Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/08/2026, 14:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
651e057ead3c2f7b58a11348bb66e17c5fdc7066ea40a96d2f95332afda5a5f0.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
651e057ead3c2f7b58a11348bb66e17c5fdc7066ea40a96d2f95332afda5a5f0.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
General
- Target 651e057ead3c2f7b58a11348bb66e17c5fdc7066ea40a96d2f95332afda5a5f0.exe
- Size 131KB
- Sample260820-rblhda1zaz
- SHA256 651e057ead3c2f7b58a11348bb66e17c5fdc7066ea40a96d2f95332afda5a5f0
- MD5 ee119f867cb649be5d3eb658c18a473f
- SHA1 7fc9968bac9cec95a26a65a87319bed4fcba733b
- SHA512 3bc2ff9bc811005a41f44f14a4589b430c985eb0c15a80042373e0c07f1d241e75fc30d020a5d09b23cc89c7e318b24a86ecfadffa0c0bfdf351fdf6ad7c2eb8
- SSDEEP 3072:1SkSRLlydef1DpZNIY3GN67Fl+6OHNv3lInO5pmRcbWawH2:1SD6ef1s67Fl7OtvKtzaI2
- TLSH T16DD39E4175D1C072E8B215716974AF718A3EFC300F545ECB73CC2A6A9F342C1AA35AAB
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
fatalrat
C2
-
http://www.taobao.com/help/getip.php
-
https://vv.video.qq.com/checktime?otype=ojson
-
https://searchplugin.csdn.net/api/v1/ip/get?ip=
-
https://www.ipplus360.com/getIP
Signatures
- Fatal Rat payload 2 IoCs
resource yara_rule behavioral2/files/0x000d00000001c569-19.dat fatalrat behavioral2/memory/5884-23-0x0000000001300000-0x0000000001328000-memory.dmp fatalrat - Gh0st RAT payload 3 IoCs
resource yara_rule behavioral2/memory/5884-44-0x0000000004760000-0x00000000048AF000-memory.dmp family_gh0strat behavioral2/memory/5884-42-0x0000000004760000-0x00000000048AF000-memory.dmp family_gh0strat behavioral2/memory/5884-45-0x0000000004760000-0x00000000048AF000-memory.dmp family_gh0strat - Executes dropped EXE 1 IoCs
pid Process 5884 DropboxCrashHandler.exe - Loads dropped DLL 1 IoCs
pid Process 5884 DropboxCrashHandler.exe -
resource yara_rule behavioral2/memory/5884-39-0x0000000004760000-0x00000000048AF000-memory.dmp upx behavioral2/memory/5884-44-0x0000000004760000-0x00000000048AF000-memory.dmp upx behavioral2/memory/5884-42-0x0000000004760000-0x00000000048AF000-memory.dmp upx behavioral2/memory/5884-45-0x0000000004760000-0x00000000048AF000-memory.dmp upx - Drops file in Program Files directory 4 IoCs
description ioc Process File created C:\Program Files (x86)\Dropbox\Update\1.3.5055.162\DropboxCrashHandler.exe 651e057ead3c2f7b58a11348bb66e17c5fdc7066ea40a96d2f95332afda5a5f0.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.5055.162\goopdate.dll 651e057ead3c2f7b58a11348bb66e17c5fdc7066ea40a96d2f95332afda5a5f0.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.5055.162\SVP7.PNG 651e057ead3c2f7b58a11348bb66e17c5fdc7066ea40a96d2f95332afda5a5f0.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.5055.162\wangwang_Dropbox.vbs 651e057ead3c2f7b58a11348bb66e17c5fdc7066ea40a96d2f95332afda5a5f0.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 651e057ead3c2f7b58a11348bb66e17c5fdc7066ea40a96d2f95332afda5a5f0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DropboxCrashHandler.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 DropboxCrashHandler.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz DropboxCrashHandler.exe - Modifies system certificate store 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 651e057ead3c2f7b58a11348bb66e17c5fdc7066ea40a96d2f95332afda5a5f0.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 5c000000010000000400000000080000530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000004348a0e9444c78cb265e058d5e8944b4d84f9662bd26db257f8934a443c7016114000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd97f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d701030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54362000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde 651e057ead3c2f7b58a11348bb66e17c5fdc7066ea40a96d2f95332afda5a5f0.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5884 DropboxCrashHandler.exe 5884 DropboxCrashHandler.exe 5884 DropboxCrashHandler.exe 5884 DropboxCrashHandler.exe 5884 DropboxCrashHandler.exe 5884 DropboxCrashHandler.exe 5884 DropboxCrashHandler.exe 5884 DropboxCrashHandler.exe 5884 DropboxCrashHandler.exe 5884 DropboxCrashHandler.exe 5884 DropboxCrashHandler.exe 5884 DropboxCrashHandler.exe 5884 DropboxCrashHandler.exe 5884 DropboxCrashHandler.exe 5884 DropboxCrashHandler.exe 5884 DropboxCrashHandler.exe 5884 DropboxCrashHandler.exe 5884 DropboxCrashHandler.exe 5884 DropboxCrashHandler.exe 5884 DropboxCrashHandler.exe 5884 DropboxCrashHandler.exe 5884 DropboxCrashHandler.exe 5884 DropboxCrashHandler.exe 5884 DropboxCrashHandler.exe 5884 DropboxCrashHandler.exe 5884 DropboxCrashHandler.exe 5884 DropboxCrashHandler.exe 5884 DropboxCrashHandler.exe 5884 DropboxCrashHandler.exe 5884 DropboxCrashHandler.exe 5884 DropboxCrashHandler.exe 5884 DropboxCrashHandler.exe 5884 DropboxCrashHandler.exe 5884 DropboxCrashHandler.exe 5884 DropboxCrashHandler.exe 5884 DropboxCrashHandler.exe 5884 DropboxCrashHandler.exe 5884 DropboxCrashHandler.exe 5884 DropboxCrashHandler.exe 5884 DropboxCrashHandler.exe 5884 DropboxCrashHandler.exe 5884 DropboxCrashHandler.exe 5884 DropboxCrashHandler.exe 5884 DropboxCrashHandler.exe 5884 DropboxCrashHandler.exe 5884 DropboxCrashHandler.exe 5884 DropboxCrashHandler.exe 5884 DropboxCrashHandler.exe 5884 DropboxCrashHandler.exe 5884 DropboxCrashHandler.exe 5884 DropboxCrashHandler.exe 5884 DropboxCrashHandler.exe 5884 DropboxCrashHandler.exe 5884 DropboxCrashHandler.exe 5884 DropboxCrashHandler.exe 5884 DropboxCrashHandler.exe 5884 DropboxCrashHandler.exe 5884 DropboxCrashHandler.exe 5884 DropboxCrashHandler.exe 5884 DropboxCrashHandler.exe 5884 DropboxCrashHandler.exe 5884 DropboxCrashHandler.exe 5884 DropboxCrashHandler.exe 5884 DropboxCrashHandler.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 5884 DropboxCrashHandler.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 1096 wrote to memory of 5884 1096 651e057ead3c2f7b58a11348bb66e17c5fdc7066ea40a96d2f95332afda5a5f0.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\651e057ead3c2f7b58a11348bb66e17c5fdc7066ea40a96d2f95332afda5a5f0.exe"C:\Users\Admin\AppData\Local\Temp\651e057ead3c2f7b58a11348bb66e17c5fdc7066ea40a96d2f95332afda5a5f0.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Program Files (x86)\Dropbox\Update\1.3.5055.162\DropboxCrashHandler.exe"C:\Program Files (x86)\Dropbox\Update\1.3.5055.162\DropboxCrashHandler.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5884
