fatalrat | 970d11840a9afac9c17131613d391da0f82c71cec0f119d62504754292e4a0d3

Analysis

max time kernel
147s
max time network
129s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
17-02-2025 13:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

970d11840a9afac9c17131613d391da0f82c71cec0f119d62504754292e4a0d3.exe
Size

892KB
MD5

7a96cacfa36023763cd276819c1be778
SHA1

2c087b1688bcaffba3426de47a0c0015a6b4d070
SHA256

970d11840a9afac9c17131613d391da0f82c71cec0f119d62504754292e4a0d3
SHA512

27a1f43bb68d353fdd4a9f815a53357d9001dd408be01043c211483ed5839621b31ec57719b18c070011100c541b22508127714af763ef7af7d763d2ac15f7a7
SSDEEP

24576:tZe29SCZcl/upox/R5zGjedEu8j8KDTbKAkw:tBZcl/uu/RIjedEu83fbAw

Score

10^/10

fatalrat discovery infostealer rat stealer trojan

Malware Config

Signatures

FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
stealer trojan fatalrat
Fatalrat family
fatalrat

Fatal Rat payload 3 IoCs

rat infostealer

resource	yara_rule
behavioral1/memory/524-16507-0x0000000000400000-0x00000000004FB000-memory.dmp	fatalrat
behavioral1/memory/8168-25214-0x0000000000400000-0x00000000004FB000-memory.dmp	fatalrat
behavioral1/memory/4952-25221-0x0000000000400000-0x00000000004FB000-memory.dmp	fatalrat

Executes dropped EXE 2 IoCs

pid	Process
8168	admin.exe
4952	970d11840a9afac9c17131613d391da0f82c71cec0f119d62504754292e4a0d3.exe

Loads dropped DLL 2 IoCs

pid	Process
524	970d11840a9afac9c17131613d391da0f82c71cec0f119d62504754292e4a0d3.exe
524	970d11840a9afac9c17131613d391da0f82c71cec0f119d62504754292e4a0d3.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 60 IoCs

