Analysis
- max time kernel
149s - max time network
148s - platform
windows11-21h2_x64 - resource
win11-20251223-en - resource tags
arch:x64arch:x86image:win11-20251223-enlocale:en-usos:windows11-21h2-x64system - submitted
29/12/2025, 00:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
_66f8447a4835720a737cc043f1cfd079e7668f9e038e4b991b13fbaab850f379.exe
Resource
win10v2004-20251223-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target _66f8447a4835720a737cc043f1cfd079e7668f9e038e4b991b13fbaab850f379.exe
- Size 3.4MB
- Sample251229-ack5ka1lar
- SHA256 66f8447a4835720a737cc043f1cfd079e7668f9e038e4b991b13fbaab850f379
- MD5 7a51c640dbb46f1cea19d858eed7c6e8
- SHA1 87dfbc797698b2d6312f6f408dc8609aa8d69f80
- SHA512 6b19ce58f140d8d56d021acfd80768bb563f73dbb543684ba983a448759798f0be56d937f3d9b12424b092eece585b2984ef5208c39bc183ec528f4ff34f1840
- SSDEEP 98304:K7TNc/KaF1+n8+06BcpKicYfUyHCm3AceDnH6Bmeh:K3ei04VK3Sds
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
fatalrat
C2
-
a2.nbdsnb2.top
Signatures
- Fatal Rat payload 1 IoCs
resource yara_rule behavioral2/memory/984-2-0x0000000010000000-0x000000001002D000-memory.dmp fatalrat - Fatalrat family
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language _66f8447a4835720a737cc043f1cfd079e7668f9e038e4b991b13fbaab850f379.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 _66f8447a4835720a737cc043f1cfd079e7668f9e038e4b991b13fbaab850f379.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz _66f8447a4835720a737cc043f1cfd079e7668f9e038e4b991b13fbaab850f379.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 984 _66f8447a4835720a737cc043f1cfd079e7668f9e038e4b991b13fbaab850f379.exe 984 _66f8447a4835720a737cc043f1cfd079e7668f9e038e4b991b13fbaab850f379.exe 984 _66f8447a4835720a737cc043f1cfd079e7668f9e038e4b991b13fbaab850f379.exe 984 _66f8447a4835720a737cc043f1cfd079e7668f9e038e4b991b13fbaab850f379.exe 984 _66f8447a4835720a737cc043f1cfd079e7668f9e038e4b991b13fbaab850f379.exe 984 _66f8447a4835720a737cc043f1cfd079e7668f9e038e4b991b13fbaab850f379.exe 984 _66f8447a4835720a737cc043f1cfd079e7668f9e038e4b991b13fbaab850f379.exe 984 _66f8447a4835720a737cc043f1cfd079e7668f9e038e4b991b13fbaab850f379.exe 984 _66f8447a4835720a737cc043f1cfd079e7668f9e038e4b991b13fbaab850f379.exe 984 _66f8447a4835720a737cc043f1cfd079e7668f9e038e4b991b13fbaab850f379.exe 984 _66f8447a4835720a737cc043f1cfd079e7668f9e038e4b991b13fbaab850f379.exe 984 _66f8447a4835720a737cc043f1cfd079e7668f9e038e4b991b13fbaab850f379.exe 984 _66f8447a4835720a737cc043f1cfd079e7668f9e038e4b991b13fbaab850f379.exe 984 _66f8447a4835720a737cc043f1cfd079e7668f9e038e4b991b13fbaab850f379.exe 984 _66f8447a4835720a737cc043f1cfd079e7668f9e038e4b991b13fbaab850f379.exe 984 _66f8447a4835720a737cc043f1cfd079e7668f9e038e4b991b13fbaab850f379.exe 984 _66f8447a4835720a737cc043f1cfd079e7668f9e038e4b991b13fbaab850f379.exe 984 _66f8447a4835720a737cc043f1cfd079e7668f9e038e4b991b13fbaab850f379.exe 984 _66f8447a4835720a737cc043f1cfd079e7668f9e038e4b991b13fbaab850f379.exe 984 _66f8447a4835720a737cc043f1cfd079e7668f9e038e4b991b13fbaab850f379.exe 984 _66f8447a4835720a737cc043f1cfd079e7668f9e038e4b991b13fbaab850f379.exe 984 _66f8447a4835720a737cc043f1cfd079e7668f9e038e4b991b13fbaab850f379.exe 984 _66f8447a4835720a737cc043f1cfd079e7668f9e038e4b991b13fbaab850f379.exe 984 _66f8447a4835720a737cc043f1cfd079e7668f9e038e4b991b13fbaab850f379.exe 