fatalrat | 24b31819e09dd8eaa1c26a08c1a4e7ae55063c7ebb3dbd0273968d13a4f0d0e3

Resubmissions

02-12-2024 06:58

241202-hrp13azmep 10

02-12-2024 04:09

241202-eqvclstrbk 10

Analysis

max time kernel
299s
max time network
297s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
02-12-2024 06:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

24b31819e09dd8eaa1c26a08c1a4e7ae55063c7ebb3dbd0273968d13a4f0d0e3.exe
Size

4.5MB
MD5

0b002ffd1ba0c617cfd6f25f75d8432e
SHA1

9a102e169744d9a28e575efecadc53b9d77fb751
SHA256

24b31819e09dd8eaa1c26a08c1a4e7ae55063c7ebb3dbd0273968d13a4f0d0e3
SHA512

52236ec4b8d3df89a7c60937c8d886ca05285cd77e639b731075368ef6bf80f973ae978d24123127d3785c8254f718c0556dc6b55be9355c4ac77bfb88f7172b
SSDEEP

49152:9YJMpJc32PMgJjQhGp7fOU3h1hyiTrMIx7Rtpb68N54+97boAXuE+OPnmr7DvjZd:9Og51Mgr/txTbV7+6W

Score

10^/10

fatalrat discovery infostealer rat

Malware Config

Signatures

FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
infostealer rat fatalrat
Fatalrat family
fatalrat

Fatal Rat payload 1 IoCs

rat infostealer

Processes:

resource	yara_rule
behavioral1/memory/2300-38-0x0000000002800000-0x000000000282A000-memory.dmp	fatalrat

Drops startup file 2 IoCs

Processes:

WTpZXx.exe

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Macromedia-Packages.lnk	WTpZXx.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Macromedia-Packages.lnk	WTpZXx.exe

Executes dropped EXE 2 IoCs

Processes:

WTpZXx.exeWTpZXx.exe

pid	Process
2668	WTpZXx.exe
2300	WTpZXx.exe

Loads dropped DLL 1 IoCs

Processes:

WTpZXx.exe

pid	Process
2300	WTpZXx.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

WTpZXx.exeWTpZXx.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WTpZXx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WTpZXx.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WTpZXx.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	WTpZXx.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WTpZXx.exe

Modifies data under HKEY_USERS 10 IoCs

Processes:

cmd.exe

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\SlowContextMenuEntries = 6024b221ea3a6910a2dc08002b30309d6d0000000114020000000000c0000000000000467d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	cmd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	cmd.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	cmd.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	cmd.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	cmd.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	cmd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	cmd.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{00021401-0000-0000-C000-000000000046} {000214E4-0000-0000-C000-000000000046} 0xFFFF = 01000000000000006fe9cda48744db01	cmd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	cmd.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\SlowContextMenuEntries = 6024b221ea3a6910a2dc08002b30309d6d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

24b31819e09dd8eaa1c26a08c1a4e7ae55063c7ebb3dbd0273968d13a4f0d0e3.exeWTpZXx.exe

pid	Process
2308	24b31819e09dd8eaa1c26a08c1a4e7ae55063c7ebb3dbd0273968d13a4f0d0e3.exe
2308	24b31819e09dd8eaa1c26a08c1a4e7ae55063c7ebb3dbd0273968d13a4f0d0e3.exe
2308	24b31819e09dd8eaa1c26a08c1a4e7ae55063c7ebb3dbd0273968d13a4f0d0e3.exe
2308	24b31819e09dd8eaa1c26a08c1a4e7ae55063c7ebb3dbd0273968d13a4f0d0e3.exe
2308	24b31819e09dd8eaa1c26a08c1a4e7ae55063c7ebb3dbd0273968d13a4f0d0e3.exe
2308	24b31819e09dd8eaa1c26a08c1a4e7ae55063c7ebb3dbd0273968d13a4f0d0e3.exe
2300	WTpZXx.exe
2300	WTpZXx.exe
2300	WTpZXx.exe
2300	WTpZXx.exe
2300	WTpZXx.exe
2300	WTpZXx.exe
2300	WTpZXx.exe
2300	WTpZXx.exe
2300	WTpZXx.exe
2300	WTpZXx.exe
2300	WTpZXx.exe
2300	WTpZXx.exe
2300	WTpZXx.exe
2300	WTpZXx.exe
2300	WTpZXx.exe
2300	WTpZXx.exe
2300	WTpZXx.exe
2300	WTpZXx.exe
2300	WTpZXx.exe
2300	WTpZXx.exe
2300	WTpZXx.exe
2300	WTpZXx.exe
2300	WTpZXx.exe
2300	WTpZXx.exe
2300	WTpZXx.exe
2300	WTpZXx.exe
2300	WTpZXx.exe
2300	WTpZXx.exe
2300	WTpZXx.exe
2300	WTpZXx.exe
2300	WTpZXx.exe
2300	WTpZXx.exe
2300	WTpZXx.exe
2300	WTpZXx.exe
2300	WTpZXx.exe
2300	WTpZXx.exe
2300	WTpZXx.exe
2300	WTpZXx.exe
2300	WTpZXx.exe
2300	WTpZXx.exe
2300	WTpZXx.exe
2300	WTpZXx.exe
2300	WTpZXx.exe
2300	WTpZXx.exe
2300	WTpZXx.exe
2300	WTpZXx.exe
2300	WTpZXx.exe
2300	WTpZXx.exe
2300	WTpZXx.exe
2300	WTpZXx.exe
2300	WTpZXx.exe
2300	WTpZXx.exe
2300	WTpZXx.exe
2300	WTpZXx.exe
2300	WTpZXx.exe
2300	WTpZXx.exe
2300	WTpZXx.exe
2300	WTpZXx.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

WTpZXx.exe

description	pid	Process
Token: SeDebugPrivilege	2300	WTpZXx.exe
Token: SeDebugPrivilege	2300	WTpZXx.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

wordpad.exeWTpZXx.exe

pid	Process
1368	wordpad.exe
1368	wordpad.exe
1368	wordpad.exe
1368	wordpad.exe
1368	wordpad.exe
2300	WTpZXx.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

24b31819e09dd8eaa1c26a08c1a4e7ae55063c7ebb3dbd0273968d13a4f0d0e3.exewrite.execmd.execmd.exe

description	pid	Process	procid_target
PID 2308 wrote to memory of 2556	2308	24b31819e09dd8eaa1c26a08c1a4e7ae55063c7ebb3dbd0273968d13a4f0d0e3.exe	88
PID 2308 wrote to memory of 2556	2308	24b31819e09dd8eaa1c26a08c1a4e7ae55063c7ebb3dbd0273968d13a4f0d0e3.exe	88
PID 2556 wrote to memory of 1368	2556	write.exe	90
PID 2556 wrote to memory of 1368	2556	write.exe	90
PID 5096 wrote to memory of 2668	5096	cmd.exe	91
PID 5096 wrote to memory of 2668	5096	cmd.exe	91
PID 5096 wrote to memory of 2668	5096	cmd.exe	91
PID 2308 wrote to memory of 2256	2308	24b31819e09dd8eaa1c26a08c1a4e7ae55063c7ebb3dbd0273968d13a4f0d0e3.exe	96
PID 2308 wrote to memory of 2256	2308	24b31819e09dd8eaa1c26a08c1a4e7ae55063c7ebb3dbd0273968d13a4f0d0e3.exe	96
PID 2256 wrote to memory of 2300	2256	cmd.exe	97
PID 2256 wrote to memory of 2300	2256	cmd.exe	97
PID 2256 wrote to memory of 2300	2256	cmd.exe	97

C:\Users\Admin\AppData\Local\Temp\24b31819e09dd8eaa1c26a08c1a4e7ae55063c7ebb3dbd0273968d13a4f0d0e3.exe
"C:\Users\Admin\AppData\Local\Temp\24b31819e09dd8eaa1c26a08c1a4e7ae55063c7ebb3dbd0273968d13a4f0d0e3.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Windows\System32\write.exe
  "C:\Windows\System32\write.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2556
- - C:\Program Files\Windows NT\Accessories\wordpad.exe
    "C:\Program Files\Windows NT\Accessories\wordpad.exe"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:1368
- C:\Windows\System32\cmd.exe
  cmd /c start "" "C:\ProgramData\WTpZXx\WTpZXx.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2256
- - C:\ProgramData\WTpZXx\WTpZXx.exe
    "C:\ProgramData\WTpZXx\WTpZXx.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2300

C:\Windows\system32\cmd.exe
cmd /c start C:\Users\Admin\Desktop\WTpZ.lnk
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:5096
- C:\Users\Admin\AppData\Roaming\WTpZXx.exe
  "C:\Users\Admin\AppData\Roaming\WTpZXx.exe" -n C:\Users\Admin\AppData\Roaming\WTpZX.zip -d C:\Users\Admin\AppData\Roaming
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:4784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\WTpZXx\VEDecoder.dll

