Malware Analysis Report

2025-03-15 03:51

Sample ID 230905-wzp8paab8x
Target JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1
SHA256 a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1
Tags
upx fatalrat evasion infostealer persistence rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1

Threat Level: Known bad

The file JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1 was found to be: Known bad.

Malicious Activity Summary

upx fatalrat evasion infostealer persistence rat

FatalRat

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Fatal Rat payload

Downloads MZ/PE file

Checks computer location settings

Loads dropped DLL

Executes dropped EXE

Identifies Wine through registry keys

UPX packed file

Adds Run key to start application

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Modifies registry class

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

Checks processor information in registry

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-09-05 18:21

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-09-05 18:21

Reported

2023-09-05 18:24

Platform

win7-20230831-en

Max time kernel

117s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe"

Signatures

FatalRat

infostealer rat fatalrat

Fatal Rat payload

rat infostealer
Description Indicator Process Target
N/A N/A N/A N/A

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Public\Documents\123\PTvrst.exe N/A

Downloads MZ/PE file

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\q1.exe N/A
N/A N/A C:\Windows\DNomb\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\123\PTvrst.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Wine C:\Users\Public\Documents\123\PTvrst.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ϵͳ×é¼þ = "C:\\Users\\Public\\Documents\\123\\PTvrst.exe" C:\Windows\DNomb\spolsvt.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Therecontinuous = "C:\\WINDOWS\\DNomb\\PTvrst.exe" C:\Users\Public\Documents\123\PTvrst.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Public\Documents\123\PTvrst.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2788 set thread context of 2628 N/A C:\Program Files (x86)\q1.exe C:\Windows\DNomb\spolsvt.exe
PID 2628 set thread context of 2296 N/A C:\Windows\DNomb\spolsvt.exe C:\Users\Public\Documents\t\spolsvt.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\SendMail.api C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\weblink.api C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_sent.gif C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOffNotificationInTray.gif C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOnNotificationInTray.gif C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\Words.pdf C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Search5.api C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\MyriadCAD.otf C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\tesselate.x3d C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\distribute_form.gif C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\warning.gif C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\ReadMe.htm C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia.api C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\VDK10.THD C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\DefaultID.pdf C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_email.gif C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\trash.gif C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.dll C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeXMP.dll C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Search.api C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\VDK10.RSD C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\RTC.der C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\email_all.gif C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\JP2KLib.dll C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\DigSig.api C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\JSByteCodeWin.bin C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\eBook.api C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\add_reviewer.gif C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File created C:\Program Files (x86)\ChromeSetup.exe C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AXSLE.dll C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Accessibility.api C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_received.gif C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_lg.gif C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\icucnv36.dll C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroSign.prc C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\PPKLite.api C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeLinguistic.dll C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\cryptocme2.dll C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Onix32.dll C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\PDFPrevHndlr.dll C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\Flash.mpp C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prcr.x3d C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\ahclient.dll C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\icudt36.dll C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\eula.ini C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annots.api C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\q1.exe C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AGMGPUOptIn.ini C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\DataMatrix.pmp C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\drvDX8.x3d C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\drvDX9.x3d C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File created C:\Program Files (x86)\q1.exe C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeUpdater.dll C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\DNomb\PTvrst.exe C:\Program Files (x86)\q1.exe N/A
File created C:\Windows\DNomb\spolsvt.exe C:\Program Files (x86)\q1.exe N/A
File created C:\Windows\DNomb\yh.png C:\Program Files (x86)\q1.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Public\Documents\t\spolsvt.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Users\Public\Documents\t\spolsvt.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\q1.exe N/A
N/A N/A C:\Program Files (x86)\q1.exe N/A
N/A N/A C:\Program Files (x86)\q1.exe N/A
N/A N/A C:\Program Files (x86)\q1.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Windows\DNomb\spolsvt.exe N/A
N/A N/A C:\Windows\DNomb\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\123\PTvrst.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Public\Documents\t\spolsvt.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\q1.exe N/A
N/A N/A C:\Program Files (x86)\q1.exe N/A
N/A N/A C:\Windows\DNomb\spolsvt.exe N/A
N/A N/A C:\Windows\DNomb\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\123\PTvrst.exe N/A
N/A N/A C:\Users\Public\Documents\123\PTvrst.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3000 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe C:\Program Files (x86)\q1.exe
PID 3000 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe C:\Program Files (x86)\q1.exe
PID 3000 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe C:\Program Files (x86)\q1.exe
PID 3000 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe C:\Program Files (x86)\q1.exe
PID 2788 wrote to memory of 2628 N/A C:\Program Files (x86)\q1.exe C:\Windows\DNomb\spolsvt.exe
PID 2788 wrote to memory of 2628 N/A C:\Program Files (x86)\q1.exe C:\Windows\DNomb\spolsvt.exe
PID 2788 wrote to memory of 2628 N/A C:\Program Files (x86)\q1.exe C:\Windows\DNomb\spolsvt.exe
PID 2788 wrote to memory of 2628 N/A C:\Program Files (x86)\q1.exe C:\Windows\DNomb\spolsvt.exe
PID 2788 wrote to memory of 2628 N/A C:\Program Files (x86)\q1.exe C:\Windows\DNomb\spolsvt.exe
PID 2788 wrote to memory of 2628 N/A C:\Program Files (x86)\q1.exe C:\Windows\DNomb\spolsvt.exe
PID 2788 wrote to memory of 2628 N/A C:\Program Files (x86)\q1.exe C:\Windows\DNomb\spolsvt.exe
PID 2788 wrote to memory of 2628 N/A C:\Program Files (x86)\q1.exe C:\Windows\DNomb\spolsvt.exe
PID 2788 wrote to memory of 2628 N/A C:\Program Files (x86)\q1.exe C:\Windows\DNomb\spolsvt.exe
PID 2788 wrote to memory of 2628 N/A C:\Program Files (x86)\q1.exe C:\Windows\DNomb\spolsvt.exe
PID 2628 wrote to memory of 2296 N/A C:\Windows\DNomb\spolsvt.exe C:\Users\Public\Documents\t\spolsvt.exe
PID 2628 wrote to memory of 2296 N/A C:\Windows\DNomb\spolsvt.exe C:\Users\Public\Documents\t\spolsvt.exe
PID 2628 wrote to memory of 2296 N/A C:\Windows\DNomb\spolsvt.exe C:\Users\Public\Documents\t\spolsvt.exe
PID 2628 wrote to memory of 2296 N/A C:\Windows\DNomb\spolsvt.exe C:\Users\Public\Documents\t\spolsvt.exe
PID 2628 wrote to memory of 2296 N/A C:\Windows\DNomb\spolsvt.exe C:\Users\Public\Documents\t\spolsvt.exe
PID 2628 wrote to memory of 2296 N/A C:\Windows\DNomb\spolsvt.exe C:\Users\Public\Documents\t\spolsvt.exe
PID 2628 wrote to memory of 2296 N/A C:\Windows\DNomb\spolsvt.exe C:\Users\Public\Documents\t\spolsvt.exe
PID 2628 wrote to memory of 2296 N/A C:\Windows\DNomb\spolsvt.exe C:\Users\Public\Documents\t\spolsvt.exe
PID 2628 wrote to memory of 2296 N/A C:\Windows\DNomb\spolsvt.exe C:\Users\Public\Documents\t\spolsvt.exe

Processes

C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe

"C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe"

C:\Program Files (x86)\q1.exe

"C:\Program Files (x86)\q1.exe"

C:\Windows\DNomb\spolsvt.exe

C:\Windows\DNomb\spolsvt.exe

C:\Users\Public\Documents\t\spolsvt.exe

C:\Users\Public\Documents\t\spolsvt.exe

C:\Users\Public\Documents\123\PTvrst.exe

"C:\Users\Public\Documents\123\PTvrst.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 testvvv123.oss-cn-hongkong.aliyuncs.com udp
HK 47.75.18.48:443 testvvv123.oss-cn-hongkong.aliyuncs.com tcp
US 8.8.8.8:53 pipi.wccabc.com udp
HK 154.23.176.188:3927 pipi.wccabc.com tcp

Files

memory/3000-0-0x0000000000400000-0x000000000042D000-memory.dmp

\Program Files (x86)\q1.exe

MD5 32865e3033c398c38c8e1d29482ca61e
SHA1 6b6b220cda653101a0adcc1f027016f2262292a6
SHA256 b58c30c03b5f0634918ca3e582e5835df073f0c93cde562a1651cd6ea4d4227c
SHA512 54795c14d468e31b964156e67156d11a08dd7ad2b2673969bc5044932c00c2dbfb69eb7d08aa72672818e56b7cbd3970ba620ffe8aabafe98e343f2b00e28631

C:\Program Files (x86)\q1.exe

MD5 32865e3033c398c38c8e1d29482ca61e
SHA1 6b6b220cda653101a0adcc1f027016f2262292a6
SHA256 b58c30c03b5f0634918ca3e582e5835df073f0c93cde562a1651cd6ea4d4227c
SHA512 54795c14d468e31b964156e67156d11a08dd7ad2b2673969bc5044932c00c2dbfb69eb7d08aa72672818e56b7cbd3970ba620ffe8aabafe98e343f2b00e28631

C:\Program Files (x86)\q1.exe

MD5 32865e3033c398c38c8e1d29482ca61e
SHA1 6b6b220cda653101a0adcc1f027016f2262292a6
SHA256 b58c30c03b5f0634918ca3e582e5835df073f0c93cde562a1651cd6ea4d4227c
SHA512 54795c14d468e31b964156e67156d11a08dd7ad2b2673969bc5044932c00c2dbfb69eb7d08aa72672818e56b7cbd3970ba620ffe8aabafe98e343f2b00e28631

memory/3000-9-0x0000000002550000-0x00000000026A2000-memory.dmp

memory/2788-11-0x0000000001080000-0x00000000011D2000-memory.dmp

\Windows\DNomb\spolsvt.exe

MD5 523d5c39f9d8d2375c3df68251fa2249
SHA1 d4ed365c44bec9246fc1a65a32a7791792647a10
SHA256 20e3dc90a3e83b6202e2a7f4603b60e5e859639cb68693426c400b13aaeabd78
SHA512 526e1bba30d03f1ac177c6ab7409187a730969c429cebef15da68ffcf44b3b93227781eebc827b2f7a0fa17c391e00a0e532263fd0167aeaeb0456f96cfe3ae4

memory/2628-34-0x0000000000400000-0x0000000000516000-memory.dmp

memory/2628-36-0x0000000000400000-0x0000000000516000-memory.dmp

memory/2628-35-0x0000000000400000-0x0000000000516000-memory.dmp

C:\Windows\DNomb\spolsvt.exe

MD5 523d5c39f9d8d2375c3df68251fa2249
SHA1 d4ed365c44bec9246fc1a65a32a7791792647a10
SHA256 20e3dc90a3e83b6202e2a7f4603b60e5e859639cb68693426c400b13aaeabd78
SHA512 526e1bba30d03f1ac177c6ab7409187a730969c429cebef15da68ffcf44b3b93227781eebc827b2f7a0fa17c391e00a0e532263fd0167aeaeb0456f96cfe3ae4

\Windows\DNomb\spolsvt.exe

MD5 523d5c39f9d8d2375c3df68251fa2249
SHA1 d4ed365c44bec9246fc1a65a32a7791792647a10
SHA256 20e3dc90a3e83b6202e2a7f4603b60e5e859639cb68693426c400b13aaeabd78
SHA512 526e1bba30d03f1ac177c6ab7409187a730969c429cebef15da68ffcf44b3b93227781eebc827b2f7a0fa17c391e00a0e532263fd0167aeaeb0456f96cfe3ae4

memory/2628-38-0x0000000000400000-0x0000000000516000-memory.dmp

memory/2628-40-0x0000000000400000-0x0000000000516000-memory.dmp

memory/2628-42-0x0000000000400000-0x0000000000516000-memory.dmp

memory/2628-43-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

C:\Windows\DNomb\spolsvt.exe

MD5 523d5c39f9d8d2375c3df68251fa2249
SHA1 d4ed365c44bec9246fc1a65a32a7791792647a10
SHA256 20e3dc90a3e83b6202e2a7f4603b60e5e859639cb68693426c400b13aaeabd78
SHA512 526e1bba30d03f1ac177c6ab7409187a730969c429cebef15da68ffcf44b3b93227781eebc827b2f7a0fa17c391e00a0e532263fd0167aeaeb0456f96cfe3ae4

memory/2628-48-0x0000000000400000-0x0000000000516000-memory.dmp

\Users\Public\Documents\t\spolsvt.exe

MD5 cdce4713e784ae069d73723034a957ff
SHA1 9a393a6bab6568f1a774fb753353223f11367e09
SHA256 b29e48102ecb3d3614e8980a8b8cc63dd2b993c6346f466479244ec2b47b69d8
SHA512 0a3a59a305cc2a6fad4e1315b0bcc5a4129595dfe1e8b703363fa02528d2d7c48d3fd22d365708be84a5557cf1916873df9563c454732f93f94a66e7e3b9fb0f

\Users\Public\Documents\t\spolsvt.exe

MD5 cdce4713e784ae069d73723034a957ff
SHA1 9a393a6bab6568f1a774fb753353223f11367e09
SHA256 b29e48102ecb3d3614e8980a8b8cc63dd2b993c6346f466479244ec2b47b69d8
SHA512 0a3a59a305cc2a6fad4e1315b0bcc5a4129595dfe1e8b703363fa02528d2d7c48d3fd22d365708be84a5557cf1916873df9563c454732f93f94a66e7e3b9fb0f

memory/2296-58-0x0000000000400000-0x0000000000430000-memory.dmp

C:\Users\Public\Documents\t\spolsvt.exe

MD5 cdce4713e784ae069d73723034a957ff
SHA1 9a393a6bab6568f1a774fb753353223f11367e09
SHA256 b29e48102ecb3d3614e8980a8b8cc63dd2b993c6346f466479244ec2b47b69d8
SHA512 0a3a59a305cc2a6fad4e1315b0bcc5a4129595dfe1e8b703363fa02528d2d7c48d3fd22d365708be84a5557cf1916873df9563c454732f93f94a66e7e3b9fb0f

memory/2296-62-0x0000000000400000-0x0000000000430000-memory.dmp

memory/2296-65-0x0000000000400000-0x0000000000430000-memory.dmp

memory/2296-60-0x0000000000400000-0x0000000000430000-memory.dmp

memory/2296-69-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2296-68-0x0000000000400000-0x0000000000430000-memory.dmp

C:\Users\Public\Documents\t\spolsvt.exe

MD5 cdce4713e784ae069d73723034a957ff
SHA1 9a393a6bab6568f1a774fb753353223f11367e09
SHA256 b29e48102ecb3d3614e8980a8b8cc63dd2b993c6346f466479244ec2b47b69d8
SHA512 0a3a59a305cc2a6fad4e1315b0bcc5a4129595dfe1e8b703363fa02528d2d7c48d3fd22d365708be84a5557cf1916873df9563c454732f93f94a66e7e3b9fb0f

memory/2296-73-0x0000000000400000-0x0000000000430000-memory.dmp

memory/2296-74-0x0000000010000000-0x000000001002A000-memory.dmp

C:\Users\Public\Documents\t\spolsvt.exe

MD5 cdce4713e784ae069d73723034a957ff
SHA1 9a393a6bab6568f1a774fb753353223f11367e09
SHA256 b29e48102ecb3d3614e8980a8b8cc63dd2b993c6346f466479244ec2b47b69d8
SHA512 0a3a59a305cc2a6fad4e1315b0bcc5a4129595dfe1e8b703363fa02528d2d7c48d3fd22d365708be84a5557cf1916873df9563c454732f93f94a66e7e3b9fb0f

memory/3000-82-0x0000000000400000-0x000000000042D000-memory.dmp

memory/3000-83-0x0000000002550000-0x00000000026A2000-memory.dmp

memory/2788-85-0x0000000001080000-0x00000000011D2000-memory.dmp

memory/2788-86-0x0000000001080000-0x00000000011D2000-memory.dmp

C:\Users\Public\Documents\123\PTvrst.exe

MD5 d22cfb5bfaeb1503b12b07e53ef0a149
SHA1 8ea2c85e363f551a159fabd65377affed4e417a1
SHA256 260464fb05210cfb30ef7a12d568f75eb781634b251d958cae8911948f6ca360
SHA512 151024cb2960b1ee485ded7ccbb753fe368a93fda5699af72e568667fa54bfb0d1732444e7b60efaab6d372204157cdb6abbf8862d0e89d612dd963342215e45

C:\Users\Public\Documents\123\PTvrst.exe

MD5 d22cfb5bfaeb1503b12b07e53ef0a149
SHA1 8ea2c85e363f551a159fabd65377affed4e417a1
SHA256 260464fb05210cfb30ef7a12d568f75eb781634b251d958cae8911948f6ca360
SHA512 151024cb2960b1ee485ded7ccbb753fe368a93fda5699af72e568667fa54bfb0d1732444e7b60efaab6d372204157cdb6abbf8862d0e89d612dd963342215e45

memory/896-89-0x0000000000400000-0x00000000006A2000-memory.dmp

memory/2788-90-0x0000000001080000-0x00000000011D2000-memory.dmp

memory/3000-94-0x0000000000400000-0x000000000042D000-memory.dmp

memory/896-95-0x0000000077660000-0x0000000077662000-memory.dmp

memory/896-96-0x0000000004300000-0x0000000004301000-memory.dmp

memory/896-99-0x0000000004290000-0x0000000004291000-memory.dmp

memory/896-98-0x0000000004210000-0x0000000004211000-memory.dmp

memory/896-100-0x0000000004260000-0x0000000004262000-memory.dmp

memory/896-97-0x0000000000400000-0x00000000006A2000-memory.dmp

memory/896-101-0x00000000042F0000-0x00000000042F1000-memory.dmp

memory/896-102-0x0000000004240000-0x0000000004241000-memory.dmp

memory/896-104-0x0000000004230000-0x0000000004231000-memory.dmp

memory/896-103-0x00000000042E0000-0x00000000042E2000-memory.dmp

memory/896-105-0x0000000004200000-0x0000000004201000-memory.dmp

memory/896-106-0x0000000004280000-0x0000000004281000-memory.dmp

memory/896-107-0x00000000042D0000-0x00000000042D1000-memory.dmp

memory/896-108-0x00000000042A0000-0x00000000042A1000-memory.dmp

memory/896-109-0x0000000004320000-0x0000000004321000-memory.dmp

memory/896-110-0x00000000041D0000-0x00000000041D1000-memory.dmp

memory/896-111-0x0000000004270000-0x0000000004271000-memory.dmp

memory/896-113-0x0000000004350000-0x0000000004351000-memory.dmp

memory/896-112-0x00000000042C0000-0x00000000042C1000-memory.dmp

memory/896-115-0x0000000004310000-0x0000000004311000-memory.dmp

memory/896-114-0x0000000004380000-0x0000000004381000-memory.dmp

memory/896-116-0x0000000004370000-0x0000000004371000-memory.dmp

memory/896-119-0x00000000042B0000-0x00000000042B1000-memory.dmp

memory/896-118-0x0000000000400000-0x00000000006A2000-memory.dmp

memory/896-117-0x0000000000400000-0x00000000006A2000-memory.dmp

memory/896-120-0x00000000042B0000-0x00000000042B1000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-09-05 18:21

Reported

2023-09-05 18:24

Platform

win10v2004-20230831-en

Max time kernel

123s

Max time network

141s

Command Line

"C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe"

Signatures

FatalRat

infostealer rat fatalrat

Fatal Rat payload

rat infostealer
Description Indicator Process Target
N/A N/A N/A N/A

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Public\Documents\123\PTvrst.exe N/A

Downloads MZ/PE file

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-528036852-1341495193-1175965888-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\q1.exe N/A
N/A N/A C:\Windows\DNomb\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\123\PTvrst.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-528036852-1341495193-1175965888-1000\Software\Wine C:\Users\Public\Documents\123\PTvrst.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ϵͳ×é¼þ = "C:\\Users\\Public\\Documents\\123\\PTvrst.exe" C:\Windows\DNomb\spolsvt.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Therecontinuous = "C:\\WINDOWS\\DNomb\\PTvrst.exe" C:\Users\Public\Documents\123\PTvrst.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Public\Documents\123\PTvrst.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2764 set thread context of 4192 N/A C:\Program Files (x86)\q1.exe C:\Windows\DNomb\spolsvt.exe
PID 4192 set thread context of 4628 N/A C:\Windows\DNomb\spolsvt.exe C:\Users\Public\Documents\t\spolsvt.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_closereview_18.svg C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_sortedby_selected_18.svg C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\nl-nl C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\hu-hu\ui-strings.js C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ui-strings.js C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\bg_pattern_RHP.png C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\hr-hr\ui-strings.js C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File created C:\Program Files (x86)\q1.exe C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\eu-es C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\cs-cz C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\eu-es C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ko-kr\ui-strings.js C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\eu-es\ui-strings.js C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_duplicate_18.svg C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\selector.js C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\de-de C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\x_2x.png C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ro-ro\ui-strings.js C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ar-ae\ui-strings.js C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_filterselected-default_32.svg C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\bg_pattern_RHP.png C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_filterselected-dark-disabled_32.svg C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sk-sk\ui-strings.js C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\css C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\en-gb\ui-strings.js C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\plugins C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\hu-hu\ui-strings.js C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ui-strings.js C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview.png C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\nb-no C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\nl-nl C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\css\main-selector.css C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\cs-cz C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\arrow-left-pressed.gif C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ui-strings.js C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ro-ro C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\cloud_secured_lg.png C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\fi-fi\ui-strings.js C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\rna-main.js C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ru-ru\ui-strings.js C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\organize_poster.jpg C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_invite_18.svg C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ar-ae C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\s_filetype_xd.svg C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\en-ae\ui-strings.js C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ru-ru\ui-strings.js C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\zh-tw\ui-strings.js C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ja-jp C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\nb-no C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\css C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-gb C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-il C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\it-it C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\arrow-down.gif C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\back-arrow-disabled.svg C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\sl-si\ui-strings.js C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons2x.png C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\back-arrow-disabled.svg C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\css C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\multi-tab-file-view-2x.png C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\nl-nl\ui-strings.js C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\move.svg C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\DNomb\spolsvt.exe C:\Program Files (x86)\q1.exe N/A
File created C:\Windows\DNomb\yh.png C:\Program Files (x86)\q1.exe N/A
File created C:\Windows\DNomb\PTvrst.exe C:\Program Files (x86)\q1.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Public\Documents\t\spolsvt.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Users\Public\Documents\t\spolsvt.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-528036852-1341495193-1175965888-1000_Classes\Local Settings C:\Program Files (x86)\q1.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\q1.exe N/A
N/A N/A C:\Program Files (x86)\q1.exe N/A
N/A N/A C:\Program Files (x86)\q1.exe N/A
N/A N/A C:\Program Files (x86)\q1.exe N/A
N/A N/A C:\Program Files (x86)\q1.exe N/A
N/A N/A C:\Program Files (x86)\q1.exe N/A
N/A N/A C:\Program Files (x86)\q1.exe N/A
N/A N/A C:\Program Files (x86)\q1.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\t\spolsvt.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Public\Documents\t\spolsvt.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\q1.exe N/A
N/A N/A C:\Program Files (x86)\q1.exe N/A
N/A N/A C:\Windows\DNomb\spolsvt.exe N/A
N/A N/A C:\Windows\DNomb\spolsvt.exe N/A
N/A N/A C:\Users\Public\Documents\123\PTvrst.exe N/A
N/A N/A C:\Users\Public\Documents\123\PTvrst.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2716 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe C:\Program Files (x86)\q1.exe
PID 2716 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe C:\Program Files (x86)\q1.exe
PID 2716 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe C:\Program Files (x86)\q1.exe
PID 2764 wrote to memory of 4192 N/A C:\Program Files (x86)\q1.exe C:\Windows\DNomb\spolsvt.exe
PID 2764 wrote to memory of 4192 N/A C:\Program Files (x86)\q1.exe C:\Windows\DNomb\spolsvt.exe
PID 2764 wrote to memory of 4192 N/A C:\Program Files (x86)\q1.exe C:\Windows\DNomb\spolsvt.exe
PID 2764 wrote to memory of 4192 N/A C:\Program Files (x86)\q1.exe C:\Windows\DNomb\spolsvt.exe
PID 2764 wrote to memory of 4192 N/A C:\Program Files (x86)\q1.exe C:\Windows\DNomb\spolsvt.exe
PID 2764 wrote to memory of 4192 N/A C:\Program Files (x86)\q1.exe C:\Windows\DNomb\spolsvt.exe
PID 2764 wrote to memory of 4192 N/A C:\Program Files (x86)\q1.exe C:\Windows\DNomb\spolsvt.exe
PID 2764 wrote to memory of 4192 N/A C:\Program Files (x86)\q1.exe C:\Windows\DNomb\spolsvt.exe
PID 2764 wrote to memory of 4192 N/A C:\Program Files (x86)\q1.exe C:\Windows\DNomb\spolsvt.exe
PID 4192 wrote to memory of 4628 N/A C:\Windows\DNomb\spolsvt.exe C:\Users\Public\Documents\t\spolsvt.exe
PID 4192 wrote to memory of 4628 N/A C:\Windows\DNomb\spolsvt.exe C:\Users\Public\Documents\t\spolsvt.exe
PID 4192 wrote to memory of 4628 N/A C:\Windows\DNomb\spolsvt.exe C:\Users\Public\Documents\t\spolsvt.exe
PID 4192 wrote to memory of 4628 N/A C:\Windows\DNomb\spolsvt.exe C:\Users\Public\Documents\t\spolsvt.exe
PID 4192 wrote to memory of 4628 N/A C:\Windows\DNomb\spolsvt.exe C:\Users\Public\Documents\t\spolsvt.exe
PID 4192 wrote to memory of 4628 N/A C:\Windows\DNomb\spolsvt.exe C:\Users\Public\Documents\t\spolsvt.exe
PID 4192 wrote to memory of 4628 N/A C:\Windows\DNomb\spolsvt.exe C:\Users\Public\Documents\t\spolsvt.exe
PID 4192 wrote to memory of 4628 N/A C:\Windows\DNomb\spolsvt.exe C:\Users\Public\Documents\t\spolsvt.exe

Processes

C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe

"C:\Users\Admin\AppData\Local\Temp\JC_a945f87d013f6b70b25cf80ed405f0636d4d2c968079cfd542bd2eda37aba7d1.exe"

C:\Program Files (x86)\q1.exe

"C:\Program Files (x86)\q1.exe"

C:\Windows\DNomb\spolsvt.exe

C:\Windows\DNomb\spolsvt.exe

C:\Users\Public\Documents\t\spolsvt.exe

C:\Users\Public\Documents\t\spolsvt.exe

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Users\Public\Documents\123\PTvrst.exe

"C:\Users\Public\Documents\123\PTvrst.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 74.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 101.132.60.8.in-addr.arpa udp
US 8.8.8.8:53 testvvv123.oss-cn-hongkong.aliyuncs.com udp
HK 47.75.18.48:443 testvvv123.oss-cn-hongkong.aliyuncs.com tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 48.18.75.47.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 226.21.18.104.in-addr.arpa udp
US 8.8.8.8:53 pipi.wccabc.com udp
HK 154.23.176.188:3927 pipi.wccabc.com tcp
US 8.8.8.8:53 188.176.23.154.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 90.65.42.20.in-addr.arpa udp

Files

memory/2716-0-0x0000000000400000-0x000000000042D000-memory.dmp

C:\Program Files (x86)\q1.exe

MD5 32865e3033c398c38c8e1d29482ca61e
SHA1 6b6b220cda653101a0adcc1f027016f2262292a6
SHA256 b58c30c03b5f0634918ca3e582e5835df073f0c93cde562a1651cd6ea4d4227c
SHA512 54795c14d468e31b964156e67156d11a08dd7ad2b2673969bc5044932c00c2dbfb69eb7d08aa72672818e56b7cbd3970ba620ffe8aabafe98e343f2b00e28631

C:\Program Files (x86)\q1.exe

MD5 32865e3033c398c38c8e1d29482ca61e
SHA1 6b6b220cda653101a0adcc1f027016f2262292a6
SHA256 b58c30c03b5f0634918ca3e582e5835df073f0c93cde562a1651cd6ea4d4227c
SHA512 54795c14d468e31b964156e67156d11a08dd7ad2b2673969bc5044932c00c2dbfb69eb7d08aa72672818e56b7cbd3970ba620ffe8aabafe98e343f2b00e28631

memory/2764-14-0x0000000000E50000-0x0000000000FA2000-memory.dmp

C:\Program Files (x86)\q1.exe

MD5 32865e3033c398c38c8e1d29482ca61e
SHA1 6b6b220cda653101a0adcc1f027016f2262292a6
SHA256 b58c30c03b5f0634918ca3e582e5835df073f0c93cde562a1651cd6ea4d4227c
SHA512 54795c14d468e31b964156e67156d11a08dd7ad2b2673969bc5044932c00c2dbfb69eb7d08aa72672818e56b7cbd3970ba620ffe8aabafe98e343f2b00e28631

memory/2716-23-0x0000000000400000-0x000000000042D000-memory.dmp

memory/2764-25-0x0000000000E50000-0x0000000000FA2000-memory.dmp

memory/4192-27-0x0000000000400000-0x0000000000516000-memory.dmp

memory/4192-28-0x0000000000400000-0x0000000000516000-memory.dmp

memory/4192-29-0x0000000000400000-0x0000000000516000-memory.dmp

memory/4192-30-0x0000000000400000-0x0000000000516000-memory.dmp

C:\Windows\DNomb\spolsvt.exe

MD5 523d5c39f9d8d2375c3df68251fa2249
SHA1 d4ed365c44bec9246fc1a65a32a7791792647a10
SHA256 20e3dc90a3e83b6202e2a7f4603b60e5e859639cb68693426c400b13aaeabd78
SHA512 526e1bba30d03f1ac177c6ab7409187a730969c429cebef15da68ffcf44b3b93227781eebc827b2f7a0fa17c391e00a0e532263fd0167aeaeb0456f96cfe3ae4

memory/4192-35-0x0000000000400000-0x0000000000516000-memory.dmp

C:\Windows\DNomb\spolsvt.exe

MD5 523d5c39f9d8d2375c3df68251fa2249
SHA1 d4ed365c44bec9246fc1a65a32a7791792647a10
SHA256 20e3dc90a3e83b6202e2a7f4603b60e5e859639cb68693426c400b13aaeabd78
SHA512 526e1bba30d03f1ac177c6ab7409187a730969c429cebef15da68ffcf44b3b93227781eebc827b2f7a0fa17c391e00a0e532263fd0167aeaeb0456f96cfe3ae4

memory/4192-36-0x0000000000400000-0x0000000000516000-memory.dmp

memory/4628-41-0x0000000000400000-0x0000000000430000-memory.dmp

memory/4628-42-0x0000000000400000-0x0000000000430000-memory.dmp

memory/4628-43-0x0000000000400000-0x0000000000430000-memory.dmp

C:\Users\Public\Documents\t\spolsvt.exe

MD5 cdce4713e784ae069d73723034a957ff
SHA1 9a393a6bab6568f1a774fb753353223f11367e09
SHA256 b29e48102ecb3d3614e8980a8b8cc63dd2b993c6346f466479244ec2b47b69d8
SHA512 0a3a59a305cc2a6fad4e1315b0bcc5a4129595dfe1e8b703363fa02528d2d7c48d3fd22d365708be84a5557cf1916873df9563c454732f93f94a66e7e3b9fb0f

C:\Users\Public\Documents\t\spolsvt.exe

MD5 cdce4713e784ae069d73723034a957ff
SHA1 9a393a6bab6568f1a774fb753353223f11367e09
SHA256 b29e48102ecb3d3614e8980a8b8cc63dd2b993c6346f466479244ec2b47b69d8
SHA512 0a3a59a305cc2a6fad4e1315b0bcc5a4129595dfe1e8b703363fa02528d2d7c48d3fd22d365708be84a5557cf1916873df9563c454732f93f94a66e7e3b9fb0f

memory/4628-47-0x0000000000400000-0x0000000000430000-memory.dmp

memory/4628-48-0x0000000010000000-0x000000001002A000-memory.dmp

C:\Users\Public\Documents\123\PTvrst.exe

MD5 d22cfb5bfaeb1503b12b07e53ef0a149
SHA1 8ea2c85e363f551a159fabd65377affed4e417a1
SHA256 260464fb05210cfb30ef7a12d568f75eb781634b251d958cae8911948f6ca360
SHA512 151024cb2960b1ee485ded7ccbb753fe368a93fda5699af72e568667fa54bfb0d1732444e7b60efaab6d372204157cdb6abbf8862d0e89d612dd963342215e45

C:\Users\Public\Documents\123\PTvrst.exe

MD5 d22cfb5bfaeb1503b12b07e53ef0a149
SHA1 8ea2c85e363f551a159fabd65377affed4e417a1
SHA256 260464fb05210cfb30ef7a12d568f75eb781634b251d958cae8911948f6ca360
SHA512 151024cb2960b1ee485ded7ccbb753fe368a93fda5699af72e568667fa54bfb0d1732444e7b60efaab6d372204157cdb6abbf8862d0e89d612dd963342215e45

memory/4316-58-0x0000000000400000-0x00000000006A2000-memory.dmp

memory/2764-59-0x0000000000E50000-0x0000000000FA2000-memory.dmp

memory/4316-63-0x00000000774E4000-0x00000000774E6000-memory.dmp

memory/4316-64-0x00000000047F0000-0x00000000047F1000-memory.dmp

memory/4316-65-0x0000000000400000-0x00000000006A2000-memory.dmp

memory/4316-67-0x00000000047B0000-0x00000000047B1000-memory.dmp

memory/4316-66-0x0000000004750000-0x0000000004751000-memory.dmp

memory/4316-68-0x0000000004780000-0x0000000004781000-memory.dmp

memory/4316-69-0x0000000004760000-0x0000000004761000-memory.dmp

memory/4316-71-0x0000000004800000-0x0000000004801000-memory.dmp

memory/4316-72-0x00000000047A0000-0x00000000047A1000-memory.dmp

memory/4316-73-0x00000000047D0000-0x00000000047D1000-memory.dmp

memory/4316-70-0x00000000047E0000-0x00000000047E2000-memory.dmp

memory/4316-75-0x0000000004820000-0x0000000004821000-memory.dmp

memory/4316-74-0x00000000047C0000-0x00000000047C1000-memory.dmp

memory/4316-76-0x00000000048F0000-0x00000000048F2000-memory.dmp

memory/4316-77-0x0000000004880000-0x0000000004881000-memory.dmp

memory/4316-78-0x0000000004740000-0x0000000004741000-memory.dmp

memory/4316-79-0x0000000004790000-0x0000000004791000-memory.dmp

memory/4316-80-0x0000000004860000-0x0000000004861000-memory.dmp

memory/4316-81-0x0000000004890000-0x0000000004891000-memory.dmp

memory/2716-82-0x0000000000400000-0x000000000042D000-memory.dmp

memory/4316-84-0x0000000000400000-0x00000000006A2000-memory.dmp

memory/4316-83-0x0000000004830000-0x0000000004831000-memory.dmp

memory/4316-85-0x0000000004770000-0x0000000004771000-memory.dmp