Malware Analysis Report

2025-03-15 03:51

Sample ID 230823-eswy8ahf68
Target Wps.exe
SHA256 de33644dcb241185d89c7606a8fc7239a274ad277c7b9abf5778736edcb674a9
Tags
upx fatalrat infostealer persistence rat gh0strat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

de33644dcb241185d89c7606a8fc7239a274ad277c7b9abf5778736edcb674a9

Threat Level: Known bad

The file Wps.exe was found to be: Known bad.

Malicious Activity Summary

upx fatalrat infostealer persistence rat gh0strat

FatalRat

Gh0st RAT payload

Gh0strat

Fatal Rat payload

Downloads MZ/PE file

UPX packed file

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Modifies registry class

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-08-23 04:12

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-08-23 04:12

Reported

2023-08-23 04:15

Platform

win10-20230703-en

Max time kernel

127s

Max time network

144s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Wps.exe"

Signatures

FatalRat

infostealer rat fatalrat

Fatal Rat payload

rat infostealer
Description Indicator Process Target
N/A N/A N/A N/A

Downloads MZ/PE file

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\uu6.exe N/A
N/A N/A C:\Users\Public\Documents\123\PTvrst.exe N/A
N/A N/A C:\WINDOWS\DNomb\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Therecontinuous = "C:\\WINDOWS\\DNomb\\PTvrst.exe" C:\Users\Public\Documents\123\PTvrst.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ϵͳ×é¼þ = "C:\\Users\\Public\\Documents\\123\\PTvrst.exe" C:\WINDOWS\DNomb\spolsvt.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Public\Documents\123\PTvrst.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4728 set thread context of 1288 N/A C:\Users\Public\Documents\123\PTvrst.exe C:\WINDOWS\DNomb\spolsvt.exe
PID 1288 set thread context of 3320 N/A C:\WINDOWS\DNomb\spolsvt.exe C:\Users\Public\Documents\t\spolsvt.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ja-jp\ui-strings.js C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ro-ro\ui-strings.js C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ar-ae C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\close.svg C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\css C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\uk-ua\ui-strings.js C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\fr-fr\ui-strings.js C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\it-it C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\DirectInk.dll C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\nb-no\ui-strings.js C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\pl-pl\ui-strings.js C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\he-il C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\Info2x.png C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\Words.pdf C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_sortedby_up_selected_18.svg C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\eu-es C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\nb-no C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\arrow-up-pressed.gif C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\fr-fr\ui-strings.js C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\sv-se C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-ae C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\sv-se\ui-strings.js C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Scan_visual.svg C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sl-si C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\tr-tr C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ca-es C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\es-es\ui-strings.js C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\FillSign.aapp C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\A12_Spinner.gif C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ko-kr C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\zh-cn\ui-strings.js C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\es-es C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\es-es C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\fr-fr\PlayStore_icon.svg C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ja-jp\ui-strings.js C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_anonymoususer_18.svg C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\de-de C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ko-kr\ui-strings.js C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\root\ui-strings.js C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\fi-fi C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\da-dk\ui-strings.js C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AXSLE.dll C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\selection-actions2x.png C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\s_agreement_filetype.svg C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\fr-ma\ui-strings.js C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\arrow-right.png C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\zh-cn\ui-strings.js C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\de-de\ui-strings.js C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\home-view C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\css C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\zh-cn\ui-strings.js C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\print_poster.png C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\large_trefoil.png C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\fr-fr C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\fi-fi C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\it-it\ui-strings.js C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\css\main-selector.css C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\core_icons__retina_hiContrast_bow.png C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_signed_out.svg C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-il C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\DNomb\Mpec.mbt C:\Program Files (x86)\uu6.exe N/A
File created C:\Windows\DNomb\spolsvt.exe C:\Program Files (x86)\uu6.exe N/A
File created C:\Windows\DNomb\PTvrst.exe C:\Program Files (x86)\uu6.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1766410430-2870137818-4067673745-1000_Classes\Local Settings C:\Program Files (x86)\uu6.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\uu6.exe N/A
N/A N/A C:\Program Files (x86)\uu6.exe N/A
N/A N/A C:\Program Files (x86)\uu6.exe N/A
N/A N/A C:\Program Files (x86)\uu6.exe N/A
N/A N/A C:\Program Files (x86)\uu6.exe N/A
N/A N/A C:\Program Files (x86)\uu6.exe N/A
N/A N/A C:\Program Files (x86)\uu6.exe N/A
N/A N/A C:\Program Files (x86)\uu6.exe N/A
N/A N/A C:\Users\Public\Documents\123\PTvrst.exe N/A
N/A N/A C:\Users\Public\Documents\123\PTvrst.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Public\Documents\t\spolsvt.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\uu6.exe N/A
N/A N/A C:\Program Files (x86)\uu6.exe N/A
N/A N/A C:\Users\Public\Documents\123\PTvrst.exe N/A
N/A N/A C:\Users\Public\Documents\123\PTvrst.exe N/A
N/A N/A C:\WINDOWS\DNomb\spolsvt.exe N/A
N/A N/A C:\WINDOWS\DNomb\spolsvt.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2908 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\Temp\Wps.exe C:\Program Files (x86)\uu6.exe
PID 2908 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\Temp\Wps.exe C:\Program Files (x86)\uu6.exe
PID 2908 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\Temp\Wps.exe C:\Program Files (x86)\uu6.exe
PID 4728 wrote to memory of 1288 N/A C:\Users\Public\Documents\123\PTvrst.exe C:\WINDOWS\DNomb\spolsvt.exe
PID 4728 wrote to memory of 1288 N/A C:\Users\Public\Documents\123\PTvrst.exe C:\WINDOWS\DNomb\spolsvt.exe
PID 4728 wrote to memory of 1288 N/A C:\Users\Public\Documents\123\PTvrst.exe C:\WINDOWS\DNomb\spolsvt.exe
PID 4728 wrote to memory of 1288 N/A C:\Users\Public\Documents\123\PTvrst.exe C:\WINDOWS\DNomb\spolsvt.exe
PID 4728 wrote to memory of 1288 N/A C:\Users\Public\Documents\123\PTvrst.exe C:\WINDOWS\DNomb\spolsvt.exe
PID 4728 wrote to memory of 1288 N/A C:\Users\Public\Documents\123\PTvrst.exe C:\WINDOWS\DNomb\spolsvt.exe
PID 4728 wrote to memory of 1288 N/A C:\Users\Public\Documents\123\PTvrst.exe C:\WINDOWS\DNomb\spolsvt.exe
PID 4728 wrote to memory of 1288 N/A C:\Users\Public\Documents\123\PTvrst.exe C:\WINDOWS\DNomb\spolsvt.exe
PID 4728 wrote to memory of 1288 N/A C:\Users\Public\Documents\123\PTvrst.exe C:\WINDOWS\DNomb\spolsvt.exe
PID 1288 wrote to memory of 3320 N/A C:\WINDOWS\DNomb\spolsvt.exe C:\Users\Public\Documents\t\spolsvt.exe
PID 1288 wrote to memory of 3320 N/A C:\WINDOWS\DNomb\spolsvt.exe C:\Users\Public\Documents\t\spolsvt.exe
PID 1288 wrote to memory of 3320 N/A C:\WINDOWS\DNomb\spolsvt.exe C:\Users\Public\Documents\t\spolsvt.exe
PID 1288 wrote to memory of 3320 N/A C:\WINDOWS\DNomb\spolsvt.exe C:\Users\Public\Documents\t\spolsvt.exe
PID 1288 wrote to memory of 3320 N/A C:\WINDOWS\DNomb\spolsvt.exe C:\Users\Public\Documents\t\spolsvt.exe
PID 1288 wrote to memory of 3320 N/A C:\WINDOWS\DNomb\spolsvt.exe C:\Users\Public\Documents\t\spolsvt.exe
PID 1288 wrote to memory of 3320 N/A C:\WINDOWS\DNomb\spolsvt.exe C:\Users\Public\Documents\t\spolsvt.exe
PID 1288 wrote to memory of 3320 N/A C:\WINDOWS\DNomb\spolsvt.exe C:\Users\Public\Documents\t\spolsvt.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Wps.exe