pid	Process
524	970d11840a9afac9c17131613d391da0f82c71cec0f119d62504754292e4a0d3.exe
524	970d11840a9afac9c17131613d391da0f82c71cec0f119d62504754292e4a0d3.exe
524	970d11840a9afac9c17131613d391da0f82c71cec0f119d62504754292e4a0d3.exe
524	970d11840a9afac9c17131613d391da0f82c71cec0f119d62504754292e4a0d3.exe
8168	admin.exe
8168	admin.exe
524	970d11840a9afac9c17131613d391da0f82c71cec0f119d62504754292e4a0d3.exe
8168	admin.exe
524	970d11840a9afac9c17131613d391da0f82c71cec0f119d62504754292e4a0d3.exe
8168	admin.exe
524	970d11840a9afac9c17131613d391da0f82c71cec0f119d62504754292e4a0d3.exe
8168	admin.exe
524	970d11840a9afac9c17131613d391da0f82c71cec0f119d62504754292e4a0d3.exe
8168	admin.exe
8168	admin.exe
8168	admin.exe
4952	970d11840a9afac9c17131613d391da0f82c71cec0f119d62504754292e4a0d3.exe
4952	970d11840a9afac9c17131613d391da0f82c71cec0f119d62504754292e4a0d3.exe
8168	admin.exe
4952	970d11840a9afac9c17131613d391da0f82c71cec0f119d62504754292e4a0d3.exe
8168	admin.exe
4952	970d11840a9afac9c17131613d391da0f82c71cec0f119d62504754292e4a0d3.exe
8168	admin.exe
4952	970d11840a9afac9c17131613d391da0f82c71cec0f119d62504754292e4a0d3.exe
8168	admin.exe
4952	970d11840a9afac9c17131613d391da0f82c71cec0f119d62504754292e4a0d3.exe
8168	admin.exe
4952	970d11840a9afac9c17131613d391da0f82c71cec0f119d62504754292e4a0d3.exe
8168	admin.exe
4952	970d11840a9afac9c17131613d391da0f82c71cec0f119d62504754292e4a0d3.exe
8168	admin.exe
4952	970d11840a9afac9c17131613d391da0f82c71cec0f119d62504754292e4a0d3.exe
8168	admin.exe
4952	970d11840a9afac9c17131613d391da0f82c71cec0f119d62504754292e4a0d3.exe
8168	admin.exe
4952	970d11840a9afac9c17131613d391da0f82c71cec0f119d62504754292e4a0d3.exe
8168	admin.exe
4952	970d11840a9afac9c17131613d391da0f82c71cec0f119d62504754292e4a0d3.exe
8168	admin.exe
4952	970d11840a9afac9c17131613d391da0f82c71cec0f119d62504754292e4a0d3.exe
8168	admin.exe
4952	970d11840a9afac9c17131613d391da0f82c71cec0f119d62504754292e4a0d3.exe
8168	admin.exe
4952	970d11840a9afac9c17131613d391da0f82c71cec0f119d62504754292e4a0d3.exe
8168	admin.exe
4952	970d11840a9afac9c17131613d391da0f82c71cec0f119d62504754292e4a0d3.exe
8168	admin.exe
4952	970d11840a9afac9c17131613d391da0f82c71cec0f119d62504754292e4a0d3.exe
8168	admin.exe
4952	970d11840a9afac9c17131613d391da0f82c71cec0f119d62504754292e4a0d3.exe
8168	admin.exe
4952	970d11840a9afac9c17131613d391da0f82c71cec0f119d62504754292e4a0d3.exe
8168	admin.exe
4952	970d11840a9afac9c17131613d391da0f82c71cec0f119d62504754292e4a0d3.exe
8168	admin.exe
4952	970d11840a9afac9c17131613d391da0f82c71cec0f119d62504754292e4a0d3.exe
8168	admin.exe
4952	970d11840a9afac9c17131613d391da0f82c71cec0f119d62504754292e4a0d3.exe
8168	admin.exe
4952	970d11840a9afac9c17131613d391da0f82c71cec0f119d62504754292e4a0d3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	970d11840a9afac9c17131613d391da0f82c71cec0f119d62504754292e4a0d3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	970d11840a9afac9c17131613d391da0f82c71cec0f119d62504754292e4a0d3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	admin.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	970d11840a9afac9c17131613d391da0f82c71cec0f119d62504754292e4a0d3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	admin.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	admin.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	970d11840a9afac9c17131613d391da0f82c71cec0f119d62504754292e4a0d3.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