Filesize
1.6MB

MD5
d6a3fed112ab4e6bfe32cbe220dc225d

SHA1
bb9190ee490c46959e2bc192009f7773222dfa12

SHA256
8d89d4282f514acf2d7ef3ff7a618bbd513a84538ad309f2a48bff77c202bd58

SHA512
043b866e32db62bf8deb4ad9aa896b8274813cf1e6e4e575a3afc595893b5e5265a0430f6a1010c80db955114a0f9d9c3f4e0b3ee47b3323fb2bbcda5b6b7f61

Download Submit
C:\ProgramData\WTpZXx\WTpZXx.exe

Filesize
508KB

MD5
a79a2e0b7f299ab2f80ee8315679baee

SHA1
43d76adbcc19e4c8b60ffba419797a22b756e927

SHA256
0a804e7efe38d6eba358781597205519b936239e9daebcdf2f71c62c6a416f5c

SHA512
f246044eb82e2d4562081b0041ba2109cbda385b335b3bf10d3408acda6ae0c605ab1a522a7f5f363dfd6417e6825ff7d2831d42b8e4440d012fdf33ec605649

Download Submit
C:\ProgramData\WTpZXx\longlq.cl

Filesize
1.2MB

MD5
6652b3a6e7290de3f12a5f94b9b72b8c

SHA1
4702a4305f14c8437787343de339fa4f0a4b4d75

SHA256
946d9c70c3ae9d8b22530a844547494c60668a6a3b0cf4e25f84f03a0781743e

SHA512
38950c74297de0820ba606680ad74252dc0f8a4c9d46bdb73b903da55ab7b243a4ae7fa6812f026d2b4ec47b8000454e944be587cb788d592ab30d3848b77d34

Download Submit
C:\Users\Admin\AppData\Roaming\WTpZX.zip

Filesize
653B

MD5
0f6c8690b0b31e8377eef649a67b5919

SHA1
4dababb21c6517b82c2c86a8d43f4d7fa742443c

SHA256
4f608080015ef94665ab6a9c2653c91baf5eb8ca1d028ba0c9306dbe3b654090

SHA512
d168692a53958e47455b039614e9b87c6d12aa7323ea09fc01abb5c4508ed79eac7818678e09b28b18975cb9a98781834b01477e0ade59782f2a7a9c19af86da

Download Submit
C:\Users\Admin\AppData\Roaming\WTpZXx.exe

Filesize
105KB

MD5
6b8ebc942fe392c669b0b21bc8f83a03

SHA1
18fb9645a7365ae17b8386e47bec0b5ba6f5122f

SHA256
e5a35deff01c93f658ab8c4192570ad9ae5ffaa4f5f6d1b4db99f176bf5bdbe7

SHA512
0953d528c5d07b22fa0a969c98d569cf68e58450e1fc0179ddb2068cb4c429d23044a71005fd0daebe7e0c896c5a7598c5329e4c040be9099dfb1e62a2686589

Download Submit
C:\Users\Admin\Desktop\WTpZ.lnk

Filesize
948B

MD5
73f238907eac9b1a9ac6ec8faa19a960

SHA1
37c9ee3d8c3134634de065580e78434aaedbb0e6

SHA256
f17cfcafa14df8d9bba535299469321a2a0bae7145616b6a0b64fb2eda9067dc

SHA512
f659470f0cd93e6e88a4b73081b9aa61fef5ec302edcf025fba7c547363d37438dcc25d7cef49cc60811532d7db55fc23c00dbaa0d8ce6144ea2b966a7e83822

Download Submit
C:\Users\Admin\Desktop\WTpZ.lnk

Filesize
1KB

MD5
9a15dd1f4c5c483a1490520d7dc7533c

SHA1
4eb74eb7b6084f6118a5ca9184eeb8bae5739411

SHA256
a965037a08b7a9e3c3fb79edfc7e6b8b9f02a0357547a011fdc96cd44b240b72

SHA512
a6f35a55b50589aa92cd4307de19fba7c821c9b5643d041c05cc7fa641cec906f64a2f023f13a4c0c7a80d604aa6137bae70418c8b2a59923fc03dbdedf9e05b

Download Submit
memory/2300-38-0x0000000002800000-0x000000000282A000-memory.dmp

Filesize
168KB

Download
memory/2308-0-0x00000000024B0000-0x0000000002896000-memory.dmp

Filesize
3.9MB

Download
memory/2308-37-0x0000000000400000-0x0000000000890000-memory.dmp

Filesize
4.6MB

Download
memory/2308-43-0x00000000024B0000-0x0000000002896000-memory.dmp

Filesize
3.9MB

Download
memory/2668-23-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download