447d6d404e3fe54af5293bfe6db55d1329bb87ccee6bc415b310f9e49e32f789fe3549d6a99045cd036362a8a4f2945c1a1
-
Filesize
1.2MB
MD57d8def4046bf2a36e9f2bcf0be543699
SHA1d57dfa0f16b3ceab6c7de9d1ea09a70e920983f9
SHA2565a4a700f688627c1bf990412a21961b9092672dae9d91778ad72e535cc80be83
SHA5121e58413dc4cff29a230da6a5ff57e23cde05cd138687c14ae11c2d326f6a7b4b5e439f202f2d1022f5d8c60485df9d6c31d5d75568ec9345cc312aec2934dfe5
-
Filesize
142KB
MD5bbaea75e78b80434b7cd699749b93a97
SHA1c7d151758cb88dee39dbb5f4cd30e7d226980dde
SHA256c9a1c52f5f5c8deef76b8e989c6a377f00061fa369cbd1cee7f53f8f03295f5c
SHA5127f41846d61452c73566554ba5f6ef356e757ff4c292ad68bbcc1b84f736c02c6b0bc52e13270e5d7be4cde743d40cfc281028d4a0e322fbeecd9b786d08bac3d
-
Filesize
797B
MD591a87960313ff55ed22675aa28723283
SHA1a4593d63991635c9274dfe651ea110e0bfd2fa6b
SHA25614ebb71907aa4e172b93dcaef8dfea0ee91bf15106a79af8efe31519910353c1
SHA512778ee1ebc88660515200e5ad0336612790f2bad7f9b05587482b560e137c66857fc0afef5e59a4acbaa737990711f18422a550d6f8b6196eee8a60d2aee47728
-
Filesize
1.1MB
MD5ead7f2ba252b4fc71fa5076bce319c1a
SHA101ad4d23563aebf9b907b8bd4f57b1023cb6e9ff
SHA2567fb84c2b2b3c75ef34ae388462da6953e9b73817ece4006d93cffeb6fee1fb45
SHA5129f80ed48ad9f71e3d7d3cedbfd07855b81973add53af5e916047e8a1b3ba9caeb7edfe5743e6f63ca821287a67760a28ebdb8637cd7bdfdbec3f0d996ef777b3
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
2.8MB
-
Filesize
236KB
-
Filesize
168KB
-
Filesize
200KB
-
Filesize
200KB
-
Filesize
236KB