524	970d11840a9afac9c17131613d391da0f82c71cec0f119d62504754292e4a0d3.exe
8168	admin.exe
8168	admin.exe
8168	admin.exe
8168	admin.exe
8168	admin.exe
8168	admin.exe
8168	admin.exe
8168	admin.exe
8168	admin.exe
8168	admin.exe
8168	admin.exe
8168	admin.exe
8168	admin.exe
8168	admin.exe
8168	admin.exe
8168	admin.exe
8168	admin.exe
8168	admin.exe
8168	admin.exe
8168	admin.exe
8168	admin.exe
8168	admin.exe
8168	admin.exe
8168	admin.exe
8168	admin.exe
8168	admin.exe
8168	admin.exe
8168	admin.exe
8168	admin.exe
8168	admin.exe
8168	admin.exe
8168	admin.exe
8168	admin.exe
8168	admin.exe
8168	admin.exe
8168	admin.exe
8168	admin.exe
8168	admin.exe
8168	admin.exe
8168	admin.exe
8168	admin.exe
8168	admin.exe
8168	admin.exe
8168	admin.exe
8168	admin.exe
8168	admin.exe
8168	admin.exe
8168	admin.exe
8168	admin.exe
8168	admin.exe
8168	admin.exe
8168	admin.exe
8168	admin.exe
8168	admin.exe
8168	admin.exe
4952	970d11840a9afac9c17131613d391da0f82c71cec0f119d62504754292e4a0d3.exe
4952	970d11840a9afac9c17131613d391da0f82c71cec0f119d62504754292e4a0d3.exe
4952	970d11840a9afac9c17131613d391da0f82c71cec0f119d62504754292e4a0d3.exe
4952	970d11840a9afac9c17131613d391da0f82c71cec0f119d62504754292e4a0d3.exe
4952	970d11840a9afac9c17131613d391da0f82c71cec0f119d62504754292e4a0d3.exe
4952	970d11840a9afac9c17131613d391da0f82c71cec0f119d62504754292e4a0d3.exe
4952	970d11840a9afac9c17131613d391da0f82c71cec0f119d62504754292e4a0d3.exe
4952	970d11840a9afac9c17131613d391da0f82c71cec0f119d62504754292e4a0d3.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	8168	admin.exe
Token: SeDebugPrivilege	524	970d11840a9afac9c17131613d391da0f82c71cec0f119d62504754292e4a0d3.exe
Token: SeDebugPrivilege	4952	970d11840a9afac9c17131613d391da0f82c71cec0f119d62504754292e4a0d3.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 524 wrote to memory of 8168	524	970d11840a9afac9c17131613d391da0f82c71cec0f119d62504754292e4a0d3.exe	31
PID 524 wrote to memory of 8168	524	970d11840a9afac9c17131613d391da0f82c71cec0f119d62504754292e4a0d3.exe	31
PID 524 wrote to memory of 8168	524	970d11840a9afac9c17131613d391da0f82c71cec0f119d62504754292e4a0d3.exe	31
PID 524 wrote to memory of 8168	524	970d11840a9afac9c17131613d391da0f82c71cec0f119d62504754292e4a0d3.exe	31
PID 524 wrote to memory of 4952	524	970d11840a9afac9c17131613d391da0f82c71cec0f119d62504754292e4a0d3.exe	32
PID 524 wrote to memory of 4952	524	970d11840a9afac9c17131613d391da0f82c71cec0f119d62504754292e4a0d3.exe	32
PID 524 wrote to memory of 4952	524	970d11840a9afac9c17131613d391da0f82c71cec0f119d62504754292e4a0d3.exe	32
PID 524 wrote to memory of 4952	524	970d11840a9afac9c17131613d391da0f82c71cec0f119d62504754292e4a0d3.exe	32

