fatalrat | aff16f3e9908bc1836fe34b11181a2c700732b1606c7e7dafd145cef1538e58a

Analysis

max time kernel
148s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 12:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
aff16f3e9908bc1836fe34b11181a2c700732b1606c7e7dafd145cef1538e58a.exe
Size 4.1MB
Sample261014-pbbbasvsft
SHA256 aff16f3e9908bc1836fe34b11181a2c700732b1606c7e7dafd145cef1538e58a
MD5 5de2101f461a2a78ee3c334ea0e8f409
SHA1 f806027c9f0e013bfda44a68deb88c4beafab5b6
SHA512 53e667d8e4903017e1df11371705e6e855d778902f348e67ad57aad5073322445fc7f86b2a7ad35d5e1abc20951b0d71c8a340eeb46181c8505c42e36e696e22
SSDEEP 98304:KFJFsscN/91jqYJ4X6ukFSd58b8jFCBgp+nMSNlnB6Woj9ghi1RebMIg9Cbk/V8N:eyqpo0d58bGeMSNlnB6WojDIg9Cbk/V8
TLSH
T14B168DE17F5D8067C163253189F9AE78B6FAAD60FA35024731503A3EFB317C2592861B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery fatalrat infostealer persistence rat spyware stealer trojan

Malware Config

Extracted

Family

fatalrat

http://www.taobao.com/help/getip.php
https://vv.video.qq.com/checktime?otype=ojson
https://searchplugin.csdn.net/api/v1/ip/get?ip=
https://www.ipplus360.com/getIP

Signatures

Family: FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
stealer trojan fatalrat

Fatal Rat payload 1 IoCs

rat infostealer

resource	yara_rule
behavioral2/memory/1716-21-0x0000000002A50000-0x0000000002A79000-memory.dmp	fatalrat

Executes dropped EXE 3 IoCs

pid	Process
1716	DropboxCrashHandler.exe
1868	DropboxCrashHandler.exe
208	SysUtilSvc.exe

Loads dropped DLL 2 IoCs

pid	Process
1716	DropboxCrashHandler.exe
1868	DropboxCrashHandler.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinSys1321 = "C:\\Program Files (x86)\\Dropbox\\Update\\1.3.5055.162\\DropboxCrashHandler.exe"	DropboxCrashHandler.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemUtility = "C:\\Windows\\SysUtilSvc.exe"	aff16f3e9908bc1836fe34b11181a2c700732b1606c7e7dafd145cef1538e58a.exe

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Dropbox\Update\1.3.5055.162\goopdate.dll	aff16f3e9908bc1836fe34b11181a2c700732b1606c7e7dafd145cef1538e58a.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.5055.162\SVP7.png	aff16f3e9908bc1836fe34b11181a2c700732b1606c7e7dafd145cef1538e58a.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.5055.162\DropboxCrashHandler.exe	SysUtilSvc.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.5055.162\goopdate.dll	SysUtilSvc.exe
File opened for modification	C:\Program Files (x86)\Dropbox\Update\1.3.5055.162\SVP7.png	SysUtilSvc.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.5055.162\DropboxCrashHandler.exe	aff16f3e9908bc1836fe34b11181a2c700732b1606c7e7dafd145cef1538e58a.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysUtilSvc.exe	aff16f3e9908bc1836fe34b11181a2c700732b1606c7e7dafd145cef1538e58a.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DropboxCrashHandler.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DropboxCrashHandler.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SysUtilSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SysUtilSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	aff16f3e9908bc1836fe34b11181a2c700732b1606c7e7dafd145cef1538e58a.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	aff16f3e9908bc1836fe34b11181a2c700732b1606c7e7dafd145cef1538e58a.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DropboxCrashHandler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DropboxCrashHandler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SysUtilSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aff16f3e9908bc1836fe34b11181a2c700732b1606c7e7dafd145cef1538e58a.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	aff16f3e9908bc1836fe34b11181a2c700732b1606c7e7dafd145cef1538e58a.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 5c000000010000000400000000080000530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000004348a0e9444c78cb265e058d5e8944b4d84f9662bd26db257f8934a443c7016114000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd97f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d701030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54362000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	aff16f3e9908bc1836fe34b11181a2c700732b1606c7e7dafd145cef1538e58a.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1716	DropboxCrashHandler.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2496	aff16f3e9908bc1836fe34b11181a2c700732b1606c7e7dafd145cef1538e58a.exe
2496	aff16f3e9908bc1836fe34b11181a2c700732b1606c7e7dafd145cef1538e58a.exe
208	SysUtilSvc.exe
208	SysUtilSvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 1716	2496	aff16f3e9908bc1836fe34b11181a2c700732b1606c7e7dafd145cef1538e58a.exe	89

