Analysis
- max time kernel
150s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/08/2026, 12:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e9a560b19524a886734a26f157f718c716d817c8d19393ab679df701f68e2240.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
e9a560b19524a886734a26f157f718c716d817c8d19393ab679df701f68e2240.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target e9a560b19524a886734a26f157f718c716d817c8d19393ab679df701f68e2240.exe
- Size 4.0MB
- Sample260810-n7tbbaxhmd
- SHA256 e9a560b19524a886734a26f157f718c716d817c8d19393ab679df701f68e2240
- MD5 2c51fd078320201efc66882a54a267e5
- SHA1 4a132bb2c641b14f34d00c4ba9a2d12bec0e2881
- SHA512 84123aaa2eb3f56eeb334a0a2f5ddfda49bbfd255c44b2327f1a1cefe1e7b833de6ec2bf39823fff5756fcc13bd16040fdde79a773dd2dfd983ff009e4d9f9d9
- SSDEEP 98304:khgvGfD8tpLWBHXovKM84AU58wImIcwvRVnlSNlnu6yoj9ghi1RebMIg9Cbk/V8N:2BB4ulU58wyTlSNlnu6yojDIg9Cbk/V8
- TLSH T1BF169ED27F5D4067C163253189F9AF78B6FAAD60FA35024732503E3EFA31782592861B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
fatalrat
C2
-
http://www.taobao.com/help/getip.php
-
https://vv.video.qq.com/checktime?otype=ojson
-
https://searchplugin.csdn.net/api/v1/ip/get?ip=
-
https://www.ipplus360.com/getIP
Signatures
- Fatal Rat payload 1 IoCs
resource yara_rule behavioral2/memory/1220-19-0x00000000013A0000-0x00000000013C9000-memory.dmp fatalrat - Executes dropped EXE 2 IoCs
pid Process 1220 DropboxCrashHandler.exe 1300 DropboxCrashHandler.exe - Loads dropped DLL 2 IoCs
pid Process 1220 DropboxCrashHandler.exe 1300 DropboxCrashHandler.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinSys870 = "C:\\Program Files (x86)\\Dropbox\\Update\\1.3.5055.162\\DropboxCrashHandler.exe" DropboxCrashHandler.exe - Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files (x86)\Dropbox\Update\1.3.5055.162\DropboxCrashHandler.exe e9a560b19524a886734a26f157f718c716d817c8d19393ab679df701f68e2240.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.5055.162\goopdate.dll e9a560b19524a886734a26f157f718c716d817c8d19393ab679df701f68e2240.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.5055.162\SVP7.png e9a560b19524a886734a26f157f718c716d817c8d19393ab679df701f68e2240.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DropboxCrashHandler.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DropboxCrashHandler.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e9a560b19524a886734a26f157f718c716d817c8d19393ab679df701f68e2240.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz DropboxCrashHandler.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 DropboxCrashHandler.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1220 DropboxCrashHandler.exe 1220 DropboxCrashHandler.exe 1220 DropboxCrashHandler.exe 1220 DropboxCrashHandler.exe 1220 DropboxCrashHandler.exe 1220 DropboxCrashHandler.exe 1220 DropboxCrashHandler.exe 1220 DropboxCrashHandler.exe 1220 DropboxCrashHandler.exe 1220 DropboxCrashHandler.exe 1220 DropboxCrashHandler.exe 1220 DropboxCrashHandler.exe 1220 DropboxCrashHandler.exe 1220 DropboxCrashHandler.exe 1220 DropboxCrashHandler.exe 1220 DropboxCrashHandler.exe 1220 DropboxCrashHandler.exe 1220 DropboxCrashHandler.exe 1220 DropboxCrashHandler.exe 1220 DropboxCrashHandler.exe 1220 DropboxCrashHandler.exe 1220 DropboxCrashHandler.exe 1220 DropboxCrashHandler.exe 1220 DropboxCrashHandler.exe 1220 DropboxCrashHandler.exe 1220 DropboxCrashHandler.exe 1220 DropboxCrashHandler.exe 1220 DropboxCrashHandler.exe 1220 DropboxCrashHandler.exe 1220 DropboxCrashHandler.exe 1220 DropboxCrashHandler.exe 1220 DropboxCrashHandler.exe 1220 DropboxCrashHandler.exe 1220 DropboxCrashHandler.exe 1220 DropboxCrashHandler.exe 1220 DropboxCrashHandler.exe 1220 DropboxCrashHandler.exe 1220 DropboxCrashHandler.exe 1220 DropboxCrashHandler.exe 1220 DropboxCrashHandler.exe 1220 DropboxCrashHandler.exe 1220 DropboxCrashHandler.exe 1220 DropboxCrashHandler.exe 1220 DropboxCrashHandler.exe 1220 DropboxCrashHandler.exe 1220 DropboxCrashHandler.exe 1220 DropboxCrashHandler.exe 1220 DropboxCrashHandler.exe 1220 DropboxCrashHandler.exe 1220 DropboxCrashHandler.exe 1220 DropboxCrashHandler.exe 1220 DropboxCrashHandler.exe 1220 DropboxCrashHandler.exe 1220 DropboxCrashHandler.exe 1220 DropboxCrashHandler.exe 1220 DropboxCrashHandler.exe 1220 DropboxCrashHandler.exe 1220 DropboxCrashHandler.exe 1220 DropboxCrashHandler.exe 1220 DropboxCrashHandler.exe 1220 DropboxCrashHandler.exe 1220 DropboxCrashHandler.exe 1220 DropboxCrashHandler.exe 1220 DropboxCrashHandler.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1220 DropboxCrashHandler.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2828 e9a560b19524a886734a26f157f718c716d817c8d19393ab679df701f68e2240.exe 2828 e9a560b19524a886734a26f157f718c716d817c8d19393ab679df701f68e2240.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2828 wrote to memory of 1220 2828 e9a560b19524a886734a26f157f718c716d817c8d19393ab679df701f68e2240.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\e9a560b19524a886734a26f157f718c716d817c8d19393ab679df701f68e2240.exe"C:\Users\Admin\AppData\Local\Temp\e9a560b19524a886734a26f157f718c716d817c8d19393ab679df701f68e2240.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Program Files (x86)\Dropbox\Update\1.3.5055.162\DropboxCrashHandler.exe"C:\Program Files (x86)\Dropbox\Update\1.3.5055.162\DropboxCrashHandler.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1220
-
-
C:\Program Files (x86)\Dropbox\Update\1.3.5055.162\DropboxCrashHandler.exe"C:\Program Files (x86)\Dropbox\Update\1.3.5055.162\DropboxCrashHandler.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1300
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Dropbox\Update\1.3.5055.162\DropboxCrashHandler.exe
- Size 130KB
- SHA256 e7141aeb22ea3165a4f7fb8c4d210151575f1b95ef545e0978a2174598a08265
- MD5 3b607e9ae169797c5112736dd445db25
- SHA1 076e59938996baf436888e2ecb536353071e0adf
- SHA512 1a80b6ed790d3325c365de14d7bdd4d98473c2cfd8a4eb5d97f99d9383946e6c9e892820e54182b06359f495cc42f261e455e3097413c605f0f208d7b6e3c2cd
- SSDEEP 3072:BZOOxLE4GTnrcyG2QltfW/ggXi0+LStLnh5jAm7tJOX47cIA9:iOxLEbTtwLf
- TLSH T10CD3C5C1F5B84CB9F4F35A395429867285BFB83DF922864E2A94015D0E23DC38E257E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Update\1.3.5055.162\SVP7.PNG
- Size 195KB
- SHA256 a9ea7566f183454d25ff53b6fc20d2fde9353ff37f78fd8757fb9d8f4f33d1cb
- MD5 714172a59ff9e26309229af1e725dd8a
- SHA1 d48f282a2be200165ffc3eab4bd47bf5906bfca1
- SHA512 f29feaa3683f88304798b79e343835069264ae5476aa9bdb4e3b8d3555a939cb5f46156ff1218b627b88fa6d6e9239ea6899d52129182717e245df4d67e709b5
- SSDEEP 3072:jDX38Jo4uaXUP/l4n5aNZtFhM4BpYMMIJ:jz8DuaEGniXF7
- TLSH T19414BE8D2EF00DCD1DF029D09D59866303ACCDA5F487B85CC99BFB86993374929D6A32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Update\1.3.5055.162\goopdate.dll
- Size 42KB
- SHA256 a7d07b13f6fc72ff905c69579f9be0cec237fc6df97b0d24e51ba44129831caa
- MD5 511e3fa6ba5f836db6abb2504b7c33ab
- SHA1 57167190667384d66baf9031dcddd917970e7e15
- SHA512 59f568ee6edad89720c4a83e7580a16149c6e81059f71509e8765e30e9098827b40be0ee94ac0b130ede687eb53e81807ca42b48ffd55af67daac18f3c9f9829
- SSDEEP 768:EKMh1TbnaCdR5LdcRzSW8PHTiyrk1n9oMRCUH:wTLdRN6Z8PLCn3RCU
- TLSH T1C2135B107540D073C14A6538A05ADBA18E6E7A111BF1A187BFBB1B7E9F712E0A73E347
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD
- Size 471B
- SHA256 acf585e3e4ca0b6dfc66869dfe60a0f27844916419b25e089266454d6d6b241d
- MD5 b1f16f4feb39ff2c5241add2fa783a39
- SHA1 4cf0c985b4fb49904e7e6936e565d0e0ff22db8b
- SHA512 0af260e827a909fd4e953e6930a515681630ca49a1fda8d5cee33fe8fa9f612a0552a6d5da3e36474fd80784e33c3e003e191c6b6d1562fd80e5c37dc6dbc06a
- TLSH T1C4F0DC120DA03C352A088E483DF7832CF004414C18F7C3FD3A7E29A725B66F0AB198E4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD
- Size 402B
- SHA256 bcf8f742bf2148a5251bb2a050f6a4891fe71c3cb80c3f5c83d28f0b724d3010
- MD5 04c0747301e6fa76757ece0d7ab4a6ff
- SHA1 e2e361fd439298185b9988ac76e4fa5f162c9d75
- SHA512 9dcd80c910e10297a824adf6d22298f0d8fa9d55403db853577999e3de40eda77cfd8121794b9d59c85264096c3bf8b507228260e389c83802bde6428648c361
- TLSH T184E0C6201FFE02BCF0B0EA301BCAA922846BF001AC2483791B944209AB0B640DCB2C38
- MD5 SHA1 SHA512 TLSH