| File name: | nn.exe |
| Full analysis: | https://app.any.run/tasks/99242825-5194-4d82-9636-f5c74fe506c8 |
| Verdict: | Malicious activity |
| Threats: | FatalRAT is a malware that gives hackers remote access and control of the system and lets them steal sensitive information like login credentials and financial data. FatalRAT has been associated with cyber espionage campaigns, particularly targeting organizations in the Asia-Pacific (APAC) region. |
| Analysis date: | August 29, 2024, 15:41:32 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5: | D76A5ECC0D4D6D0A167E33A9C8060100 |
| SHA1: | 088B492F9B1E29C1FACE9416B8346E2C2156A9C2 |
| SHA256: | EB307DB4C9404CA7D49E93F6BC7242A7C029845052F5FE6C29CF41F29E3F327B |
| SSDEEP: | 3072:i8O1Nr/sH4nBYXWOvtjUOBddd4NZZZ62lasnRT77DNGgkgv5:i8O1N3nBEKZZZVtvQev |
MALICIOUS
GH0ST mutex has been found
- nn.exe (PID: 5284)
Connects to the CnC server
- nn.exe (PID: 5284)
FATALRAT has been detected (SURICATA)
- nn.exe (PID: 5284)
SUSPICIOUS
Drops the executable file immediately after the start
- nn.exe (PID: 1076)
Reads security settings of Internet Explorer
- nn.exe (PID: 1076)
Reads the date of Windows installation
- nn.exe (PID: 1076)
Executable content was dropped or overwritten
- nn.exe (PID: 1076)
Starts itself from another location
- nn.exe (PID: 1076)
Contacting a server suspected of hosting an CnC
- nn.exe (PID: 5284)
Connects to unusual port
- nn.exe (PID: 5284)
INFO
Creates files or folders in the user directory
- nn.exe (PID: 1076)
The process uses the downloaded file
- nn.exe (PID: 1076)
Checks supported languages
- nn.exe (PID: 1076)
- nn.exe (PID: 5284)
Process checks computer location settings
- nn.exe (PID: 1076)
Reads the computer name
- nn.exe (PID: 1076)
- nn.exe (PID: 5284)
Reads CPU info
- nn.exe (PID: 5284)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable MS Visual C++ (generic) (42.2) |
|---|---|---|
| .exe | | | Win64 Executable (generic) (37.3) |
| .dll | | | Win32 Dynamic Link Library (generic) (8.8) |
| .exe | | | Win32 Executable (generic) (6) |
| .exe | | | Generic Win/DOS Executable (2.7) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2021:04:20 08:04:19+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 20480 |
| InitializedDataSize: | 172032 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x1e70 |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
Total processes
127
Monitored processes
2
Malicious processes
2
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1076 | "C:\Users\admin\AppData\Local\Temp\nn.exe" | C:\Users\admin\AppData\Local\Temp\nn.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 5284 | "C:\Users\admin\AppData\Local\nn.exe" | C:\Users\admin\AppData\Local\nn.exe | nn.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 1073807364 Modules
| |||||||||||||||
Total events
4 126
Read events
4 111
Write events
15
Delete events
0
Modification events
| (PID) Process: | (1076) nn.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer |
| Operation: | write | Name: | SlowContextMenuEntries |
Value: 6024B221EA3A6910A2DC08002B30309D48010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000 | |||
| (PID) Process: | (1076) nn.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (1076) nn.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
| (PID) Process: | (1076) nn.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
| (PID) Process: | (1076) nn.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 0 | |||
| (PID) Process: | (5284) nn.exe | Key: | HKEY_CURRENT_USER\System\CurrentControlSet\Services\Stuvwx Abcdefgh |
| Operation: | write | Name: | Group |
Value: Fatal | |||
| (PID) Process: | (5284) nn.exe | Key: | HKEY_CURRENT_USER\System\CurrentControlSet\Services\Stuvwx Abcdefgh |
| Operation: | write | Name: | InstallTime |
Value: 2024-08-29 15:41 | |||
| (PID) Process: | (5284) nn.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\DirectDraw\MostRecentApplication |
| Operation: | write | Name: | Name |
Value: nn.exe | |||
| (PID) Process: | (5284) nn.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\DirectDraw\MostRecentApplication |
| Operation: | write | Name: | ID |
Value: | |||
Executable files
1
Suspicious files
0
Text files
0
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 1076 | nn.exe | C:\Users\admin\AppData\Local\nn.exe | executable | |
MD5:D76A5ECC0D4D6D0A167E33A9C8060100 | SHA256:EB307DB4C9404CA7D49E93F6BC7242A7C029845052F5FE6C29CF41F29E3F327B | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
12
DNS requests
6
Threats
4
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
6276 | RUXIMICS.exe | 40.127.240.158:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
2120 | MoUsoCoreWorker.exe | 40.127.240.158:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
6052 | svchost.exe | 40.127.240.158:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
5284 | nn.exe | 18.177.76.42:11183 | 0.tcp.jp.ngrok.io | AMAZON-02 | JP | malicious |
6052 | svchost.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
2120 | MoUsoCoreWorker.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
3888 | svchost.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
6052 | svchost.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
0.tcp.jp.ngrok.io |
| malicious |
settings-win.data.microsoft.com |
| whitelisted |
self.events.data.microsoft.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
2256 | svchost.exe | Misc activity | ET INFO DNS Query to a *.ngrok domain (ngrok.io) |
5284 | nn.exe | A Network Trojan was detected | AV TROJAN FatalRAT CnC Request |
5284 | nn.exe | Malware Command and Control Activity Detected | ET MALWARE FatalRAT CnC Activity |
5284 | nn.exe | Malware Command and Control Activity Detected | ET MALWARE FatalRAT CnC Activity |
Process | Message |
|---|---|
nn.exe | SVP7-Thread running...
|
nn.exe | SVP7-Thread running...
|
nn.exe | SVP7-Thread running...
|
nn.exe | SVP7-Thread running...
|
nn.exe | SVP7-Thread running...
|
nn.exe | SVP7-Thread running...
|
nn.exe | SVP7-Thread running...
|
nn.exe | SVP7-Thread running...
|
nn.exe | SVP7-Thread running...
|
nn.exe | SVP7-Thread running...
|