Analysis
- max time kernel
149s - max time network
145s - platform
windows11-21h2_x64 - resource
win11-20251223-en - resource tags
arch:x64arch:x86image:win11-20251223-enlocale:en-usos:windows11-21h2-x64system - submitted
26/12/2025, 10:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
288299a40472f64a2c51cd75f9cd27692819c4927fdb65530f88124aef4b2d78.exe
Resource
win10v2004-20251223-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 288299a40472f64a2c51cd75f9cd27692819c4927fdb65530f88124aef4b2d78.exe
- Size 3.3MB
- Sample251226-mvdveswpcl
- SHA256 288299a40472f64a2c51cd75f9cd27692819c4927fdb65530f88124aef4b2d78
- MD5 5465d2597470fd994bcb0f28d0c06622
- SHA1 1830c9d2a7255e80aa41879e22324ad1f9fd04c4
- SHA512 5e97682a50105a458ad1d98397afd5eb2d2e61e302a3295051c1b2428c7ca3dd99a627a2801f8b342b09c048dadfbe70f845ed5fc7a03ce1830cb6a2b77224e6
- SSDEEP 49152:jpaOwfkulpMeRdC/YDvHFHvh5glntvnrXt1R6fSl+jEpLIriw6GaRDeO3lD9ilVk:daOwFAjCvH5Y/nrHR66UxDsDe+0lS
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
fatalrat
C2
-
a24.nbdsnb2.top
Signatures
- Fatal Rat payload 1 IoCs
resource yara_rule behavioral2/memory/4556-2-0x0000000010000000-0x000000001002D000-memory.dmp fatalrat - Fatalrat family
- Gh0st RAT payload 3 IoCs
resource yara_rule behavioral2/memory/4556-12-0x0000000003210000-0x000000000335D000-memory.dmp family_gh0strat behavioral2/memory/4556-10-0x0000000003210000-0x000000000335D000-memory.dmp family_gh0strat behavioral2/memory/4556-13-0x0000000003210000-0x000000000335D000-memory.dmp family_gh0strat - Gh0strat family
-
resource yara_rule behavioral2/memory/4556-7-0x0000000003210000-0x000000000335D000-memory.dmp upx behavioral2/memory/4556-12-0x0000000003210000-0x000000000335D000-memory.dmp upx behavioral2/memory/4556-10-0x0000000003210000-0x000000000335D000-memory.dmp upx behavioral2/memory/4556-13-0x0000000003210000-0x000000000335D000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 288299a40472f64a2c51cd75f9cd27692819c4927fdb65530f88124aef4b2d78.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 288299a40472f64a2c51cd75f9cd27692819c4927fdb65530f88124aef4b2d78.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz 288299a40472f64a2c51cd75f9cd27692819c4927fdb65530f88124aef4b2d78.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4556 288299a40472f64a2c51cd75f9cd27692819c4927fdb65530f88124aef4b2d78.exe 4556 288299a40472f64a2c51cd75f9cd27692819c4927fdb65530f88124aef4b2d78.exe 4556 288299a40472f64a2c51cd75f9cd27692819c4927fdb65530f88124aef4b2d78.exe 4556 288299a40472f64a2c51cd75f9cd27692819c4927fdb65530f88124aef4b2d78.exe 4556 288299a40472f64a2c51cd75f9cd27692819c4927fdb65530f88124aef4b2d78.exe 4556 288299a40472f64a2c51cd75f9cd27692819c4927fdb65530f88124aef4b2d78.exe 4556 288299a40472f64a2c51cd75f9cd27692819c4927fdb65530f88124aef4b2d78.exe 4556 288299a40472f64a2c51cd75f9cd27692819c4927fdb65530f88124aef4b2d78.exe 4556 288299a40472f64a2c51cd75f9cd27692819c4927fdb65530f88124aef4b2d78.exe 4556 288299a40472f64a2c51cd75f9cd27692819c4927fdb65530f88124aef4b2d78.exe 4556 288299a40472f64a2c51cd75f9cd27692819c4927fdb65530f88124aef4b2d78.exe 4556 288299a40472f64a2c51cd75f9cd27692819c4927fdb65530f88124aef4b2d78.exe 4556 288299a40472f64a2c51cd75f9cd27692819c4927fdb65530f88124aef4b2d78.exe 4556 288299a40472f64a2c51cd75f9cd27692819c4927fdb65530f88124aef4b2d78.exe 4556 288299a40472f64a2c51cd75f9cd27692819c4927fdb65530f88124aef4b2d78.exe 4556 288299a40472f64a2c51cd75f9cd27692819c4927fdb65530f88124aef4b2d78.exe 4556 288299a40472f64a2c51cd75f9cd27692819c4927fdb65530f88124aef4b2d78.exe 4556 288299a40472f64a2c51cd75f9cd27692819c4927fdb65530f88124aef4b2d78.exe 4556 288299a40472f64a2c51cd75f9cd27692819c4927fdb65530f88124aef4b2d78.exe 4556 