"C:\Users\Admin\AppData\Local\Temp\Wps.exe"

C:\Program Files (x86)\uu6.exe

"C:\Program Files (x86)\uu6.exe"

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Users\Public\Documents\123\PTvrst.exe

"C:\Users\Public\Documents\123\PTvrst.exe"

C:\WINDOWS\DNomb\spolsvt.exe

C:\WINDOWS\DNomb\spolsvt.exe

C:\Users\Public\Documents\t\spolsvt.exe

C:\Users\Public\Documents\t\spolsvt.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 sidamingzhu.oss-cn-hongkong.aliyuncs.com udp
HK 47.75.19.36:443 sidamingzhu.oss-cn-hongkong.aliyuncs.com tcp
US 8.8.8.8:53 36.19.75.47.in-addr.arpa udp
US 8.8.8.8:53 8.3.197.209.in-addr.arpa udp
US 8.8.8.8:53 226.21.18.104.in-addr.arpa udp
US 8.8.8.8:53 226.20.18.104.in-addr.arpa udp
US 8.8.8.8:53 h1.wccabc.com udp
HK 8.218.53.227:3927 h1.wccabc.com tcp
US 8.8.8.8:53 227.53.218.8.in-addr.arpa udp
US 8.8.8.8:53 0.77.109.52.in-addr.arpa udp
US 8.8.8.8:53 38.148.119.40.in-addr.arpa udp

Files

memory/2908-120-0x0000000000400000-0x000000000047F000-memory.dmp

C:\Program Files (x86)\uu6.exe

MD5 46a9d07a97b5b35bfb3d61509b4110bb
SHA1 a4fc26da50e1f06782fbfb1a46368600e881c66e
SHA256 7916c0b39135619a5f8cbc0c71ea762e6e65624c7c85ccd5900039bbb5e056ba
SHA512 50a4adcf22cacf43df14fc6e7730cce535f3718775aaee6fc5b71f80db6cdd66a8738dcf71daa09b199b1066d880942215d67fb986c37ba6998a11210681101a

C:\Program Files (x86)\uu6.exe

MD5 46a9d07a97b5b35bfb3d61509b4110bb
SHA1 a4fc26da50e1f06782fbfb1a46368600e881c66e
SHA256 7916c0b39135619a5f8cbc0c71ea762e6e65624c7c85ccd5900039bbb5e056ba
SHA512 50a4adcf22cacf43df14fc6e7730cce535f3718775aaee6fc5b71f80db6cdd66a8738dcf71daa09b199b1066d880942215d67fb986c37ba6998a11210681101a

memory/2248-128-0x0000000000400000-0x0000000000688000-memory.dmp

memory/2908-142-0x0000000000400000-0x000000000047F000-memory.dmp

memory/2248-144-0x0000000000400000-0x0000000000688000-memory.dmp

memory/2248-145-0x0000000000400000-0x0000000000688000-memory.dmp

C:\Users\Public\Documents\123\PTvrst.exe

MD5 d22cfb5bfaeb1503b12b07e53ef0a149
SHA1 8ea2c85e363f551a159fabd65377affed4e417a1
SHA256 260464fb05210cfb30ef7a12d568f75eb781634b251d958cae8911948f6ca360
SHA512 151024cb2960b1ee485ded7ccbb753fe368a93fda5699af72e568667fa54bfb0d1732444e7b60efaab6d372204157cdb6abbf8862d0e89d612dd963342215e45

C:\Users\Public\Documents\123\PTvrst.exe

MD5 d22cfb5bfaeb1503b12b07e53ef0a149
SHA1 8ea2c85e363f551a159fabd65377affed4e417a1
SHA256 260464fb05210cfb30ef7a12d568f75eb781634b251d958cae8911948f6ca360
SHA512 151024cb2960b1ee485ded7ccbb753fe368a93fda5699af72e568667fa54bfb0d1732444e7b60efaab6d372204157cdb6abbf8862d0e89d612dd963342215e45

memory/4728-148-0x0000000000400000-0x00000000006A2000-memory.dmp

memory/2248-149-0x0000000000400000-0x0000000000688000-memory.dmp

memory/4728-153-0x00000000777A4000-0x00000000777A5000-memory.dmp

memory/4728-154-0x00000000047B0000-0x00000000047B1000-memory.dmp

memory/4728-155-0x0000000000400000-0x00000000006A2000-memory.dmp

memory/4728-156-0x0000000004730000-0x0000000004731000-memory.dmp

memory/4728-157-0x0000000004780000-0x0000000004781000-memory.dmp

memory/4728-160-0x00000000047A0000-0x00000000047A1000-memory.dmp

C:\WINDOWS\DNomb\Mpec.mbt

MD5 6894403c7124ed7b24d6a6fc7158cb4e
SHA1 802290c110dd05631e2dda8ba18bfbfccaa10331
SHA256 21d81876aa65d400a3569f3db177435718f94aa7e7e47448319e704894b17f72
SHA512 38e7214f8cf1944650512d53fbb03f9de8ff5c52717445b376f603a462ea55ddd8a199a71f00d4b0b293271c475fc72a111ff9028e5029e72d85a39bfa4c2f01