C:\Users\Admin\AppData\Local\Temp\aff16f3e9908bc1836fe34b11181a2c700732b1606c7e7dafd145cef1538e58a.exe
"C:\Users\Admin\AppData\Local\Temp\aff16f3e9908bc1836fe34b11181a2c700732b1606c7e7dafd145cef1538e58a.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Program Files (x86)\Dropbox\Update\1.3.5055.162\DropboxCrashHandler.exe
  "C:\Program Files (x86)\Dropbox\Update\1.3.5055.162\DropboxCrashHandler.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1716

C:\Program Files (x86)\Dropbox\Update\1.3.5055.162\DropboxCrashHandler.exe
"C:\Program Files (x86)\Dropbox\Update\1.3.5055.162\DropboxCrashHandler.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1868

C:\Windows\SysUtilSvc.exe
C:\Windows\SysUtilSvc.exe
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:208

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DropboxCrashHandler.exe

Path C:\Program Files (x86)\Dropbox\Update\1.3.5055.162\DropboxCrashHandler.exe
Size 130KB
SHA256 e7141aeb22ea3165a4f7fb8c4d210151575f1b95ef545e0978a2174598a08265
MD5 3b607e9ae169797c5112736dd445db25
SHA1 076e59938996baf436888e2ecb536353071e0adf
SHA512 1a80b6ed790d3325c365de14d7bdd4d98473c2cfd8a4eb5d97f99d9383946e6c9e892820e54182b06359f495cc42f261e455e3097413c605f0f208d7b6e3c2cd
SSDEEP 3072:BZOOxLE4GTnrcyG2QltfW/ggXi0+LStLnh5jAm7tJOX47cIA9:iOxLEbTtwLf
TLSH
T10CD3C5C1F5B84CB9F4F35A395429867285BFB83DF922864E2A94015D0E23DC38E257E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SVP7.PNG

Path C:\Program Files (x86)\Dropbox\Update\1.3.5055.162\SVP7.PNG
Size 195KB
SHA256 a9ea7566f183454d25ff53b6fc20d2fde9353ff37f78fd8757fb9d8f4f33d1cb
MD5 714172a59ff9e26309229af1e725dd8a
SHA1 d48f282a2be200165ffc3eab4bd47bf5906bfca1
SHA512 f29feaa3683f88304798b79e343835069264ae5476aa9bdb4e3b8d3555a939cb5f46156ff1218b627b88fa6d6e9239ea6899d52129182717e245df4d67e709b5
SSDEEP 3072:jDX38Jo4uaXUP/l4n5aNZtFhM4BpYMMIJ:jz8DuaEGniXF7
TLSH
T19414BE8D2EF00DCD1DF029D09D59866303ACCDA5F487B85CC99BFB86993374929D6A32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdate.dll

Path C:\Program Files (x86)\Dropbox\Update\1.3.5055.162\goopdate.dll
Size 42KB
SHA256 a7d07b13f6fc72ff905c69579f9be0cec237fc6df97b0d24e51ba44129831caa
MD5 511e3fa6ba5f836db6abb2504b7c33ab
SHA1 57167190667384d66baf9031dcddd917970e7e15
SHA512 59f568ee6edad89720c4a83e7580a16149c6e81059f71509e8765e30e9098827b40be0ee94ac0b130ede687eb53e81807ca42b48ffd55af67daac18f3c9f9829
SSDEEP 768:EKMh1TbnaCdR5LdcRzSW8PHTiyrk1n9oMRCUH:wTLdRN6Z8PLCn3RCU
TLSH
T1C2135B107540D073C14A6538A05ADBA18E6E7A111BF1A187BFBB1B7E9F712E0A73E347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD
Size 471B
SHA256 00325884d1fde9a8d35769ec1881a3bc8fab2dde89bb75a398cd857a935d6715
MD5 7aa9b84ab09200fea2d1d917d1ebb4ad
SHA1 72198ddf83017e73449485b65ad5eccdc7444fc4
SHA512 b947b0e0ae32be71114f92ddbe887cf4440b4a2e1ecf55715ec277b93519a439caa99b663ffa01b7167494de987c9b41eb978427186b3ef5d878750cb027a2e1
TLSH
T167F0DCA1805338746E058CEEBEE3EE08302896491DB2C1F73A9817A1DA143D1FEEE4D4
MD5 SHA1 SHA512 TLSH

