Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
31-12-2024 05:44
Behavioral task
behavioral1
Sample
2419c9055084e8afb8fd6e55ce30a35d6a4085a01c3feee2d38406564946cf4e.exe
Resource
win7-20241010-en
General
-
Target
2419c9055084e8afb8fd6e55ce30a35d6a4085a01c3feee2d38406564946cf4e.exe
-
Size
246KB
-
MD5
0886ff81f6c22255df038271f0ce3ef8
-
SHA1
c689bfa64579811e4eed0c0517b64cce16451259
-
SHA256
2419c9055084e8afb8fd6e55ce30a35d6a4085a01c3feee2d38406564946cf4e
-
SHA512
b4d75df3b25a82748479f959e66cc8d27efaf0b9abfe1fed398b37cd7e74232ea907bb22c8d7d29bb37debf65901f40530c1be1f5a32220a4f9334697d527798
-
SSDEEP
3072:2AUpC6wm9ITYGZ8HED96BKb4QDzTPJc5XLMedtjKZlfED9yETXZTSU98ohblrAFD:2Hg61yTt+TKpLBctLMhbcrD9zxAFhG
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 4 IoCs
resource yara_rule behavioral2/memory/324-1-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/324-2-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/324-14-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/324-36-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon -
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatalrat family
-
Fatal Rat payload 1 IoCs
resource yara_rule behavioral2/memory/2456-30-0x0000000010000000-0x000000001002D000-memory.dmp fatalrat -
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
pid Process 4500 spower.exe 2456 svchost.exe -
resource yara_rule behavioral2/files/0x000a000000023ba8-16.dat vmprotect behavioral2/memory/4500-20-0x00007FF6AC390000-0x00007FF6AC93C000-memory.dmp vmprotect -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2419c9055084e8afb8fd6e55ce30a35d6a4085a01c3feee2d38406564946cf4e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SCHTASKS.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3992 SCHTASKS.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 324 2419c9055084e8afb8fd6e55ce30a35d6a4085a01c3feee2d38406564946cf4e.exe 324 2419c9055084e8afb8fd6e55ce30a35d6a4085a01c3feee2d38406564946cf4e.exe 324 2419c9055084e8afb8fd6e55ce30a35d6a4085a01c3feee2d38406564946cf4e.exe 324 2419c9055084e8afb8fd6e55ce30a35d6a4085a01c3feee2d38406564946cf4e.exe 324 2419c9055084e8afb8fd6e55ce30a35d6a4085a01c3feee2d38406564946cf4e.exe 324 2419c9055084e8afb8fd6e55ce30a35d6a4085a01c3feee2d38406564946cf4e.exe 4500 spower.exe 4500 spower.exe 4500 spower.exe 4500 spower.exe 324 2419c9055084e8afb8fd6e55ce30a35d6a4085a01c3feee2d38406564946cf4e.exe 324 2419c9055084e8afb8fd6e55ce30a35d6a4085a01c3feee2d38406564946cf4e.exe 324 2419c9055084e8afb8fd6e55ce30a35d6a4085a01c3feee2d38406564946cf4e.exe 324 2419c9055084e8afb8fd6e55ce30a35d6a4085a01c3feee2d38406564946cf4e.exe 324 2419c9055084e8afb8fd6e55ce30a35d6a4085a01c3feee2d38406564946cf4e.exe 324 2419c9055084e8afb8fd6e55ce30a35d6a4085a01c3feee2d38406564946cf4e.exe 2456 svchost.exe 2456 svchost.exe 2456 svchost.exe 2456 svchost.exe 2456 svchost.exe 2456 svchost.exe 2456 svchost.exe 2456 svchost.exe 2456 svchost.exe 2456 svchost.exe 2456 svchost.exe 2456 svchost.exe 2456 svchost.exe 2456 svchost.exe 2456 svchost.exe 2456 svchost.exe 2456 svchost.exe 2456 svchost.exe 2456 svchost.exe 2456 svchost.exe 2456 svchost.exe 2456 svchost.exe 2456 svchost.exe 2456 svchost.exe 2456 svchost.exe 2456 svchost.exe 2456 svchost.exe 2456 svchost.exe 2456 svchost.exe 2456 svchost.exe 2456 svchost.exe 2456 svchost.exe 2456 svchost.exe 2456 svchost.exe 2456 svchost.exe 2456 svchost.exe 2456 svchost.exe 2456 svchost.exe 2456 svchost.exe 2456 svchost.exe 2456 svchost.exe 2456 svchost.exe 2456 svchost.exe 2456 svchost.exe 2456 svchost.exe 2456 svchost.exe 2456 svchost.exe 2456 svchost.