288299a40472f64a2c51cd75f9cd27692819c4927fdb65530f88124aef4b2d78.exe 4556 288299a40472f64a2c51cd75f9cd27692819c4927fdb65530f88124aef4b2d78.exe 4556 288299a40472f64a2c51cd75f9cd27692819c4927fdb65530f88124aef4b2d78.exe 4556 288299a40472f64a2c51cd75f9cd27692819c4927fdb65530f88124aef4b2d78.exe 4556 288299a40472f64a2c51cd75f9cd27692819c4927fdb65530f88124aef4b2d78.exe 4556 288299a40472f64a2c51cd75f9cd27692819c4927fdb65530f88124aef4b2d78.exe 4556 288299a40472f64a2c51cd75f9cd27692819c4927fdb65530f88124aef4b2d78.exe 4556 288299a40472f64a2c51cd75f9cd27692819c4927fdb65530f88124aef4b2d78.exe 4556 288299a40472f64a2c51cd75f9cd27692819c4927fdb65530f88124aef4b2d78.exe 4556 288299a40472f64a2c51cd75f9cd27692819c4927fdb65530f88124aef4b2d78.exe 4556 288299a40472f64a2c51cd75f9cd27692819c4927fdb65530f88124aef4b2d78.exe 4556 288299a40472f64a2c51cd75f9cd27692819c4927fdb65530f88124aef4b2d78.exe 4556 288299a40472f64a2c51cd75f9cd27692819c4927fdb65530f88124aef4b2d78.exe 4556 288299a40472f64a2c51cd75f9cd27692819c4927fdb65530f88124aef4b2d78.exe 4556 288299a40472f64a2c51cd75f9cd27692819c4927fdb65530f88124aef4b2d78.exe 4556 288299a40472f64a2c51cd75f9cd27692819c4927fdb65530f88124aef4b2d78.exe 4556 288299a40472f64a2c51cd75f9cd27692819c4927fdb65530f88124aef4b2d78.exe 4556 288299a40472f64a2c51cd75f9cd27692819c4927fdb65530f88124aef4b2d78.exe 4556 288299a40472f64a2c51cd75f9cd27692819c4927fdb65530f88124aef4b2d78.exe 4556 288299a40472f64a2c51cd75f9cd27692819c4927fdb65530f88124aef4b2d78.exe 4556 288299a40472f64a2c51cd75f9cd27692819c4927fdb65530f88124aef4b2d78.exe 4556 288299a40472f64a2c51cd75f9cd27692819c4927fdb65530f88124aef4b2d78.exe 4556 288299a40472f64a2c51cd75f9cd27692819c4927fdb65530f88124aef4b2d78.exe 4556 288299a40472f64a2c51cd75f9cd27692819c4927fdb65530f88124aef4b2d78.exe 4556 288299a40472f64a2c51cd75f9cd27692819c4927fdb65530f88124aef4b2d78.exe 4556 288299a40472f64a2c51cd75f9cd27692819c4927fdb65530f88124aef4b2d78.exe 4556 288299a40472f64a2c51cd75f9cd27692819c4927fdb65530f88124aef4b2d78.exe 4556 288299a40472f64a2c51cd75f9cd27692819c4927fdb65530f88124aef4b2d78.exe 4556 288299a40472f64a2c51cd75f9cd27692819c4927fdb65530f88124aef4b2d78.exe 4556 288299a40472f64a2c51cd75f9cd27692819c4927fdb65530f88124aef4b2d78.exe 4556 288299a40472f64a2c51cd75f9cd27692819c4927fdb65530f88124aef4b2d78.exe 4556 288299a40472f64a2c51cd75f9cd27692819c4927fdb65530f88124aef4b2d78.exe 4556 288299a40472f64a2c51cd75f9cd27692819c4927fdb65530f88124aef4b2d78.exe 4556 288299a40472f64a2c51cd75f9cd27692819c4927fdb65530f88124aef4b2d78.exe 4556 288299a40472f64a2c51cd75f9cd27692819c4927fdb65530f88124aef4b2d78.exe 4556 288299a40472f64a2c51cd75f9cd27692819c4927fdb65530f88124aef4b2d78.exe 4556 288299a40472f64a2c51cd75f9cd27692819c4927fdb65530f88124aef4b2d78.exe 4556 288299a40472f64a2c51cd75f9cd27692819c4927fdb65530f88124aef4b2d78.exe 4556 288299a40472f64a2c51cd75f9cd27692819c4927fdb65530f88124aef4b2d78.exe 4556 288299a40472f64a2c51cd75f9cd27692819c4927fdb65530f88124aef4b2d78.exe 4556 288299a40472f64a2c51cd75f9cd27692819c4927fdb65530f88124aef4b2d78.exe 4556 288299a40472f64a2c51cd75f9cd27692819c4927fdb65530f88124aef4b2d78.exe 4556 288299a40472f64a2c51cd75f9cd27692819c4927fdb65530f88124aef4b2d78.exe 4556 288299a40472f64a2c51cd75f9cd27692819c4927fdb65530f88124aef4b2d78.exe 4556 288299a40472f64a2c51cd75f9cd27692819c4927fdb65530f88124aef4b2d78.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4556 288299a40472f64a2c51cd75f9cd27692819c4927fdb65530f88124aef4b2d78.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\288299a40472f64a2c51cd75f9cd27692819c4927fdb65530f88124aef4b2d78.exe"C:\Users\Admin\AppData\Local\Temp\288299a40472f64a2c51cd75f9cd27692819c4927fdb65530f88124aef4b2d78.exe"1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4556