Submit Download

ACF36929369259566C0D9BA6E8069883

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\ACF36929369259566C0D9BA6E8069883
Size 727B
SHA256 16e36ca0743af4d0a41fe25fcd1b31d0a15a071f4ad88bcb29cb7482f7ecffb6
MD5 684e5216717411339402e0d4c92abd67
SHA1 1ccac142514849b5281144a04852334253a0af95
SHA512 acf2025bf455f5d8fd2952a6f770f4c055b43e097907ff15699ebfd9f4f0664f16f629eb796f964ba48c0f538d67648ba5212306ed0689cad10a049ae0155d06
TLSH
T1810149F27D0C6413183F48D84EF46EB6A750A9900EC1D8D65F7C1859E488BD2CD045F5
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_7F584189DFCC61AA971930CA5AED3120

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_7F584189DFCC61AA971930CA5AED3120
Size 471B
SHA256 5dc1b97eba22e2619a680119b4b156e7f77f86987ceb2c73af73f6c73f0caa3e
MD5 51073a7f8dfbf12428c3f1cdacc820c7
SHA1 8623c8fe9f1d74cddd7e1640fadf2abd48227390
SHA512 6af018c3917033583fb9543697ab0964cc2c81ef4064f94efce3b52e58045dd3042481dd928fd35ba2bff44c66b00eeb7dfef46d30889f58f3df22a8daa5d549
TLSH
T190F0DC12C24EB0100F4BCCDE12924627B823607B4192C5A7AE6C54A5846C7BD6C29439
MD5 SHA1 SHA512 TLSH

Submit Download

3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3FE2BD01AB6BC312BF0DADE7F797388F_D700B3BF42AE699B26DDBDD3E4CB7EDD
Size 402B
SHA256 be8beefe56e6c6079d1dbd144a4eb958ec3939fffb5c51b8c0ed3581d18f4f97
MD5 7bb5adb8edfbeaf0e70137064694b248
SHA1 d664ba438b703dbe834b2eb84f5af6a5496ad778
SHA512 035016aa58d7361d3aea0d6f1a4d3f2290e201d820a4d8ee3f9aca9d29c47175f15f25def076d6cf992f2848f1cde05eb51630475a87267e0bfdbe7b0baede88
TLSH
T15CE0C0214DFF013CF0B1EA740FCA5635001BE1051C24837917B4160DB70B500DD76C35
MD5 SHA1 SHA512 TLSH

Submit Download

ACF36929369259566C0D9BA6E8069883

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\ACF36929369259566C0D9BA6E8069883
Size 400B
SHA256 c92953b25973ed5c76ac85e2c21ed34f0ce3dd0d68ea7d3feeb8f5f5bcf55f49
MD5 5654c307b9bb05166d60df59ded43468
SHA1 6388302cc854a582cb122f61c35b644f6a64669b
SHA512 e7141e1251e4f3aeca08f611b007fb74e41e4e5b48ce529ee43304a6ac5e1731e764bdc38d4e12c4e8bed4bd3d550fe120bd5b12ab5261f885dfe358db8c0495
TLSH
T16EE0C02433F4028DF461F77887E9F174467DF40528028EBF0220114CD6017000C6177B
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_7F584189DFCC61AA971930CA5AED3120

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_7F584189DFCC61AA971930CA5AED3120
Size 412B
SHA256 03f98b7fa45981736eb5fcdbe0efcc8e6ed14c2cc62a3a4ce0f1ffdb6bbcb327
MD5 b524a74a79aa8080c222fe23f9ae4ba3
SHA1 9f8d1351b4993d48715f64fff9c5c83180c85af8
SHA512 3f41237b7375cb545c1460126243dacd01c515db61b14b4a0c384df58dd7f4a43f75d34a69146d4a50d4e22af434d4c87894e0cbd8fba5ab503c2246fe241051
TLSH
T1DBE0C02011FA400CF5E4F0340ADF7A785D69F0360845B2B00BD45B0CA715F00DC11E3E
MD5 SHA1 SHA512 TLSH

Submit Download

SysUtilSvc.exe

Path C:\Windows\SysUtilSvc.exe
Size 4.1MB
SHA256 aff16f3e9908bc1836fe34b11181a2c700732b1606c7e7dafd145cef1538e58a
MD5 5de2101f461a2a78ee3c334ea0e8f409
SHA1 f806027c9f0e013bfda44a68deb88c4beafab5b6
SHA512 53e667d8e4903017e1df11371705e6e855d778902f348e67ad57aad5073322445fc7f86b2a7ad35d5e1abc20951b0d71c8a340eeb46181c8505c42e36e696e22
SSDEEP 98304:KFJFsscN/91jqYJ4X6ukFSd58b8jFCBgp+nMSNlnB6Woj9ghi1RebMIg9Cbk/V8N:eyqpo0d58bGeMSNlnB6WojDIg9Cbk/V8
TLSH
T14B168DE17F5D8067C163253189F9AE78B6FAAD60FA35024731503A3EFB317C2592861B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1716-18-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/1716-21-0x0000000002A50000-0x0000000002A79000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads