fatalrat | aff16f3e9908bc1836fe34b11181a2c700732b1606c7e7dafd145cef1538e58a

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/10/2026, 12:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
aff16f3e9908bc1836fe34b11181a2c700732b1606c7e7dafd145cef1538e58a.exe
Size 4.1MB
Sample261014-pbbbasvsft
SHA256 aff16f3e9908bc1836fe34b11181a2c700732b1606c7e7dafd145cef1538e58a
MD5 5de2101f461a2a78ee3c334ea0e8f409
SHA1 f806027c9f0e013bfda44a68deb88c4beafab5b6
SHA512 53e667d8e4903017e1df11371705e6e855d778902f348e67ad57aad5073322445fc7f86b2a7ad35d5e1abc20951b0d71c8a340eeb46181c8505c42e36e696e22
SSDEEP 98304:KFJFsscN/91jqYJ4X6ukFSd58b8jFCBgp+nMSNlnB6Woj9ghi1RebMIg9Cbk/V8N:eyqpo0d58bGeMSNlnB6WojDIg9Cbk/V8
TLSH
T14B168DE17F5D8067C163253189F9AE78B6FAAD60FA35024731503A3EFB317C2592861B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery fatalrat infostealer persistence rat spyware stealer trojan

Malware Config

Extracted

Family

fatalrat

http://www.taobao.com/help/getip.php
https://vv.video.qq.com/checktime?otype=ojson
https://searchplugin.csdn.net/api/v1/ip/get?ip=
https://www.ipplus360.com/getIP

Signatures

Family: FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
stealer trojan fatalrat

Fatal Rat payload 1 IoCs

rat infostealer

resource	yara_rule
behavioral1/memory/2056-22-0x00000000007E0000-0x0000000000809000-memory.dmp	fatalrat

Executes dropped EXE 3 IoCs

pid	Process
2056	DropboxCrashHandler.exe
752	DropboxCrashHandler.exe
2256	SysUtilSvc.exe

Loads dropped DLL 2 IoCs

pid	Process
2056	DropboxCrashHandler.exe
752	DropboxCrashHandler.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemUtility = "C:\\Windows\\SysUtilSvc.exe"	aff16f3e9908bc1836fe34b11181a2c700732b1606c7e7dafd145cef1538e58a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinSys1321 = "C:\\Program Files (x86)\\Dropbox\\Update\\1.3.5055.162\\DropboxCrashHandler.exe"	DropboxCrashHandler.exe

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Dropbox\Update\1.3.5055.162\goopdate.dll	SysUtilSvc.exe
File opened for modification	C:\Program Files (x86)\Dropbox\Update\1.3.5055.162\SVP7.png	SysUtilSvc.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.5055.162\DropboxCrashHandler.exe	aff16f3e9908bc1836fe34b11181a2c700732b1606c7e7dafd145cef1538e58a.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.5055.162\goopdate.dll	aff16f3e9908bc1836fe34b11181a2c700732b1606c7e7dafd145cef1538e58a.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.5055.162\SVP7.png	aff16f3e9908bc1836fe34b11181a2c700732b1606c7e7dafd145cef1538e58a.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.5055.162\DropboxCrashHandler.exe	SysUtilSvc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysUtilSvc.exe	aff16f3e9908bc1836fe34b11181a2c700732b1606c7e7dafd145cef1538e58a.exe
File created	C:\Windows\SysUtilSvc.exe	aff16f3e9908bc1836fe34b11181a2c700732b1606c7e7dafd145cef1538e58a.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DropboxCrashHandler.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SysUtilSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SysUtilSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	aff16f3e9908bc1836fe34b11181a2c700732b1606c7e7dafd145cef1538e58a.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	aff16f3e9908bc1836fe34b11181a2c700732b1606c7e7dafd145cef1538e58a.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DropboxCrashHandler.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DropboxCrashHandler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SysUtilSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aff16f3e9908bc1836fe34b11181a2c700732b1606c7e7dafd145cef1538e58a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DropboxCrashHandler.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 5c000000010000000400000000080000530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000004348a0e9444c78cb265e058d5e8944b4d84f9662bd26db257f8934a443c7016114000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd97f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d701030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54362000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	aff16f3e9908bc1836fe34b11181a2c700732b1606c7e7dafd145cef1538e58a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	aff16f3e9908bc1836fe34b11181a2c700732b1606c7e7dafd145cef1538e58a.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2056	DropboxCrashHandler.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4556	aff16f3e9908bc1836fe34b11181a2c700732b1606c7e7dafd145cef1538e58a.exe
4556	aff16f3e9908bc1836fe34b11181a2c700732b1606c7e7dafd145cef1538e58a.exe
2256	SysUtilSvc.exe
2256	SysUtilSvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4556 wrote to memory of 2056	4556	aff16f3e9908bc1836fe34b11181a2c700732b1606c7e7dafd145cef1538e58a.exe	90

C:\Users\Admin\AppData\Local\Temp\aff16f3e9908bc1836fe34b11181a2c700732b1606c7e7dafd145cef1538e58a.exe
"C:\Users\Admin\AppData\Local\Temp\aff16f3e9908bc1836fe34b11181a2c700732b1606c7e7dafd145cef1538e58a.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4556
- C:\Program Files (x86)\Dropbox\Update\1.3.5055.162\DropboxCrashHandler.exe
  "C:\Program Files (x86)\Dropbox\Update\1.3.5055.162\DropboxCrashHandler.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2056

C:\Program Files (x86)\Dropbox\Update\1.3.5055.162\DropboxCrashHandler.exe
"C:\Program Files (x86)\Dropbox\Update\1.3.5055.162\DropboxCrashHandler.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:752

C:\Windows\SysUtilSvc.exe
C:\Windows\SysUtilSvc.exe
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DropboxCrashHandler.exe

Path C:\Program Files (x86)\Dropbox\Update\1.3.5055.162\DropboxCrashHandler.exe
Size 130KB
SHA256 e7141aeb22ea3165a4f7fb8c4d210151575f1b95ef545e0978a2174598a08265
MD5 3b607e9ae169797c5112736dd445db25
SHA1 076e59938996baf436888e2ecb536353071e0adf
SHA512 1a80b6ed790d3325c365de14d7bdd4d98473c2cfd8a4eb5d97f99d9383946e6c9e892820e54182b06359f495cc42f261e455e3097413c605f0f208d7b6e3c2cd
SSDEEP 3072:BZOOxLE4GTnrcyG2QltfW/ggXi0+LStLnh5jAm7tJOX47cIA9:iOxLEbTtwLf
TLSH
T10CD3C5C1F5B84CB9F4F35A395429867285BFB83DF922864E2A94015D0E23DC38E257E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SVP7.PNG

Path C:\Program Files (x86)\Dropbox\Update\1.3.5055.162\SVP7.PNG
Size 195KB
SHA256 a9ea7566f183454d25ff53b6fc20d2fde9353ff37f78fd8757fb9d8f4f33d1cb
MD5 714172a59ff9e26309229af1e725dd8a
SHA1 d48f282a2be200165ffc3eab4bd47bf5906bfca1
SHA512 f29feaa3683f88304798b79e343835069264ae5476aa9bdb4e3b8d3555a939cb5f46156ff1218b627b88fa6d6e9239ea6899d52129182717e245df4d67e709b5
SSDEEP 3072:jDX38Jo4uaXUP/l4n5aNZtFhM4BpYMMIJ:jz8DuaEGniXF7
TLSH
T19414BE8D2EF00DCD1DF029D09D59866303ACCDA5F487B85CC99BFB86993374929D6A32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdate.dll

Path C:\Program Files (x86)\Dropbox\Update\1.3.5055.162\goopdate.dll
Size 42KB
SHA256 a7d07b13f6fc72ff905c69579f9be0cec237fc6df97b0d24e51ba44129831caa
MD5 511e3fa6ba5f836db6abb2504b7c33ab
SHA1 57167190667384d66baf9031dcddd917970e7e15
SHA512 59f568ee6edad89720c4a83e7580a16149c6e81059f71509e8765e30e9098827b40be0ee94ac0b130ede687eb53e81807ca42b48ffd55af67daac18f3c9f9829
SSDEEP 768:EKMh1TbnaCdR5LdcRzSW8PHTiyrk1n9oMRCUH:wTLdRN6Z8PLCn3RCU
TLSH
T1C2135B107540D073C14A6538A05ADBA18E6E7A111BF1A187BFBB1B7E9F712E0A73E347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD
Size 471B
SHA256 00325884d1fde9a8d35769ec1881a3bc8fab2dde89bb75a398cd857a935d6715
MD5 7aa9b84ab09200fea2d1d917d1ebb4ad
SHA1 72198ddf83017e73449485b65ad5eccdc7444fc4
SHA512 b947b0e0ae32be71114f92ddbe887cf4440b4a2e1ecf55715ec277b93519a439caa99b663ffa01b7167494de987c9b41eb978427186b3ef5d878750cb027a2e1
TLSH
T167F0DCA1805338746E058CEEBEE3EE08302896491DB2C1F73A9817A1DA143D1FEEE4D4
MD5 SHA1 SHA512 TLSH