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4500 spower.exe Token: SeDebugPrivilege 2456 svchost.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 324 wrote to memory of 4500 324 2419c9055084e8afb8fd6e55ce30a35d6a4085a01c3feee2d38406564946cf4e.exe 86 PID 324 wrote to memory of 4500 324 2419c9055084e8afb8fd6e55ce30a35d6a4085a01c3feee2d38406564946cf4e.exe 86 PID 4500 wrote to memory of 792 4500 spower.exe 8 PID 4500 wrote to memory of 792 4500 spower.exe 8 PID 4500 wrote to memory of 792 4500 spower.exe 8 PID 324 wrote to memory of 2456 324 2419c9055084e8afb8fd6e55ce30a35d6a4085a01c3feee2d38406564946cf4e.exe 90 PID 324 wrote to memory of 2456 324 2419c9055084e8afb8fd6e55ce30a35d6a4085a01c3feee2d38406564946cf4e.exe 90 PID 324 wrote to memory of 2456 324 2419c9055084e8afb8fd6e55ce30a35d6a4085a01c3feee2d38406564946cf4e.exe 90 PID 324 wrote to memory of 3992 324 2419c9055084e8afb8fd6e55ce30a35d6a4085a01c3feee2d38406564946cf4e.exe 91 PID 324 wrote to memory of 3992 324 2419c9055084e8afb8fd6e55ce30a35d6a4085a01c3feee2d38406564946cf4e.exe 91 PID 324 wrote to memory of 3992 324 2419c9055084e8afb8fd6e55ce30a35d6a4085a01c3feee2d38406564946cf4e.exe 91
Processes
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p1⤵PID:792
-
C:\Users\Admin\AppData\Local\Temp\2419c9055084e8afb8fd6e55ce30a35d6a4085a01c3feee2d38406564946cf4e.exe"C:\Users\Admin\AppData\Local\Temp\2419c9055084e8afb8fd6e55ce30a35d6a4085a01c3feee2d38406564946cf4e.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:324 -
C:\Users\Admin\AppData\Local\Temp\nqxpqhl2nfz3t0x\spower.exeC:\Users\Admin\AppData\Local\Temp\nqxpqhl2nfz3t0x\spower.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4500
-
-
C:\ProgramData\NVIDIARV\svchost.exeC:\ProgramData\NVIDIARV\svchost.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2456
-
-
C:\Windows\SysWOW64\SCHTASKS.exeSCHTASKS /Create /SC ONLOGON /TN WindowsUpdata /F /RL HIGHEST /TR C:\Users\Public\Picturesnqxpqhl2\CCCef3Render.exe2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3992
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.4MB
MD5c42379ca208a33e2496ea4f5da6c9f24
SHA1f0dc893080344a1873f84ee7221d5aa08a480e4a
SHA2563106d03a8d2451396f2d799001e87d4f5393d58028f142c763356e20be9fbaf4
SHA51273e5beb73a3ee9ca82cbe740d9ed84c7a03d3f0fb3b707273f7e93c22a09e1a0ac6ff9e353651c906dd608faff09c0c395eda4c7a213a15d164f1024b4580186
-
Filesize
2.7MB
MD5ac30909929056007eaf0fbcf53c3a21f
SHA17046d48c84748b246ebaa1c0153e8f81d3b0acc1
SHA256f11baf3657a9bbfeb5d140a37d456573f589212447446a1519033ad010b9f58f
SHA51271a40652f3cdfbd33cfc539855d6cbb1fba601e83bbd4b3e4f5e397144b3abfed5d148b486aec4eec17136e063609f93beae72a5e78d12d876dd79ccd3c9c849