memory/4728-158-0x0000000004760000-0x0000000004761000-memory.dmp

memory/1288-163-0x0000000000400000-0x0000000000516000-memory.dmp

memory/4728-165-0x0000000004790000-0x0000000004791000-memory.dmp

memory/4728-167-0x00000000047C0000-0x00000000047C1000-memory.dmp

memory/4728-169-0x0000000004720000-0x0000000004721000-memory.dmp

memory/4728-170-0x0000000004770000-0x0000000004771000-memory.dmp

memory/4728-172-0x00000000047E0000-0x00000000047E1000-memory.dmp

memory/4728-176-0x00000000048F0000-0x00000000048F1000-memory.dmp

memory/4728-178-0x0000000004880000-0x0000000004881000-memory.dmp

memory/4728-179-0x0000000004920000-0x0000000004921000-memory.dmp

memory/4728-180-0x0000000004930000-0x0000000004931000-memory.dmp

memory/4728-181-0x0000000004A70000-0x0000000004A72000-memory.dmp

memory/4728-184-0x0000000004910000-0x0000000004911000-memory.dmp

memory/4728-185-0x0000000004890000-0x0000000004891000-memory.dmp

memory/4728-183-0x0000000004830000-0x0000000004832000-memory.dmp

memory/1288-177-0x0000000000400000-0x0000000000516000-memory.dmp

memory/4728-186-0x0000000004870000-0x0000000004872000-memory.dmp

memory/1288-175-0x0000000000400000-0x0000000000516000-memory.dmp

C:\WINDOWS\DNomb\spolsvt.exe

MD5 523d5c39f9d8d2375c3df68251fa2249
SHA1 d4ed365c44bec9246fc1a65a32a7791792647a10
SHA256 20e3dc90a3e83b6202e2a7f4603b60e5e859639cb68693426c400b13aaeabd78
SHA512 526e1bba30d03f1ac177c6ab7409187a730969c429cebef15da68ffcf44b3b93227781eebc827b2f7a0fa17c391e00a0e532263fd0167aeaeb0456f96cfe3ae4

C:\Windows\DNomb\spolsvt.exe

MD5 523d5c39f9d8d2375c3df68251fa2249
SHA1 d4ed365c44bec9246fc1a65a32a7791792647a10
SHA256 20e3dc90a3e83b6202e2a7f4603b60e5e859639cb68693426c400b13aaeabd78
SHA512 526e1bba30d03f1ac177c6ab7409187a730969c429cebef15da68ffcf44b3b93227781eebc827b2f7a0fa17c391e00a0e532263fd0167aeaeb0456f96cfe3ae4

memory/1288-168-0x0000000000400000-0x0000000000516000-memory.dmp

memory/1288-166-0x0000000000400000-0x0000000000516000-memory.dmp

memory/1288-164-0x0000000000400000-0x0000000000516000-memory.dmp

memory/4728-162-0x0000000004740000-0x0000000004741000-memory.dmp

memory/2908-189-0x0000000000400000-0x000000000047F000-memory.dmp

memory/3320-191-0x0000000000400000-0x0000000000430000-memory.dmp

memory/3320-192-0x0000000000400000-0x0000000000430000-memory.dmp

memory/3320-193-0x0000000000400000-0x0000000000430000-memory.dmp

memory/3320-197-0x0000000000400000-0x0000000000430000-memory.dmp

C:\Users\Public\Documents\t\spolsvt.exe

MD5 cdce4713e784ae069d73723034a957ff
SHA1 9a393a6bab6568f1a774fb753353223f11367e09
SHA256 b29e48102ecb3d3614e8980a8b8cc63dd2b993c6346f466479244ec2b47b69d8
SHA512 0a3a59a305cc2a6fad4e1315b0bcc5a4129595dfe1e8b703363fa02528d2d7c48d3fd22d365708be84a5557cf1916873df9563c454732f93f94a66e7e3b9fb0f

C:\Users\Public\Documents\t\spolsvt.exe

MD5 cdce4713e784ae069d73723034a957ff
SHA1 9a393a6bab6568f1a774fb753353223f11367e09
SHA256 b29e48102ecb3d3614e8980a8b8cc63dd2b993c6346f466479244ec2b47b69d8
SHA512 0a3a59a305cc2a6fad4e1315b0bcc5a4129595dfe1e8b703363fa02528d2d7c48d3fd22d365708be84a5557cf1916873df9563c454732f93f94a66e7e3b9fb0f

memory/3320-198-0x0000000010000000-0x000000001002A000-memory.dmp

memory/4728-203-0x0000000000400000-0x00000000006A2000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-08-23 04:12

Reported

2023-08-23 04:15

Platform

win7-20230712-en

Max time kernel

148s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Wps.exe"