Submit Download

ACF36929369259566C0D9BA6E8069883

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\ACF36929369259566C0D9BA6E8069883
Size 727B
SHA256 16e36ca0743af4d0a41fe25fcd1b31d0a15a071f4ad88bcb29cb7482f7ecffb6
MD5 684e5216717411339402e0d4c92abd67
SHA1 1ccac142514849b5281144a04852334253a0af95
SHA512 acf2025bf455f5d8fd2952a6f770f4c055b43e097907ff15699ebfd9f4f0664f16f629eb796f964ba48c0f538d67648ba5212306ed0689cad10a049ae0155d06
TLSH
T1810149F27D0C6413183F48D84EF46EB6A750A9900EC1D8D65F7C1859E488BD2CD045F5
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_7F584189DFCC61AA971930CA5AED3120

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_7F584189DFCC61AA971930CA5AED3120
Size 471B
SHA256 5dc1b97eba22e2619a680119b4b156e7f77f86987ceb2c73af73f6c73f0caa3e
MD5 51073a7f8dfbf12428c3f1cdacc820c7
SHA1 8623c8fe9f1d74cddd7e1640fadf2abd48227390
SHA512 6af018c3917033583fb9543697ab0964cc2c81ef4064f94efce3b52e58045dd3042481dd928fd35ba2bff44c66b00eeb7dfef46d30889f58f3df22a8daa5d549
TLSH
T190F0DC12C24EB0100F4BCCDE12924627B823607B4192C5A7AE6C54A5846C7BD6C29439
MD5 SHA1 SHA512 TLSH

Submit Download

3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD
Size 402B
SHA256 2b969120a3534e75ce12a6d8e322ab73993576fb4ddc835bf299e33a73f043a5
MD5 48978340dbc25e53c31b0d9a172624f0
SHA1 bfc967f4268767007cdf669f1d65585aefd8278d
SHA512 ee7759f548986613d42f5939f213b4fd80c9086412ef98261dd6343ed1d3cef292ec532dd3ec3c8a1372954da445e046c2e39151f77ca9dda7bde345852d3e4d
TLSH
T16CE068210DFA012CF0B2EA741BCA5521001AE1051C28837917A0020DA70B600DD72835
MD5 SHA1 SHA512 TLSH

Submit Download

ACF36929369259566C0D9BA6E8069883

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\ACF36929369259566C0D9BA6E8069883
Size 400B
SHA256 e48bd2cd21a69b4342ff37e294fc3d0d8aad1aee657c6ef93a272e5d3a950c59
MD5 d0abf6bc9033f28622d12a82cbaae911
SHA1 475b833c55a8979b782735e638db33ecd16880e6
SHA512 26ca5860c61495d35d35d84f2775e1d6e28caca7eb506a05ab51d4a7670bd065900a81a36f740d9d7121ccbc94052ff55a45a5705366cbcea63deb684ce19ae1
TLSH
T1CAE0C03433F4419DF061F7788BE9F170467DF44924038EBF05601548D605B400C1173B
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_7F584189DFCC61AA971930CA5AED3120

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_7F584189DFCC61AA971930CA5AED3120
Size 412B
SHA256 69a76ac5b2bdabe3f643053f58bf2df4297b8df66a7b71d006fa234ac3b81516
MD5 1b58415bfe66591adb5488bcb0967dcf
SHA1 f723dd6f858b254e26fe7d059150d5482f1a4df8
SHA512 3f7fe3bd473ebc71b82a6149248fcb2801c3e29c0fea3c845d6fc27ddf5bc464b91680be699f05bd316821c5fc0b7acd003967d54bd851dfba9dfb8483980546
TLSH
T12EE0C02011FA400CF6E4F0384BCA7A784969F0361815E2B01BD46B08E715E00DC12E3D
MD5 SHA1 SHA512 TLSH

Submit Download

SysUtilSvc.exe

Path C:\Windows\SysUtilSvc.exe
Size 4.1MB
SHA256 aff16f3e9908bc1836fe34b11181a2c700732b1606c7e7dafd145cef1538e58a
MD5 5de2101f461a2a78ee3c334ea0e8f409
SHA1 f806027c9f0e013bfda44a68deb88c4beafab5b6
SHA512 53e667d8e4903017e1df11371705e6e855d778902f348e67ad57aad5073322445fc7f86b2a7ad35d5e1abc20951b0d71c8a340eeb46181c8505c42e36e696e22
SSDEEP 98304:KFJFsscN/91jqYJ4X6ukFSd58b8jFCBgp+nMSNlnB6Woj9ghi1RebMIg9Cbk/V8N:eyqpo0d58bGeMSNlnB6WojDIg9Cbk/V8
TLSH
T14B168DE17F5D8067C163253189F9AE78B6FAAD60FA35024731503A3EFB317C2592861B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2056-18-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/2056-22-0x00000000007E0000-0x0000000000809000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads