fatalrat | 476ff2a15d602a14c136e11141890eb0513b1090ddb2c82f0ba51f8fb6803a1b

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
25/03/2025, 07:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.exe
Size

347KB
MD5

fe36f9338bec464c20098dc13e9eba94
SHA1

f68ec3bf7089e14791032708d45886a21acd7bca
SHA256

476ff2a15d602a14c136e11141890eb0513b1090ddb2c82f0ba51f8fb6803a1b
SHA512

0b7186d9eb1b7a576f316a73c8f4c77891fb6618347b5cdfecb23ee6784a3a856ade361e6adbad71059ac2b256e90e01356a30788de5574b8e905b62737c483d
SSDEEP

6144:zvEN2U+T6i5LirrllHy4HUcMQY6fEGqZYGVd82PDp:zENN+T5xYrllrU7QY6fEvmedp

Score

10^/10

fatalrat defense_evasion discovery infostealer persistence rat stealer trojan

Malware Config

Signatures

FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
stealer trojan fatalrat
Fatalrat family
fatalrat

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Fatal Rat payload 3 IoCs

rat infostealer

resource	yara_rule
behavioral1/memory/1560-8-0x0000000010000000-0x000000001001C000-memory.dmp	fatalrat
behavioral1/memory/1680-16-0x0000000010000000-0x000000001001C000-memory.dmp	fatalrat
behavioral1/memory/1560-64-0x0000000000400000-0x0000000000424000-memory.dmp	fatalrat

Boot or Logon Autostart Execution: Active Setup 2 TTPs 8 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe

Executes dropped EXE 8 IoCs

pid	Process
1560	sample.exe
1680	Ghijkl.exe
1596	icsys.icn.exe
4200	explorer.exe
3228	spoolsv.exe
3108	svchost.exe
460	spoolsv.exe
3620	Ghijkl.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Ghijkl.exe	sample.exe
File opened for modification	\??\c:\windows\system\explorer.exe	icsys.icn.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\Ghijkl.exe	Ghijkl.exe
File created	C:\Windows\Ghijkl.exe	Ghijkl.exe
File created	C:\Windows\Ghijkl.exe	sample.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sample.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sample.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icsys.icn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ghijkl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ghijkl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM	Ghijkl.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet	Ghijkl.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Services	Ghijkl.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Services\Ghijkl Nopqrstu	Ghijkl.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Services\Ghijkl Nopqrstu\Group = "new1104"	Ghijkl.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Services\Ghijkl Nopqrstu\InstallTime = "2025-03-25 07:45"	Ghijkl.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Services\Ghijkl Nopqrstu	Ghijkl.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1560	sample.exe
1560	sample.exe
1680	Ghijkl.exe
1680	Ghijkl.exe
1596	icsys.icn.exe
1596	icsys.icn.exe
4200	explorer.exe
4200	explorer.exe
4200	explorer.exe
4200	explorer.exe
4200	explorer.exe
4200	explorer.exe
3108	svchost.exe
3108	svchost.exe
3108	svchost.exe
3108	svchost.exe
4200	explorer.exe
4200	explorer.exe
3108	svchost.exe
3108	svchost.exe
4200	explorer.exe
4200	explorer.exe
3108	svchost.exe
3108	svchost.exe
4200	explorer.exe
4200	explorer.exe
3108	svchost.exe
3108	svchost.exe
4200	explorer.exe
4200	explorer.exe
3108	svchost.exe
3108	svchost.exe
4200	explorer.exe
4200	explorer.exe
3108	svchost.exe
3108	svchost.exe
4200	explorer.exe
4200	explorer.exe
3108	svchost.exe
3108	svchost.exe
4200	explorer.exe
4200	explorer.exe
3108	svchost.exe
3108	svchost.exe
4200	explorer.exe
4200	explorer.exe
3108	svchost.exe
3108	svchost.exe
4200	explorer.exe
4200	explorer.exe
3108	svchost.exe
3108	svchost.exe
4200	explorer.exe
4200	explorer.exe
3108	svchost.exe
3108	svchost.exe
4200	explorer.exe
4200	explorer.exe
3108	svchost.exe
3108	svchost.exe
4200	explorer.exe
4200	explorer.exe
3108	svchost.exe
3108	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3108	svchost.exe
4200	explorer.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1560	sample.exe
Token: SeDebugPrivilege	1680	Ghijkl.exe
Token: SeDebugPrivilege	3620	Ghijkl.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
3116	sample.exe
3116	sample.exe
1596	icsys.icn.exe
1596	icsys.icn.exe
4200	explorer.exe
4200	explorer.exe
3228	spoolsv.exe
3228	spoolsv.exe
3108	svchost.exe
3108	svchost.exe
460	spoolsv.exe
460	spoolsv.exe
4200	explorer.exe
4200	explorer.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3116 wrote to memory of 1560	3116	sample.exe	87
PID 3116 wrote to memory of 1560	3116	sample.exe	87
PID 3116 wrote to memory of 1560	3116	sample.exe	87
PID 3116 wrote to memory of 1596	3116	sample.exe	98
PID 3116 wrote to memory of 1596	3116	sample.exe	98
PID 3116 wrote to memory of 1596	3116	sample.exe	98
PID 1596 wrote to memory of 4200	1596	icsys.icn.exe	99
PID 1596 wrote to memory of 4200	1596	icsys.icn.exe	99
PID 1596 wrote to memory of 4200	1596	icsys.icn.exe	99
PID 4200 wrote to memory of 3228	4200	explorer.exe	100
PID 4200 wrote to memory of 3228	4200	explorer.exe	100
PID 4200 wrote to memory of 3228	4200	explorer.exe	100
PID 3228 wrote to memory of 3108	3228	spoolsv.exe	101
PID 3228 wrote to memory of 3108	3228	spoolsv.exe	101
PID 3228 wrote to memory of 3108	3228	spoolsv.exe	101
PID 3108 wrote to memory of 460	3108	svchost.exe	102
PID 3108 wrote to memory of 460	3108	svchost.exe	102
PID 3108 wrote to memory of 460	3108	svchost.exe	102
PID 3108 wrote to memory of 4232	3108	svchost.exe	103
PID 3108 wrote to memory of 4232	3108	svchost.exe	103
PID 3108 wrote to memory of 4232	3108	svchost.exe	103
PID 1680 wrote to memory of 3620	1680	Ghijkl.exe	106
PID 1680 wrote to memory of 3620	1680	Ghijkl.exe	106
PID 1680 wrote to memory of 3620	1680	Ghijkl.exe	106
PID 3108 wrote to memory of 1840	3108	svchost.exe	116
PID 3108 wrote to memory of 1840	3108	svchost.exe	116
PID 3108 wrote to memory of 1840	3108	svchost.exe	116
PID 3108 wrote to memory of 2920	3108	svchost.exe	119
PID 3108 wrote to memory of 2920	3108	svchost.exe	119
PID 3108 wrote to memory of 2920	3108	svchost.exe	119

C:\Users\Admin\AppData\Local\Temp\sample.exe
"C:\Users\Admin\AppData\Local\Temp\sample.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3116
- \??\c:\users\admin\appdata\local\temp\sample.exe
  c:\users\admin\appdata\local\temp\sample.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1560
- C:\Users\Admin\AppData\Local\icsys.icn.exe
  C:\Users\Admin\AppData\Local\icsys.icn.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1596
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Modifies WinLogon for persistence
    - Modifies visiblity of hidden/system files in Explorer
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4200
  - - \??\c:\windows\system\spoolsv.exe
      c:\windows\system\spoolsv.exe SE
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3228
    - - \??\c:\windows\system\svchost.exe
        
        c:\windows\system\svchost.exe
        5⤵
        Modifies WinLogon for persistence
        Modifies visiblity of hidden/system files in Explorer
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3108
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:460
      - C:\Windows\SysWOW64\at.exe
        
        at 07:47 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4232
      - C:\Windows\SysWOW64\at.exe
        
        at 07:48 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1840
      - C:\Windows\SysWOW64\at.exe
        
        at 07:49 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2920

C:\Windows\Ghijkl.exe
C:\Windows\Ghijkl.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Windows\Ghijkl.exe
  C:\Windows\Ghijkl.exe Win7
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\sample.exe

Filesize
140KB

MD5
200488185d59ab372448732e08da1b50

SHA1
717019dd5769e2a765401df7028fbf367d805268

SHA256
1722be3ca7c30055c94f37b865d6f3554c934b23a59f3c1adb7c093473ee0521

SHA512
6d84378730d86a0fb0c4b10c47375470595b6e6f42d9cfb6b7224f50aa2af372da2f9ae341e1a277a7c04663be4adce8c6baecc8b29a6815cf056d73a93a2637

Download Submit
C:\Users\Admin\AppData\Local\icsys.icn.exe

Filesize
206KB

MD5
a53b5457181718ebb1485029645e013c

SHA1
26b81ec5b46f48a486a9cf4d6c3fe2ae349da119

SHA256
84e4c1e92d37d717c7606c08177167d509277251ab195cea91ffda226694459e

SHA512
8e73370d0401f3260fe38614495cb5e3ebaf7d8fd319f3eee4fd1129af549058605bae8a3960e7355cdc8062c2f26ec4783e4c9d7f3d050d1f10f61b0d604bd3

Download Submit
C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
206KB

MD5
9384cf6ebd9cda454e45226c1fcd9107

SHA1
a88e8e4a44f268760e25cba305187926a99f2f74

SHA256
aec103c5ff3e7d688e9542d47f0e1858b921013f495260a3c3f54ca184315825

SHA512
30b3cb1192385ae97471d2c019f1d7cfe5b48bc51b7fd15afa3209ad5a75327bd8cbaa9673dc3c046c2a0b82a1911e34c50b3bb5e4cb1db82ef41277a4759d25

Download Submit
C:\Windows\System\explorer.exe

Filesize
206KB

MD5
6ee2c15b445294ce074ebb51514059b6

SHA1
1ae1ee093ee177ed3ff2a3a4476efabdc16db4df

SHA256
e9fac35190c0a968e8208a47955957c132179818329bd223ab6396cbf6ea1325

SHA512
62aae7cc352af07d0512773d3c0086b839b3bcbd97fac7247f878333fcaacefa5efaeaac0c0ba49452441cb42bc4d56851126676901b4ea1367bc7711fa32311

Download Submit
\??\c:\windows\system\spoolsv.exe

Filesize
207KB

MD5
f5faa0590b825b822ad534001d043653

SHA1
58c9379c021f857adaf2754851373a0f43c1674b

SHA256
103e3d1123e2ab5e6eab5fb9e35634e86322a6a7e1122ffd973065ec3c87fd54

SHA512
63be837cc8de08a562d4268c8ef5b14454c08f6d7c1e8eda9e725793b7651362854475c0394401b51fd4e79188b9a3774046971252869310363ed5631055cbda

Download Submit
\??\c:\windows\system\svchost.exe

Filesize
206KB

MD5
bbd74aade39eae6894940c70594b63fe

SHA1
802e3a5d5ca2c42369774a09e43ec3aafa4309de

SHA256
493a9f3aa8b5648d8b03d487c06471c0e6cc3cbfce5d7330701d98839ccc0b01

SHA512
4f82e1a6ee1e0d34d0c89a3433abdc30a15bb573d0821bbcfcaaab1177bfc64de908e760af757ab3efd159bb8581c0141e315fdedafd99ed93d1ee7f38839140

Download Submit
memory/1560-8-0x0000000010000000-0x000000001001C000-memory.dmp

Filesize
112KB

Download
memory/1560-64-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1680-16-0x0000000010000000-0x000000001001C000-memory.dmp

Filesize
112KB

Download