Signatures

FatalRat

infostealer rat fatalrat

Gh0st RAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0strat

rat gh0strat

Fatal Rat payload

rat infostealer
Description Indicator Process Target
N/A N/A N/A N/A

Downloads MZ/PE file

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\uu6.exe N/A
N/A N/A C:\Users\Public\Documents\123\PTvrst.exe N/A
N/A N/A C:\WINDOWS\DNomb\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Therecontinuous = "C:\\WINDOWS\\DNomb\\PTvrst.exe" C:\Users\Public\Documents\123\PTvrst.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ϵͳ×é¼þ = "C:\\Users\\Public\\Documents\\123\\PTvrst.exe" C:\WINDOWS\DNomb\spolsvt.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Public\Documents\123\PTvrst.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1664 set thread context of 1192 N/A C:\Users\Public\Documents\123\PTvrst.exe C:\WINDOWS\DNomb\spolsvt.exe
PID 1192 set thread context of 3044 N/A C:\WINDOWS\DNomb\spolsvt.exe C:\Users\Public\Documents\t\spolsvt.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.pdf C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\AdobeID.pdf C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm.api C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\pmd.cer C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\ADMPlugin.apl C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\EScript.api C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\IA32.api C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\authplay.dll C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOffNotificationInTray.gif C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\atl.dll C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\logsession.dll C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Accessibility.api C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\2d.x3d C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_browser.gif C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_lg.gif C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\AUMProduct.aup C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Checkers.api C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Search5.api C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\pdf.gif C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_same_reviewers.gif C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AXE8SharedExpat.dll C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\AdobePDF417.pmp C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\HLS.api C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\Real.mpp C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\Flash.mpp C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\QuickTime.mpp C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\VDK10.STP C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\ViewerPS.dll C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\JSByteCodeWin.bin C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\VDK10.STD C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\drvSOFT.x3d C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\ended_review_or_form.gif C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\submission_history.gif C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeUpdater.dll C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\cryptocme2.sig C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\PDFSigQFormalRep.pdf C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_shared.gif C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\DefaultID.pdf C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\eBook.api C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\drvDX9.x3d C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\vdk150.dll C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroSign.prc C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\ReadOutLoud.api C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Spelling.api C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\VDK10.CMP C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\drvDX8.x3d C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\end_review.gif C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\sqlite.dll C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\uu6.exe C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\icucnv36.dll C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\README.TXT C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\adobepdf.xdc C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annots.api C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\DNomb\Mpec.mbt C:\Program Files (x86)\uu6.exe N/A
File created C:\Windows\DNomb\spolsvt.exe C:\Program Files (x86)\uu6.exe N/A
File created C:\Windows\DNomb\PTvrst.exe C:\Program Files (x86)\uu6.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\uu6.exe N/A
N/A N/A C:\Program Files (x86)\uu6.exe N/A
N/A N/A C:\Program Files (x86)\uu6.exe N/A
N/A N/A C:\Program Files (x86)\uu6.exe N/A
N/A N/A C:\Users\Public\Documents\123\PTvrst.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\WINDOWS\DNomb\spolsvt.exe N/A
N/A N/A C:\WINDOWS\DNomb\spolsvt.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Public\Documents\t\spolsvt.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\uu6.exe N/A
N/A N/A C:\Program Files (x86)\uu6.exe N/A
N/A N/A C:\Users\Public\Documents\123\PTvrst.exe N/A
N/A N/A C:\Users\Public\Documents\123\PTvrst.exe N/A
N/A N/A C:\WINDOWS\DNomb\spolsvt.exe N/A
N/A N/A C:\WINDOWS\DNomb\spolsvt.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2436 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\Wps.exe C:\Program Files (x86)\uu6.exe
PID 2436 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\Wps.exe C:\Program Files (x86)\uu6.exe
PID 2436 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\Wps.exe C:\Program Files (x86)\uu6.exe
PID 2436 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\Wps.exe C:\Program Files (x86)\uu6.exe
PID 1664 wrote to memory of 1192 N/A C:\Users\Public\Documents\123\PTvrst.exe C:\WINDOWS\DNomb\spolsvt.exe
PID 1664 wrote to memory of 1192 N/A C:\Users\Public\Documents\123\PTvrst.exe C:\WINDOWS\DNomb\spolsvt.exe
PID 1664 wrote to memory of 1192 N/A C:\Users\Public\Documents\123\PTvrst.exe C:\WINDOWS\DNomb\spolsvt.exe
PID 1664 wrote to memory of 1192 N/A C:\Users\Public\Documents\123\PTvrst.exe C:\WINDOWS\DNomb\spolsvt.exe
PID 1664 wrote to memory of 1192 N/A C:\Users\Public\Documents\123\PTvrst.exe C:\WINDOWS\DNomb\spolsvt.exe
PID 1664 wrote to memory of 1192 N/A C:\Users\Public\Documents\123\PTvrst.exe C:\WINDOWS\DNomb\spolsvt.exe
PID 1664 wrote to memory of 1192 N/A C:\Users\Public\Documents\123\PTvrst.exe C:\WINDOWS\DNomb\spolsvt.exe
PID 1664 wrote to memory of 1192 N/A C:\Users\Public\Documents\123\PTvrst.exe C:\WINDOWS\DNomb\spolsvt.exe
PID 1664 wrote to memory of 1192 N/A C:\Users\Public\Documents\123\PTvrst.exe C:\WINDOWS\DNomb\spolsvt.exe
PID 1664 wrote to memory of 1192 N/A C:\Users\Public\Documents\123\PTvrst.exe C:\WINDOWS\DNomb\spolsvt.exe
PID 1664 wrote to memory of 1192 N/A C:\Users\Public\Documents\123\PTvrst.exe C:\WINDOWS\DNomb\spolsvt.exe
PID 1664 wrote to memory of 1192 N/A C:\Users\Public\Documents\123\PTvrst.exe C:\WINDOWS\DNomb\spolsvt.exe
PID 1664 wrote to memory of 1192 N/A C:\Users\Public\Documents\123\PTvrst.exe C:\WINDOWS\DNomb\spolsvt.exe
PID 1192 wrote to memory of 3044 N/A C:\WINDOWS\DNomb\spolsvt.exe C:\Users\Public\Documents\t\spolsvt.exe
PID 1192 wrote to memory of 3044 N/A C:\WINDOWS\DNomb\spolsvt.exe C:\Users\Public\Documents\t\spolsvt.exe
PID 1192 wrote to memory of 3044 N/A C:\WINDOWS\DNomb\spolsvt.exe C:\Users\Public\Documents\t\spolsvt.exe
PID 1192 wrote to memory of 3044 N/A C:\WINDOWS\DNomb\spolsvt.exe C:\Users\Public\Documents\t\spolsvt.exe
PID 1192 wrote to memory of 3044 N/A C:\WINDOWS\DNomb\spolsvt.exe C:\Users\Public\Documents\t\spolsvt.exe
PID 1192 wrote to memory of 3044 N/A C:\WINDOWS\DNomb\spolsvt.exe C:\Users\Public\Documents\t\spolsvt.exe
PID 1192 wrote to memory of 3044 N/A C:\WINDOWS\DNomb\spolsvt.exe C:\Users\Public\Documents\t\spolsvt.exe
PID 1192 wrote to memory of 3044 N/A C:\WINDOWS\DNomb\spolsvt.exe C:\Users\Public\Documents\t\spolsvt.exe
PID 1192 wrote to memory of 3044 N/A C:\WINDOWS\DNomb\spolsvt.exe C:\Users\Public\Documents\t\spolsvt.exe
PID 1192 wrote to memory of 3044 N/A C:\WINDOWS\DNomb\spolsvt.exe C:\Users\Public\Documents\t\spolsvt.exe
PID 1192 wrote to memory of 3044 N/A C:\WINDOWS\DNomb\spolsvt.exe C:\Users\Public\Documents\t\spolsvt.exe
PID 1192 wrote to memory of 3044 N/A C:\WINDOWS\DNomb\spolsvt.exe C:\Users\Public\Documents\t\spolsvt.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Wps.exe

"C:\Users\Admin\AppData\Local\Temp\Wps.exe"

C:\Program Files (x86)\uu6.exe

"C:\Program Files (x86)\uu6.exe"

C:\Users\Public\Documents\123\PTvrst.exe

"C:\Users\Public\Documents\123\PTvrst.exe"

C:\WINDOWS\DNomb\spolsvt.exe

C:\WINDOWS\DNomb\spolsvt.exe

C:\Users\Public\Documents\t\spolsvt.exe

C:\Users\Public\Documents\t\spolsvt.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 sidamingzhu.oss-cn-hongkong.aliyuncs.com udp
HK 47.75.19.36:443 sidamingzhu.oss-cn-hongkong.aliyuncs.com tcp
US 8.8.8.8:53 h1.wccabc.com udp
HK 8.218.53.227:3927 h1.wccabc.com tcp
US 8.8.8.8:53 www.microsoft.com udp
NL 104.85.1.163:80 www.microsoft.com tcp
HK 8.218.53.227:3927 h1.wccabc.com tcp

Files

memory/2436-54-0x0000000000400000-0x000000000047F000-memory.dmp

\Program Files (x86)\uu6.exe

MD5 46a9d07a97b5b35bfb3d61509b4110bb
SHA1 a4fc26da50e1f06782fbfb1a46368600e881c66e
SHA256 7916c0b39135619a5f8cbc0c71ea762e6e65624c7c85ccd5900039bbb5e056ba
SHA512 50a4adcf22cacf43df14fc6e7730cce535f3718775aaee6fc5b71f80db6cdd66a8738dcf71daa09b199b1066d880942215d67fb986c37ba6998a11210681101a

C:\Program Files (x86)\uu6.exe

MD5 46a9d07a97b5b35bfb3d61509b4110bb
SHA1 a4fc26da50e1f06782fbfb1a46368600e881c66e
SHA256 7916c0b39135619a5f8cbc0c71ea762e6e65624c7c85ccd5900039bbb5e056ba
SHA512 50a4adcf22cacf43df14fc6e7730cce535f3718775aaee6fc5b71f80db6cdd66a8738dcf71daa09b199b1066d880942215d67fb986c37ba6998a11210681101a

memory/2436-64-0x00000000026C0000-0x0000000002948000-memory.dmp

C:\Program Files (x86)\uu6.exe

MD5 46a9d07a97b5b35bfb3d61509b4110bb
SHA1 a4fc26da50e1f06782fbfb1a46368600e881c66e
SHA256 7916c0b39135619a5f8cbc0c71ea762e6e65624c7c85ccd5900039bbb5e056ba
SHA512 50a4adcf22cacf43df14fc6e7730cce535f3718775aaee6fc5b71f80db6cdd66a8738dcf71daa09b199b1066d880942215d67fb986c37ba6998a11210681101a

memory/2644-65-0x0000000000400000-0x0000000000688000-memory.dmp

memory/2436-83-0x0000000000400000-0x000000000047F000-memory.dmp

memory/2436-84-0x00000000026C0000-0x0000000002948000-memory.dmp

C:\Users\Public\Documents\123\PTvrst.exe

MD5 d22cfb5bfaeb1503b12b07e53ef0a149
SHA1 8ea2c85e363f551a159fabd65377affed4e417a1
SHA256 260464fb05210cfb30ef7a12d568f75eb781634b251d958cae8911948f6ca360
SHA512 151024cb2960b1ee485ded7ccbb753fe368a93fda5699af72e568667fa54bfb0d1732444e7b60efaab6d372204157cdb6abbf8862d0e89d612dd963342215e45

C:\Users\Public\Documents\123\PTvrst.exe

MD5 d22cfb5bfaeb1503b12b07e53ef0a149
SHA1 8ea2c85e363f551a159fabd65377affed4e417a1
SHA256 260464fb05210cfb30ef7a12d568f75eb781634b251d958cae8911948f6ca360
SHA512 151024cb2960b1ee485ded7ccbb753fe368a93fda5699af72e568667fa54bfb0d1732444e7b60efaab6d372204157cdb6abbf8862d0e89d612dd963342215e45

memory/2644-87-0x0000000000400000-0x0000000000688000-memory.dmp

memory/1664-89-0x0000000000400000-0x00000000006A2000-memory.dmp

memory/2644-90-0x0000000000400000-0x0000000000688000-memory.dmp

\Program Files (x86)\WPS_Installer.exe

MD5 b52ba2b99108c496389ae5bb81fa6537
SHA1 9073d8c4a1968be24357862015519f2afecd833a
SHA256 c6ac7d9add40b913112b265d4f366d9ef80bbd711049db085fc750fcad4e14d8
SHA512 6637506ee80d359e729e0011b97e8d827e14356393193247f502b7fcfbbca249dc045b8acfe4b31ce462468f421dc5d9a4e31183bedb66c45a9aa43c01f81397

memory/2436-94-0x00000000026C0000-0x00000000026D0000-memory.dmp

memory/1664-96-0x00000000779B0000-0x00000000779B2000-memory.dmp

memory/2436-97-0x0000000000400000-0x000000000047F000-memory.dmp

memory/1664-100-0x00000000042A0000-0x00000000042A1000-memory.dmp

memory/1664-99-0x0000000004210000-0x0000000004211000-memory.dmp

memory/1664-98-0x0000000004300000-0x0000000004301000-memory.dmp

memory/1664-109-0x00000000042D0000-0x00000000042D1000-memory.dmp

memory/1664-117-0x0000000004380000-0x0000000004381000-memory.dmp

memory/1664-116-0x0000000004350000-0x0000000004351000-memory.dmp

memory/1664-115-0x00000000042C0000-0x00000000042C1000-memory.dmp

memory/1664-114-0x0000000004280000-0x0000000004281000-memory.dmp

memory/1664-113-0x00000000041D0000-0x00000000041D1000-memory.dmp

memory/1664-112-0x0000000004370000-0x0000000004371000-memory.dmp

memory/1664-111-0x0000000004320000-0x0000000004321000-memory.dmp

memory/1664-110-0x00000000042B0000-0x00000000042B1000-memory.dmp

memory/1664-108-0x0000000004290000-0x0000000004291000-memory.dmp

memory/1664-107-0x0000000004200000-0x0000000004201000-memory.dmp

memory/1664-106-0x0000000004310000-0x0000000004311000-memory.dmp

memory/1664-105-0x0000000004230000-0x0000000004231000-memory.dmp

memory/1664-104-0x00000000042E0000-0x00000000042E2000-memory.dmp

memory/1664-103-0x0000000004240000-0x0000000004241000-memory.dmp

memory/1664-102-0x00000000042F0000-0x00000000042F1000-memory.dmp

memory/1664-101-0x0000000004270000-0x0000000004271000-memory.dmp

memory/1664-118-0x0000000000400000-0x00000000006A2000-memory.dmp

C:\WINDOWS\DNomb\Mpec.mbt

MD5 6894403c7124ed7b24d6a6fc7158cb4e
SHA1 802290c110dd05631e2dda8ba18bfbfccaa10331
SHA256 21d81876aa65d400a3569f3db177435718f94aa7e7e47448319e704894b17f72
SHA512 38e7214f8cf1944650512d53fbb03f9de8ff5c52717445b376f603a462ea55ddd8a199a71f00d4b0b293271c475fc72a111ff9028e5029e72d85a39bfa4c2f01

C:\WINDOWS\DNomb\spolsvt.exe

MD5 523d5c39f9d8d2375c3df68251fa2249
SHA1 d4ed365c44bec9246fc1a65a32a7791792647a10
SHA256 20e3dc90a3e83b6202e2a7f4603b60e5e859639cb68693426c400b13aaeabd78
SHA512 526e1bba30d03f1ac177c6ab7409187a730969c429cebef15da68ffcf44b3b93227781eebc827b2f7a0fa17c391e00a0e532263fd0167aeaeb0456f96cfe3ae4

memory/1664-120-0x00000000041E0000-0x00000000041E1000-memory.dmp

\Windows\DNomb\spolsvt.exe

MD5 523d5c39f9d8d2375c3df68251fa2249
SHA1 d4ed365c44bec9246fc1a65a32a7791792647a10
SHA256 20e3dc90a3e83b6202e2a7f4603b60e5e859639cb68693426c400b13aaeabd78
SHA512 526e1bba30d03f1ac177c6ab7409187a730969c429cebef15da68ffcf44b3b93227781eebc827b2f7a0fa17c391e00a0e532263fd0167aeaeb0456f96cfe3ae4

memory/1192-123-0x0000000000400000-0x0000000000516000-memory.dmp

memory/1192-125-0x0000000000400000-0x0000000000516000-memory.dmp

memory/1192-127-0x0000000000400000-0x0000000000516000-memory.dmp

memory/1192-130-0x0000000000400000-0x0000000000516000-memory.dmp

memory/1192-133-0x0000000000400000-0x0000000000516000-memory.dmp

memory/1192-136-0x0000000000400000-0x0000000000516000-memory.dmp

memory/1192-137-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

C:\Windows\DNomb\spolsvt.exe

MD5 523d5c39f9d8d2375c3df68251fa2249
SHA1 d4ed365c44bec9246fc1a65a32a7791792647a10
SHA256 20e3dc90a3e83b6202e2a7f4603b60e5e859639cb68693426c400b13aaeabd78
SHA512 526e1bba30d03f1ac177c6ab7409187a730969c429cebef15da68ffcf44b3b93227781eebc827b2f7a0fa17c391e00a0e532263fd0167aeaeb0456f96cfe3ae4

memory/1192-141-0x0000000000400000-0x0000000000516000-memory.dmp

\Users\Public\Documents\t\spolsvt.exe

MD5 cdce4713e784ae069d73723034a957ff
SHA1 9a393a6bab6568f1a774fb753353223f11367e09
SHA256 b29e48102ecb3d3614e8980a8b8cc63dd2b993c6346f466479244ec2b47b69d8
SHA512 0a3a59a305cc2a6fad4e1315b0bcc5a4129595dfe1e8b703363fa02528d2d7c48d3fd22d365708be84a5557cf1916873df9563c454732f93f94a66e7e3b9fb0f

memory/3044-150-0x0000000000400000-0x0000000000430000-memory.dmp

memory/3044-155-0x0000000000400000-0x0000000000430000-memory.dmp

memory/3044-158-0x0000000000400000-0x0000000000430000-memory.dmp

memory/3044-159-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/3044-152-0x0000000000400000-0x0000000000430000-memory.dmp

memory/3044-148-0x0000000000400000-0x0000000000430000-memory.dmp

C:\Users\Public\Documents\t\spolsvt.exe

MD5 cdce4713e784ae069d73723034a957ff
SHA1 9a393a6bab6568f1a774fb753353223f11367e09
SHA256 b29e48102ecb3d3614e8980a8b8cc63dd2b993c6346f466479244ec2b47b69d8
SHA512 0a3a59a305cc2a6fad4e1315b0bcc5a4129595dfe1e8b703363fa02528d2d7c48d3fd22d365708be84a5557cf1916873df9563c454732f93f94a66e7e3b9fb0f

memory/3044-163-0x0000000000400000-0x0000000000430000-memory.dmp

memory/3044-164-0x0000000010000000-0x000000001002A000-memory.dmp

C:\Users\Public\Documents\t\spolsvt.exe

MD5 cdce4713e784ae069d73723034a957ff
SHA1 9a393a6bab6568f1a774fb753353223f11367e09
SHA256 b29e48102ecb3d3614e8980a8b8cc63dd2b993c6346f466479244ec2b47b69d8
SHA512 0a3a59a305cc2a6fad4e1315b0bcc5a4129595dfe1e8b703363fa02528d2d7c48d3fd22d365708be84a5557cf1916873df9563c454732f93f94a66e7e3b9fb0f

memory/1664-170-0x0000000000400000-0x00000000006A2000-memory.dmp

memory/3044-171-0x0000000000FD0000-0x0000000000FE4000-memory.dmp

memory/3044-175-0x0000000000FD0000-0x0000000000FE4000-memory.dmp

memory/3044-174-0x0000000000FD0000-0x0000000000FE4000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2023-08-23 04:12

Reported

2023-08-23 04:15

Platform

win10v2004-20230703-en

Max time kernel

142s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Wps.exe"

Signatures

FatalRat

infostealer rat fatalrat

Fatal Rat payload

rat infostealer
Description Indicator Process Target
N/A N/A N/A N/A

Downloads MZ/PE file

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\uu6.exe N/A
N/A N/A C:\Users\Public\Documents\123\PTvrst.exe N/A
N/A N/A C:\WINDOWS\DNomb\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ϵͳ×é¼þ = "C:\\Users\\Public\\Documents\\123\\PTvrst.exe" C:\WINDOWS\DNomb\spolsvt.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Therecontinuous = "C:\\WINDOWS\\DNomb\\PTvrst.exe" C:\Users\Public\Documents\123\PTvrst.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Public\Documents\123\PTvrst.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3660 set thread context of 1592 N/A C:\Users\Public\Documents\123\PTvrst.exe C:\WINDOWS\DNomb\spolsvt.exe
PID 1592 set thread context of 4216 N/A C:\WINDOWS\DNomb\spolsvt.exe C:\Users\Public\Documents\t\spolsvt.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\logsession.dll C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fi-fi C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\themes\dark\rhp_world_icon.png C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\tr-tr\ui-strings.js C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_ellipses-hover.svg C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\main-high-contrast.css C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\pl-pl C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\line_2x.png C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\PDDom.api C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\reviews_super.gif C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\zh-cn\ui-strings.js C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\da-dk\ui-strings.js C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\da-dk\PlayStore_icon.svg C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\da-dk\ui-strings.js C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ja-jp\ui-strings.js C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\css\main.css C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\eu-es\ui-strings.js C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\themes\dark C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\root C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\hu-hu C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ko-kr C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\cstm_brand_preview2x.png C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\share_icons.png C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\en-ae C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\hr-hr C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\tr-tr\ui-strings.js C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\root\ui-strings.js C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\pt-br C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\sl-sl C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\it-it C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\nb-no\ui-strings.js C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\convertpdf-rna-tool-view.js C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\pt-br C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\hr-hr C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\images\themeless\web_documentcloud_logo.png C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\selector.js C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\fi-fi C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File created C:\Program Files (x86)\WPS_Installer.exe C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ro-ro\ui-strings.js C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ru-ru\ui-strings.js C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ca-es\ui-strings.js C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\en_get.svg C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\hu-hu C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\[email protected] C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\es-es C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\uk-ua C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\nub.png C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\pl-pl\ui-strings.js C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\plugins\rhp C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\adobe_sign_tag.png C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\hr-hr\ui-strings.js C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\da-dk C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\pt-br\ui-strings.js C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\hu-hu C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\zh-tw C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\es-es\ui-strings.js C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\close.svg C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\nl-nl C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\RHP_icons_2x.png C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ca-es\ui-strings.js C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\[email protected] C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\file_info.png C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\A12_Spinner_int.gif C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\epdf\plugin.js C:\Users\Admin\AppData\Local\Temp\Wps.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\DNomb\Mpec.mbt C:\Program Files (x86)\uu6.exe N/A
File created C:\Windows\DNomb\spolsvt.exe C:\Program Files (x86)\uu6.exe N/A
File created C:\Windows\DNomb\PTvrst.exe C:\Program Files (x86)\uu6.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings C:\Program Files (x86)\uu6.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\uu6.exe N/A
N/A N/A C:\Program Files (x86)\uu6.exe N/A
N/A N/A C:\Program Files (x86)\uu6.exe N/A
N/A N/A C:\Program Files (x86)\uu6.exe N/A
N/A N/A C:\Program Files (x86)\uu6.exe N/A
N/A N/A C:\Program Files (x86)\uu6.exe N/A
N/A N/A C:\Program Files (x86)\uu6.exe N/A
N/A N/A C:\Program Files (x86)\uu6.exe N/A
N/A N/A C:\Users\Public\Documents\123\PTvrst.exe N/A
N/A N/A C:\Users\Public\Documents\123\PTvrst.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Public\Documents\t\spolsvt.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\uu6.exe N/A
N/A N/A C:\Program Files (x86)\uu6.exe N/A
N/A N/A C:\Users\Public\Documents\123\PTvrst.exe N/A
N/A N/A C:\Users\Public\Documents\123\PTvrst.exe N/A
N/A N/A C:\WINDOWS\DNomb\spolsvt.exe N/A
N/A N/A C:\WINDOWS\DNomb\spolsvt.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 904 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Local\Temp\Wps.exe C:\Program Files (x86)\uu6.exe
PID 904 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Local\Temp\Wps.exe C:\Program Files (x86)\uu6.exe
PID 904 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Local\Temp\Wps.exe C:\Program Files (x86)\uu6.exe
PID 3660 wrote to memory of 1592 N/A C:\Users\Public\Documents\123\PTvrst.exe C:\WINDOWS\DNomb\spolsvt.exe
PID 3660 wrote to memory of 1592 N/A C:\Users\Public\Documents\123\PTvrst.exe C:\WINDOWS\DNomb\spolsvt.exe
PID 3660 wrote to memory of 1592 N/A C:\Users\Public\Documents\123\PTvrst.exe C:\WINDOWS\DNomb\spolsvt.exe
PID 3660 wrote to memory of 1592 N/A C:\Users\Public\Documents\123\PTvrst.exe C:\WINDOWS\DNomb\spolsvt.exe
PID 3660 wrote to memory of 1592 N/A C:\Users\Public\Documents\123\PTvrst.exe C:\WINDOWS\DNomb\spolsvt.exe
PID 3660 wrote to memory of 1592 N/A C:\Users\Public\Documents\123\PTvrst.exe C:\WINDOWS\DNomb\spolsvt.exe
PID 3660 wrote to memory of 1592 N/A C:\Users\Public\Documents\123\PTvrst.exe C:\WINDOWS\DNomb\spolsvt.exe
PID 3660 wrote to memory of 1592 N/A C:\Users\Public\Documents\123\PTvrst.exe C:\WINDOWS\DNomb\spolsvt.exe
PID 3660 wrote to memory of 1592 N/A C:\Users\Public\Documents\123\PTvrst.exe C:\WINDOWS\DNomb\spolsvt.exe
PID 1592 wrote to memory of 4216 N/A C:\WINDOWS\DNomb\spolsvt.exe C:\Users\Public\Documents\t\spolsvt.exe
PID 1592 wrote to memory of 4216 N/A C:\WINDOWS\DNomb\spolsvt.exe C:\Users\Public\Documents\t\spolsvt.exe
PID 1592 wrote to memory of 4216 N/A C:\WINDOWS\DNomb\spolsvt.exe C:\Users\Public\Documents\t\spolsvt.exe
PID 1592 wrote to memory of 4216 N/A C:\WINDOWS\DNomb\spolsvt.exe C:\Users\Public\Documents\t\spolsvt.exe
PID 1592 wrote to memory of 4216 N/A C:\WINDOWS\DNomb\spolsvt.exe C:\Users\Public\Documents\t\spolsvt.exe
PID 1592 wrote to memory of 4216 N/A C:\WINDOWS\DNomb\spolsvt.exe C:\Users\Public\Documents\t\spolsvt.exe
PID 1592 wrote to memory of 4216 N/A C:\WINDOWS\DNomb\spolsvt.exe C:\Users\Public\Documents\t\spolsvt.exe
PID 1592 wrote to memory of 4216 N/A C:\WINDOWS\DNomb\spolsvt.exe C:\Users\Public\Documents\t\spolsvt.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Wps.exe

"C:\Users\Admin\AppData\Local\Temp\Wps.exe"

C:\Program Files (x86)\uu6.exe

"C:\Program Files (x86)\uu6.exe"

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Users\Public\Documents\123\PTvrst.exe

"C:\Users\Public\Documents\123\PTvrst.exe"

C:\WINDOWS\DNomb\spolsvt.exe

C:\WINDOWS\DNomb\spolsvt.exe

C:\Users\Public\Documents\t\spolsvt.exe

C:\Users\Public\Documents\t\spolsvt.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 sidamingzhu.oss-cn-hongkong.aliyuncs.com udp
HK 47.75.19.36:443 sidamingzhu.oss-cn-hongkong.aliyuncs.com tcp
US 8.8.8.8:53 208.194.73.20.in-addr.arpa udp
US 8.8.8.8:53 36.19.75.47.in-addr.arpa udp
US 8.8.8.8:53 226.21.18.104.in-addr.arpa udp
US 8.8.8.8:53 226.20.18.104.in-addr.arpa udp
US 8.8.8.8:53 158.240.127.40.in-addr.arpa udp
US 8.8.8.8:53 h1.wccabc.com udp
HK 8.218.53.227:3927 h1.wccabc.com tcp
US 8.8.8.8:53 227.53.218.8.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 0.77.109.52.in-addr.arpa udp
US 8.8.8.8:53 9.173.189.20.in-addr.arpa udp

Files

memory/904-133-0x0000000000400000-0x000000000047F000-memory.dmp

C:\Program Files (x86)\uu6.exe

MD5 46a9d07a97b5b35bfb3d61509b4110bb
SHA1 a4fc26da50e1f06782fbfb1a46368600e881c66e
SHA256 7916c0b39135619a5f8cbc0c71ea762e6e65624c7c85ccd5900039bbb5e056ba
SHA512 50a4adcf22cacf43df14fc6e7730cce535f3718775aaee6fc5b71f80db6cdd66a8738dcf71daa09b199b1066d880942215d67fb986c37ba6998a11210681101a

C:\Program Files (x86)\uu6.exe

MD5 46a9d07a97b5b35bfb3d61509b4110bb
SHA1 a4fc26da50e1f06782fbfb1a46368600e881c66e
SHA256 7916c0b39135619a5f8cbc0c71ea762e6e65624c7c85ccd5900039bbb5e056ba
SHA512 50a4adcf22cacf43df14fc6e7730cce535f3718775aaee6fc5b71f80db6cdd66a8738dcf71daa09b199b1066d880942215d67fb986c37ba6998a11210681101a

C:\Program Files (x86)\uu6.exe

MD5 46a9d07a97b5b35bfb3d61509b4110bb
SHA1 a4fc26da50e1f06782fbfb1a46368600e881c66e
SHA256 7916c0b39135619a5f8cbc0c71ea762e6e65624c7c85ccd5900039bbb5e056ba
SHA512 50a4adcf22cacf43df14fc6e7730cce535f3718775aaee6fc5b71f80db6cdd66a8738dcf71daa09b199b1066d880942215d67fb986c37ba6998a11210681101a

memory/2648-148-0x0000000000400000-0x0000000000688000-memory.dmp

memory/904-159-0x0000000000400000-0x000000000047F000-memory.dmp

memory/2648-160-0x0000000000400000-0x0000000000688000-memory.dmp

memory/2648-161-0x0000000000400000-0x0000000000688000-memory.dmp

C:\Users\Public\Documents\123\PTvrst.exe

MD5 d22cfb5bfaeb1503b12b07e53ef0a149
SHA1 8ea2c85e363f551a159fabd65377affed4e417a1
SHA256 260464fb05210cfb30ef7a12d568f75eb781634b251d958cae8911948f6ca360
SHA512 151024cb2960b1ee485ded7ccbb753fe368a93fda5699af72e568667fa54bfb0d1732444e7b60efaab6d372204157cdb6abbf8862d0e89d612dd963342215e45

C:\Users\Public\Documents\123\PTvrst.exe

MD5 d22cfb5bfaeb1503b12b07e53ef0a149
SHA1 8ea2c85e363f551a159fabd65377affed4e417a1
SHA256 260464fb05210cfb30ef7a12d568f75eb781634b251d958cae8911948f6ca360
SHA512 151024cb2960b1ee485ded7ccbb753fe368a93fda5699af72e568667fa54bfb0d1732444e7b60efaab6d372204157cdb6abbf8862d0e89d612dd963342215e45

memory/3660-167-0x0000000000400000-0x00000000006A2000-memory.dmp

memory/3660-168-0x00000000779D4000-0x00000000779D6000-memory.dmp

memory/3660-169-0x00000000047E0000-0x00000000047E1000-memory.dmp

memory/3660-170-0x0000000004750000-0x0000000004751000-memory.dmp

memory/3660-171-0x00000000047A0000-0x00000000047A1000-memory.dmp

memory/3660-172-0x0000000004780000-0x0000000004781000-memory.dmp

memory/3660-173-0x00000000047D0000-0x00000000047D2000-memory.dmp

memory/3660-174-0x0000000004770000-0x0000000004771000-memory.dmp

memory/3660-175-0x0000000004760000-0x0000000004761000-memory.dmp

memory/3660-176-0x00000000047F0000-0x00000000047F1000-memory.dmp

memory/3660-177-0x00000000047C0000-0x00000000047C1000-memory.dmp

memory/3660-178-0x00000000047B0000-0x00000000047B1000-memory.dmp

memory/3660-180-0x0000000004860000-0x0000000004861000-memory.dmp

memory/3660-179-0x0000000004810000-0x0000000004811000-memory.dmp

memory/3660-182-0x0000000004740000-0x0000000004741000-memory.dmp

C:\WINDOWS\DNomb\Mpec.mbt

MD5 6894403c7124ed7b24d6a6fc7158cb4e
SHA1 802290c110dd05631e2dda8ba18bfbfccaa10331
SHA256 21d81876aa65d400a3569f3db177435718f94aa7e7e47448319e704894b17f72
SHA512 38e7214f8cf1944650512d53fbb03f9de8ff5c52717445b376f603a462ea55ddd8a199a71f00d4b0b293271c475fc72a111ff9028e5029e72d85a39bfa4c2f01

memory/3660-184-0x0000000004790000-0x0000000004791000-memory.dmp

memory/1592-185-0x0000000000400000-0x0000000000516000-memory.dmp

memory/1592-187-0x0000000000400000-0x0000000000516000-memory.dmp

memory/3660-189-0x0000000000400000-0x00000000006A2000-memory.dmp

memory/3660-191-0x00000000048F0000-0x00000000048F1000-memory.dmp

memory/3660-193-0x0000000004870000-0x0000000004871000-memory.dmp

memory/1592-190-0x0000000000400000-0x0000000000516000-memory.dmp

memory/1592-188-0x0000000000400000-0x0000000000516000-memory.dmp

memory/3660-186-0x0000000004840000-0x0000000004841000-memory.dmp

memory/1592-197-0x0000000000400000-0x0000000000516000-memory.dmp

memory/1592-196-0x0000000000400000-0x0000000000516000-memory.dmp

C:\WINDOWS\DNomb\spolsvt.exe

MD5 523d5c39f9d8d2375c3df68251fa2249
SHA1 d4ed365c44bec9246fc1a65a32a7791792647a10
SHA256 20e3dc90a3e83b6202e2a7f4603b60e5e859639cb68693426c400b13aaeabd78
SHA512 526e1bba30d03f1ac177c6ab7409187a730969c429cebef15da68ffcf44b3b93227781eebc827b2f7a0fa17c391e00a0e532263fd0167aeaeb0456f96cfe3ae4

C:\Windows\DNomb\spolsvt.exe

MD5 523d5c39f9d8d2375c3df68251fa2249
SHA1 d4ed365c44bec9246fc1a65a32a7791792647a10
SHA256 20e3dc90a3e83b6202e2a7f4603b60e5e859639cb68693426c400b13aaeabd78
SHA512 526e1bba30d03f1ac177c6ab7409187a730969c429cebef15da68ffcf44b3b93227781eebc827b2f7a0fa17c391e00a0e532263fd0167aeaeb0456f96cfe3ae4

memory/4216-202-0x0000000000400000-0x0000000000430000-memory.dmp

memory/4216-203-0x0000000000400000-0x0000000000430000-memory.dmp

memory/4216-204-0x0000000000400000-0x0000000000430000-memory.dmp

C:\Users\Public\Documents\t\spolsvt.exe

MD5 cdce4713e784ae069d73723034a957ff
SHA1 9a393a6bab6568f1a774fb753353223f11367e09
SHA256 b29e48102ecb3d3614e8980a8b8cc63dd2b993c6346f466479244ec2b47b69d8
SHA512 0a3a59a305cc2a6fad4e1315b0bcc5a4129595dfe1e8b703363fa02528d2d7c48d3fd22d365708be84a5557cf1916873df9563c454732f93f94a66e7e3b9fb0f

memory/4216-208-0x0000000000400000-0x0000000000430000-memory.dmp

C:\Users\Public\Documents\t\spolsvt.exe

MD5 cdce4713e784ae069d73723034a957ff
SHA1 9a393a6bab6568f1a774fb753353223f11367e09
SHA256 b29e48102ecb3d3614e8980a8b8cc63dd2b993c6346f466479244ec2b47b69d8
SHA512 0a3a59a305cc2a6fad4e1315b0bcc5a4129595dfe1e8b703363fa02528d2d7c48d3fd22d365708be84a5557cf1916873df9563c454732f93f94a66e7e3b9fb0f

memory/904-209-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4216-210-0x0000000010000000-0x000000001002A000-memory.dmp

memory/3660-215-0x0000000000400000-0x00000000006A2000-memory.dmp