Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30-11-2024 03:44
Static task
static1
Behavioral task
behavioral1
Sample
c730fc432e44173d4038f4df061092cc4bff06d9588a2742138cbd534c148230.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
c730fc432e44173d4038f4df061092cc4bff06d9588a2742138cbd534c148230.dll
Resource
win10v2004-20241007-en
General
-
Target
c730fc432e44173d4038f4df061092cc4bff06d9588a2742138cbd534c148230.dll
-
Size
192KB
-
MD5
850802ceba1bbb55fb50cea635402cb9
-
SHA1
8bfc680da3553746d4ccc287cf9630b305543948
-
SHA256
c730fc432e44173d4038f4df061092cc4bff06d9588a2742138cbd534c148230
-
SHA512
937dc7aa3f540f50882f3789318b22017ea1777d2dff7753b61f6778fabc1155d415254cdbc87832f14b72644a4909f6145df8b24cbc7f39fc3c3224cf7fb9ff
-
SSDEEP
3072:IPpYUtQdNfgBVP82nl+ypWPuBRLM1jQaVL3lPUD/yjVvOSiO0:Ayg3EYUUOC/qvOSiO
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatalrat family
-
Fatal Rat payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2608-0-0x0000000000EE0000-0x0000000000F08000-memory.dmp fatalrat -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
rundll32.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
rundll32.exedescription pid Process Token: SeDebugPrivilege 2608 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid Process procid_target PID 1036 wrote to memory of 2608 1036 rundll32.exe 84 PID 1036 wrote to memory of 2608 1036 rundll32.exe 84 PID 1036 wrote to memory of 2608 1036 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c730fc432e44173d4038f4df061092cc4bff06d9588a2742138cbd534c148230.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c730fc432e44173d4038f4df061092cc4bff06d9588a2742138cbd534c148230.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2608
-