C:\Users\Admin\AppData\Local\Temp\970d11840a9afac9c17131613d391da0f82c71cec0f119d62504754292e4a0d3.exe
"C:\Users\Admin\AppData\Local\Temp\970d11840a9afac9c17131613d391da0f82c71cec0f119d62504754292e4a0d3.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:524
- \??\c:\admin.exe
  c://admin.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:8168
- C:\Users\Admin\AppData\Local\970d11840a9afac9c17131613d391da0f82c71cec0f119d62504754292e4a0d3.exe
  "C:\Users\Admin\AppData\Local\970d11840a9afac9c17131613d391da0f82c71cec0f119d62504754292e4a0d3.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\admin.exe

Filesize
892KB

MD5
7a96cacfa36023763cd276819c1be778

SHA1
2c087b1688bcaffba3426de47a0c0015a6b4d070

SHA256
970d11840a9afac9c17131613d391da0f82c71cec0f119d62504754292e4a0d3

SHA512
27a1f43bb68d353fdd4a9f815a53357d9001dd408be01043c211483ed5839621b31ec57719b18c070011100c541b22508127714af763ef7af7d763d2ac15f7a7

Download Submit
memory/524-518-0x00000000021D0000-0x00000000022E1000-memory.dmp

Filesize
1.1MB

Download
memory/524-1-0x0000000075730000-0x0000000075777000-memory.dmp

Filesize
284KB

Download
memory/524-503-0x00000000021D0000-0x00000000022E1000-memory.dmp

Filesize
1.1MB

Download
memory/524-538-0x00000000021D0000-0x00000000022E1000-memory.dmp

Filesize
1.1MB

Download
memory/524-550-0x00000000021D0000-0x00000000022E1000-memory.dmp

Filesize
1.1MB

Download
memory/524-548-0x00000000021D0000-0x00000000022E1000-memory.dmp

Filesize
1.1MB

Download
memory/524-520-0x00000000021D0000-0x00000000022E1000-memory.dmp

Filesize
1.1MB

Download
memory/524-544-0x00000000021D0000-0x00000000022E1000-memory.dmp

Filesize
1.1MB

Download
memory/524-542-0x00000000021D0000-0x00000000022E1000-memory.dmp

Filesize
1.1MB

Download
memory/524-540-0x00000000021D0000-0x00000000022E1000-memory.dmp

Filesize
1.1MB

Download
memory/524-536-0x00000000021D0000-0x00000000022E1000-memory.dmp

Filesize
1.1MB

Download
memory/524-534-0x00000000021D0000-0x00000000022E1000-memory.dmp

Filesize
1.1MB

Download
memory/524-532-0x00000000021D0000-0x00000000022E1000-memory.dmp

Filesize
1.1MB

Download
memory/524-530-0x00000000021D0000-0x00000000022E1000-memory.dmp

Filesize
1.1MB

Download
memory/524-528-0x00000000021D0000-0x00000000022E1000-memory.dmp

Filesize
1.1MB

Download
memory/524-526-0x00000000021D0000-0x00000000022E1000-memory.dmp

Filesize
1.1MB

Download
memory/524-524-0x00000000021D0000-0x00000000022E1000-memory.dmp

Filesize
1.1MB

Download
memory/524-516-0x00000000021D0000-0x00000000022E1000-memory.dmp

Filesize
1.1MB

Download
memory/524-546-0x00000000021D0000-0x00000000022E1000-memory.dmp

Filesize
1.1MB

Download
memory/524-504-0x00000000021D0000-0x00000000022E1000-memory.dmp

Filesize
1.1MB

Download
memory/524-523-0x00000000021D0000-0x00000000022E1000-memory.dmp

Filesize
1.1MB

Download
memory/524-514-0x00000000021D0000-0x00000000022E1000-memory.dmp

Filesize
1.1MB

Download
memory/524-512-0x00000000021D0000-0x00000000022E1000-memory.dmp

Filesize
1.1MB

Download
memory/524-510-0x00000000021D0000-0x00000000022E1000-memory.dmp

Filesize
1.1MB

Download
memory/524-508-0x00000000021D0000-0x00000000022E1000-memory.dmp

Filesize
1.1MB

Download
memory/524-506-0x00000000021D0000-0x00000000022E1000-memory.dmp

Filesize
1.1MB

Download
memory/524-552-0x00000000021D0000-0x00000000022E1000-memory.dmp

Filesize
1.1MB

Download
memory/524-560-0x00000000021D0000-0x00000000022E1000-memory.dmp

Filesize
1.1MB

Download
memory/524-564-0x00000000021D0000-0x00000000022E1000-memory.dmp

Filesize
1.1MB

Download
memory/524-562-0x00000000021D0000-0x00000000022E1000-memory.dmp

Filesize
1.1MB

Download
memory/524-558-0x00000000021D0000-0x00000000022E1000-memory.dmp

Filesize
1.1MB

Download
memory/524-556-0x00000000021D0000-0x00000000022E1000-memory.dmp

Filesize
1.1MB

Download
memory/524-554-0x00000000021D0000-0x00000000022E1000-memory.dmp

Filesize
1.1MB

Download
memory/524-2239-0x0000000001F20000-0x00000000020A1000-memory.dmp

Filesize
1.5MB

Download
memory/524-0-0x0000000000400000-0x00000000004FB000-memory.dmp

Filesize
1004KB

Download
memory/524-16507-0x0000000000400000-0x00000000004FB000-memory.dmp

Filesize
1004KB

Download
memory/524-7791-0x0000000002750000-0x000000000284B000-memory.dmp

Filesize
1004KB

Download
memory/4952-25221-0x0000000000400000-0x00000000004FB000-memory.dmp

Filesize
1004KB

Download
memory/8168-7792-0x0000000000400000-0x00000000004FB000-memory.dmp

Filesize
1004KB

Download
memory/8168-25214-0x0000000000400000-0x00000000004FB000-memory.dmp

Filesize
1004KB

Download