Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
24/02/2025, 10:11
Static task
static1
Behavioral task
behavioral1
Sample
package/MaskDoc.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral2
Sample
package/MaskDoc.exe
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
package/PotPlayer.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral4
Sample
package/PotPlayer.dll
Resource
win10v2004-20250217-en
windows10-2004-x64
General
-
Target
package/MaskDoc.exe
-
Size
63KB
-
MD5
6dcc71ba39c9c398a1da7fc19f7aa838
-
SHA1
842793fb82f3baa7ff645e314ee2d33311a20b50
-
SHA256
c5699d2d486747254907bd61a57f2f3ffb143ef357d42147295d6ce52aef1a97
-
SHA512
a94f4f96e47a20362dd773517c89e792111a0563aa13ec1c9afc8ed60e1c31fd576f50707bb10c78360f95a8fd09021782aaad42bf5c8cb33f13d6b8ef519e30
-
SSDEEP
768:2LMx2GXnvoLan/vhZ97F6Zkkj6KED2KnSM6pG+VHYnPqi4R43Q+:2LMxfvomxnF6ZkNjS/G+CnPYot
Malware Config
Signatures
-
Fatalrat family
-
Fatal Rat payload 2 IoCs
resource yara_rule behavioral2/memory/4128-3-0x0000000000600000-0x000000000062A000-memory.dmp fatalrat behavioral2/memory/4128-8-0x0000000002AD0000-0x0000000002B02000-memory.dmp fatalrat -
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: MaskDoc.exe File opened (read-only) \??\U: MaskDoc.exe File opened (read-only) \??\V: MaskDoc.exe File opened (read-only) \??\B: MaskDoc.exe File opened (read-only) \??\I: MaskDoc.exe File opened (read-only) \??\K: MaskDoc.exe File opened (read-only) \??\P: MaskDoc.exe File opened (read-only) \??\S: MaskDoc.exe File opened (read-only) \??\Y: MaskDoc.exe File opened (read-only) \??\G: MaskDoc.exe File opened (read-only) \??\J: MaskDoc.exe File opened (read-only) \??\M: MaskDoc.exe File opened (read-only) \??\N: MaskDoc.exe File opened (read-only) \??\Q: MaskDoc.exe File opened (read-only) \??\T: MaskDoc.exe File opened (read-only) \??\X: MaskDoc.exe File opened (read-only) \??\Z: MaskDoc.exe File opened (read-only) \??\L: MaskDoc.exe File opened (read-only) \??\O: MaskDoc.exe File opened (read-only) \??\W: MaskDoc.exe File opened (read-only) \??\E: MaskDoc.exe File opened (read-only) \??\H: MaskDoc.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MaskDoc.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MaskDoc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MaskDoc.exe -
Suspicious behavior: EnumeratesProcesses 58 IoCs
pid Process 4128 MaskDoc.exe 4128 MaskDoc.exe 4128 MaskDoc.exe 4128 MaskDoc.exe 4128 MaskDoc.exe 4128 MaskDoc.exe 4128 MaskDoc.exe 4128 MaskDoc.exe 4128 MaskDoc.exe 4128 MaskDoc.exe 4128 MaskDoc.exe 4128 MaskDoc.exe 4128 MaskDoc.exe 4128 MaskDoc.exe 4128 MaskDoc.exe 4128 MaskDoc.exe 4128 MaskDoc.exe 4128 MaskDoc.exe 4128 MaskDoc.exe 4128 MaskDoc.exe 4128 MaskDoc.exe 4128 MaskDoc.exe 4128 MaskDoc.exe 4128 MaskDoc.exe 4128 MaskDoc.exe 4128 MaskDoc.exe 4128 MaskDoc.exe 4128 MaskDoc.exe 4128 MaskDoc.exe 4128 MaskDoc.exe 4128 MaskDoc.exe 4128 MaskDoc.exe 4128 MaskDoc.exe 4128 MaskDoc.exe 4128 MaskDoc.exe 4128 MaskDoc.exe 4128 MaskDoc.exe 4128 MaskDoc.exe 4128 MaskDoc.exe 4128 MaskDoc.exe 4128 MaskDoc.exe 4128 MaskDoc.exe 4128 MaskDoc.exe 4128 MaskDoc.exe 4128 MaskDoc.exe 4128 MaskDoc.exe 4128 MaskDoc.exe 4128 MaskDoc.exe 4128 MaskDoc.exe 4128 MaskDoc.exe 4128 MaskDoc.exe 4128 MaskDoc.exe 4128 MaskDoc.exe 4128 MaskDoc.exe 4128 MaskDoc.exe 4128 MaskDoc.exe 4128 MaskDoc.exe 4128 MaskDoc.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4128 MaskDoc.exe Token: SeDebugPrivilege 4128 MaskDoc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\package\MaskDoc.exe"C:\Users\Admin\AppData\Local\Temp\package\MaskDoc.exe"1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4128