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Dropbox\Update\1.3.5055.162\DropboxCrashHandler.exe
- Size 130KB
- SHA256 e7141aeb22ea3165a4f7fb8c4d210151575f1b95ef545e0978a2174598a08265
- MD5 3b607e9ae169797c5112736dd445db25
- SHA1 076e59938996baf436888e2ecb536353071e0adf
- SHA512 1a80b6ed790d3325c365de14d7bdd4d98473c2cfd8a4eb5d97f99d9383946e6c9e892820e54182b06359f495cc42f261e455e3097413c605f0f208d7b6e3c2cd
- SSDEEP 3072:BZOOxLE4GTnrcyG2QltfW/ggXi0+LStLnh5jAm7tJOX47cIA9:iOxLEbTtwLf
- TLSH T10CD3C5C1F5B84CB9F4F35A395429867285BFB83DF922864E2A94015D0E23DC38E257E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Update\1.3.5055.162\SVP7.PNG
- Size 200KB
- SHA256 9dc632abc9ab15d414cfb47cf9766f270135f086268030a9b3ec99f89e6a2a7c
- MD5 5a0e5600881a4727b6290cdc44b36598
- SHA1 b74a0ff2b68f77a0e4cd15d40fff174bdb8f092d
- SHA512 07e28db38c2fb79ee3c0e2b54723105c7708306589e602185886288a6ea3c2468185f349a7101cf9906ff12dac2b07a5ca894ea8281263ef23f6c6eef0808b6e
- SSDEEP 6144:8aAc9H2UT1ZMUvuplPN5Fo6stTBJlvmLTHc:T9RT7MZplPfFo6stTtOc
- TLSH T17814AE13B651897FC251023DA48FAB36DFBF68342564F723A7748A8D1C68198E33935B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Update\1.3.5055.162\goopdate.dll
- Size 35KB
- SHA256 cb768968a7ab1f060f8db315b44d86dc2bf10669ff41d512b008367c8d801a32
- MD5 baaf2e3e9bea5a360ba40e21b63cf69a
- SHA1 0fc945abd3968e9b4c4f858ee3a8022a9d19c588
- SHA512 0e758125ee3dee31e9c56d577688bb95029517f46f8acb7e69008e62b6815d7a92922ab04bf04b650874b7183f747c6096d52e9be402106c53c4b50960e96584
- SSDEEP 768:silJHc1eD3MkzUjWLLqhemnTED5UfUVUa0:sx43Mx7ZOVU1
- TLSH T1B3F23B11729190B3E1A66A3858B093715D3FBD012BF490CB3FBA16795FB22D09A3C367
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD
- Size 471B
- SHA256 ed7806a4628c1a8a7a8d59b4ecd18147ee58c2041b9f60380ab668af5f994919
- MD5 2c0fb757dfea0c642bec930809321822
- SHA1 7f8f17cb954e666d3feb06c14e3b7c020186af88
- SHA512 69920ec86347d208857db1f5677ddd917c9678759d42b4d9f44976d15b700be1fc0853589ceaaa18ed7262b6d1725dee5ef4cdd70402d61ae23b4507eb2cbf73
- TLSH T1ECF0DC5B00A124742A0A8E08ECD226AC3218942E3DB240FFB95B114B40317F6F0685C4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD
- Size 402B
- SHA256 7761fc0d66c493f0995ccc32143aa724518f932ea6d48cd93f39804741d4c2b0
- MD5 b3239764735bf0a8a69fae0fc4b5b491
- SHA1 f6b80fe0dbe689db33245a5b5619f5dc793cf3bb
- SHA512 ae9e6f98e2918206559d5e2348024e4da1d5d18ddbfa16182cfc48393dc3d807cdf33eea0f4cd9a99804ffc45e33baf3569ea74569d95877bc76721ada4002e8
- TLSH T1F3E0C02415F9013CF071EB300BC659224457E1011C9CC3791791030DE707600DC31C74
- MD5 SHA1 SHA512 TLSH