984 _66f8447a4835720a737cc043f1cfd079e7668f9e038e4b991b13fbaab850f379.exe 984 _66f8447a4835720a737cc043f1cfd079e7668f9e038e4b991b13fbaab850f379.exe 984 _66f8447a4835720a737cc043f1cfd079e7668f9e038e4b991b13fbaab850f379.exe 984 _66f8447a4835720a737cc043f1cfd079e7668f9e038e4b991b13fbaab850f379.exe 984 _66f8447a4835720a737cc043f1cfd079e7668f9e038e4b991b13fbaab850f379.exe 984 _66f8447a4835720a737cc043f1cfd079e7668f9e038e4b991b13fbaab850f379.exe 984 _66f8447a4835720a737cc043f1cfd079e7668f9e038e4b991b13fbaab850f379.exe 984 _66f8447a4835720a737cc043f1cfd079e7668f9e038e4b991b13fbaab850f379.exe 984 _66f8447a4835720a737cc043f1cfd079e7668f9e038e4b991b13fbaab850f379.exe 984 _66f8447a4835720a737cc043f1cfd079e7668f9e038e4b991b13fbaab850f379.exe 984 _66f8447a4835720a737cc043f1cfd079e7668f9e038e4b991b13fbaab850f379.exe 984 _66f8447a4835720a737cc043f1cfd079e7668f9e038e4b991b13fbaab850f379.exe 984 _66f8447a4835720a737cc043f1cfd079e7668f9e038e4b991b13fbaab850f379.exe 984 _66f8447a4835720a737cc043f1cfd079e7668f9e038e4b991b13fbaab850f379.exe 984 _66f8447a4835720a737cc043f1cfd079e7668f9e038e4b991b13fbaab850f379.exe 984 _66f8447a4835720a737cc043f1cfd079e7668f9e038e4b991b13fbaab850f379.exe 984 _66f8447a4835720a737cc043f1cfd079e7668f9e038e4b991b13fbaab850f379.exe 984 _66f8447a4835720a737cc043f1cfd079e7668f9e038e4b991b13fbaab850f379.exe 984 _66f8447a4835720a737cc043f1cfd079e7668f9e038e4b991b13fbaab850f379.exe 984 _66f8447a4835720a737cc043f1cfd079e7668f9e038e4b991b13fbaab850f379.exe 984 _66f8447a4835720a737cc043f1cfd079e7668f9e038e4b991b13fbaab850f379.exe 984 _66f8447a4835720a737cc043f1cfd079e7668f9e038e4b991b13fbaab850f379.exe 984 _66f8447a4835720a737cc043f1cfd079e7668f9e038e4b991b13fbaab850f379.exe 984 _66f8447a4835720a737cc043f1cfd079e7668f9e038e4b991b13fbaab850f379.exe 984 _66f8447a4835720a737cc043f1cfd079e7668f9e038e4b991b13fbaab850f379.exe 984 _66f8447a4835720a737cc043f1cfd079e7668f9e038e4b991b13fbaab850f379.exe 984 _66f8447a4835720a737cc043f1cfd079e7668f9e038e4b991b13fbaab850f379.exe 984 _66f8447a4835720a737cc043f1cfd079e7668f9e038e4b991b13fbaab850f379.exe 984 _66f8447a4835720a737cc043f1cfd079e7668f9e038e4b991b13fbaab850f379.exe 984 _66f8447a4835720a737cc043f1cfd079e7668f9e038e4b991b13fbaab850f379.exe 984 _66f8447a4835720a737cc043f1cfd079e7668f9e038e4b991b13fbaab850f379.exe 984 _66f8447a4835720a737cc043f1cfd079e7668f9e038e4b991b13fbaab850f379.exe 984 _66f8447a4835720a737cc043f1cfd079e7668f9e038e4b991b13fbaab850f379.exe 984 _66f8447a4835720a737cc043f1cfd079e7668f9e038e4b991b13fbaab850f379.exe 984 _66f8447a4835720a737cc043f1cfd079e7668f9e038e4b991b13fbaab850f379.exe 984 _66f8447a4835720a737cc043f1cfd079e7668f9e038e4b991b13fbaab850f379.exe 984 _66f8447a4835720a737cc043f1cfd079e7668f9e038e4b991b13fbaab850f379.exe 984 _66f8447a4835720a737cc043f1cfd079e7668f9e038e4b991b13fbaab850f379.exe 984 _66f8447a4835720a737cc043f1cfd079e7668f9e038e4b991b13fbaab850f379.exe 984 _66f8447a4835720a737cc043f1cfd079e7668f9e038e4b991b13fbaab850f379.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 984 _66f8447a4835720a737cc043f1cfd079e7668f9e038e4b991b13fbaab850f379.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\_66f8447a4835720a737cc043f1cfd079e7668f9e038e4b991b13fbaab850f379.exe"C:\Users\Admin\AppData\Local\Temp\_66f8447a4835720a737cc043f1cfd079e7668f9e038e4b991b13fbaab850f379.exe"1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:984