fatalrat | 76a65ecfc54d6ef74020e0b9ab497a3abf7e1709c40cc071535cd4bae3c82783

Analysis

max time kernel
149s
max time network
146s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
24-10-2024 07:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

名单助手PDF.exe
Size

6.1MB
MD5

f24efc53f425d85f86e7d4e2000dbc2a
SHA1

3d29c3ea01714fe3f757c104f44281e2335d278b
SHA256

d2caeb6d90e3240fd087e2180e28219651dc9f6c5ee7c2f18bd59e5b98dcfd6f
SHA512

ad88e648c3124fc379784887e7d6cbb3576eb9bae9cc8400c9d1ed7b093c1c8c691bd98f9a43f8a6a8cd33db403888f4106fef70697b90a8670227fd334a1813
SSDEEP

98304:4YYX5YQmdT8PRv0J0hx09BSpKki9jBGrisYdMLU9V09DsL2qEKqjb:niby94pFKjBGr97eL

Score

10^/10

fatalrat discovery infostealer rat

Malware Config

Signatures

FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
infostealer rat fatalrat

Fatal Rat payload 2 IoCs

rat infostealer

resource	yara_rule
behavioral5/memory/1744-64-0x0000000001D60000-0x0000000001D8A000-memory.dmp	fatalrat
behavioral5/memory/1744-69-0x0000000001CE0000-0x0000000001D12000-memory.dmp	fatalrat

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
1744	3M6M5MF.exe

Loads dropped DLL 1 IoCs

pid	Process
1744	3M6M5MF.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\3M6M5MF.exe	3M6M5MF.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3M6M5MF.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	3M6M5MF.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	3M6M5MF.exe

Suspicious behavior: EnumeratesProcesses 53 IoCs

pid	Process
800	名单助手PDF.exe
800	名单助手PDF.exe
1744	3M6M5MF.exe
1744	3M6M5MF.exe
1744	3M6M5MF.exe
1744	3M6M5MF.exe
1744	3M6M5MF.exe
1744	3M6M5MF.exe
1744	3M6M5MF.exe
1744	3M6M5MF.exe
1744	3M6M5MF.exe
1744	3M6M5MF.exe
1744	3M6M5MF.exe
1744	3M6M5MF.exe
1744	3M6M5MF.exe
1744	3M6M5MF.exe
1744	3M6M5MF.exe
1744	3M6M5MF.exe
1744	3M6M5MF.exe
1744	3M6M5MF.exe
1744	3M6M5MF.exe
1744	3M6M5MF.exe
1744	3M6M5MF.exe
1744	3M6M5MF.exe
1744	3M6M5MF.exe
1744	3M6M5MF.exe
1744	3M6M5MF.exe
1744	3M6M5MF.exe
1744	3M6M5MF.exe
1744	3M6M5MF.exe
1744	3M6M5MF.exe
1744	3M6M5MF.exe
1744	3M6M5MF.exe
1744	3M6M5MF.exe
1744	3M6M5MF.exe
1744	3M6M5MF.exe
1744	3M6M5MF.exe
1744	3M6M5MF.exe
1744	3M6M5MF.exe
1744	3M6M5MF.exe
1744	3M6M5MF.exe
1744	3M6M5MF.exe
1744	3M6M5MF.exe
1744	3M6M5MF.exe
1744	3M6M5MF.exe
1744	3M6M5MF.exe
1744	3M6M5MF.exe
1744	3M6M5MF.exe
1744	3M6M5MF.exe
1744	3M6M5MF.exe
1744	3M6M5MF.exe
1744	3M6M5MF.exe
1744	3M6M5MF.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1744	3M6M5MF.exe
Token: SeDebugPrivilege	1744	3M6M5MF.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 1744	2428	taskeng.exe	34
PID 2428 wrote to memory of 1744	2428	taskeng.exe	34
PID 2428 wrote to memory of 1744	2428	taskeng.exe	34
PID 2428 wrote to memory of 1744	2428	taskeng.exe	34

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\名单助手PDF.exe
"C:\Users\Admin\AppData\Local\Temp\名单助手PDF.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:800

C:\Windows\system32\taskeng.exe
taskeng.exe {4F3FC921-7C08-49F5-AA65-6DF470D1776E} S-1-5-21-1163522206-1469769407-485553996-1000:PJCSDMRP\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2428
- C:\ProgramData\T9TCTC\3M6M5MF.exe
  C:\ProgramData\T9TCTC\3M6M5MF.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\T9TCTC\3M6M5MF.exe

Filesize
233KB

MD5
4f9c6e1a88e9a25dff08db5c05b07a15

SHA1
c6375b4ac7fa362064e4eeba9442c12b9bfb7238

SHA256
9714e568328990ce76669b10573032c34b8617d6c292dafbf509bb59de9d86bc

SHA512
3c0faac411137c73fa5e1dffd2c696ced0ccc221b9974fed3bd158b7b6bf4e002162c4f0d4f41105483eb16c6220e20fe48a65adf8f6278882d0d0ff0727726b

Download Submit
C:\ProgramData\T9TCTC\PBVM90.dll

Filesize
2.2MB

MD5
6763be58feb53c3b430c94277b99adcb

SHA1
94008b6cd06888df63542969f3b1007a85d2fa1b

SHA256
c072f5f0e28cbc8cb347a7736371b57d6a9192667122fbb83fd4f436529f96ef

SHA512
4aa0814c5f296adf7dfdc8bb7879b447d6d404e3fe54af5293bfe6db55d1329bb87ccee6bc415b310f9e49e32f789fe3549d6a99045cd036362a8a4f2945c1a1

Download Submit
C:\ProgramData\T9TCTC\longlq.cl

Filesize
1.2MB

MD5
eab35abc0ae31018b3f0c64fb93b785b

SHA1
be2468ea6292889e8c58306aacbc875147e29a00

SHA256
5b8e39728ad4b2ec68d5b3e0af4dfa914a26812bbdca20198d3fe0d40397126a

SHA512
c1555252c93c314a8d26ef018afcb54937abc0b5e755fbc3d6a3bcda7ec796fddca48ffb215cdcb1a92edb2361122d273b1c40987cd2f4c2fe754a2be8f6ae06

Download Submit
C:\Users\Admin\AppData\Roaming\0J3J3\2L2L.exe

Filesize
142KB

MD5
bbaea75e78b80434b7cd699749b93a97

SHA1
c7d151758cb88dee39dbb5f4cd30e7d226980dde

SHA256
c9a1c52f5f5c8deef76b8e989c6a377f00061fa369cbd1cee7f53f8f03295f5c

SHA512
7f41846d61452c73566554ba5f6ef356e757ff4c292ad68bbcc1b84f736c02c6b0bc52e13270e5d7be4cde743d40cfc281028d4a0e322fbeecd9b786d08bac3d

Download Submit
C:\Users\Admin\AppData\Roaming\0J3J3\Microsoft\Windows\Start Menu\Programs\startup\website_secure_lnk.lnk

Filesize
756B

MD5
97d388cb0a9c8695d9e6bc6c21d2b52a

SHA1
255f5e66d5bc94e21683b20e22af0b26d8b00096

SHA256
15cff19f986b46fafd7e6de8751e580673c6cec8040b13dbc1485c1c0dc23f42

SHA512
654118ca5944ccf206e2dce09308cbe4355e77d93c8152f57c7f4bfc583e542c28d740185095e4c0f9f0dbf3f7842b6fd7be12944819bad438d0fc9b6d4b5303

Download Submit
C:\Users\Public\9SCSCS

Filesize
1.1MB

MD5
9bfaab258ac336e40145a0e98c4d0639

SHA1
1bbab07dddf56f3fd43c1c61d38b11dd121795c6

SHA256
53a844c36f87b391260bfca420e9cdb46770e42a4b2a4ad4be925ad381830eb7

SHA512
5adc1903d385943fa999aa1541ee101ca0d38d9bb602c4a36e690f9099eb3b3df99b2d65c4f97f3abfcd8f8a5767d1493b59b88f9b68dc8c09205b380e782c19

Download Submit
memory/800-55-0x00000000040A0000-0x000000000436D000-memory.dmp

Filesize
2.8MB

Download
memory/800-3-0x00000000020C0000-0x00000000026A9000-memory.dmp

Filesize
5.9MB

Download
memory/800-0-0x00000000020C0000-0x00000000026A9000-memory.dmp

Filesize
5.9MB

Download
memory/800-1-0x00000000040A0000-0x000000000436D000-memory.dmp

Filesize
2.8MB

Download
memory/800-77-0x00000000020C0000-0x00000000026A9000-memory.dmp

Filesize
5.9MB

Download
memory/800-78-0x00000000040A0000-0x000000000436D000-memory.dmp

Filesize
2.8MB

Download
memory/1744-63-0x0000000001D20000-0x0000000001D5B000-memory.dmp

Filesize
236KB

Download
memory/1744-62-0x0000000001CE0000-0x0000000001D12000-memory.dmp

Filesize
200KB

Download
memory/1744-64-0x0000000001D60000-0x0000000001D8A000-memory.dmp

Filesize
168KB

Download
memory/1744-69-0x0000000001CE0000-0x0000000001D12000-memory.dmp

Filesize
200KB

Download
memory/1744-70-0x0000000001D20000-0x0000000001D5B000-memory.dmp

Filesize
236KB

Download