Analysis
-
max time kernel
120s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
20-07-2024 09:36
Behavioral task
behavioral1
Sample
letsvpn-latest.exe
Resource
win7-20240704-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
letsvpn-latest.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
16 signatures
150 seconds
General
-
Target
letsvpn-latest.exe
-
Size
17.8MB
-
MD5
982df76237c9ff52ad1d2cda5176fbc3
-
SHA1
fc7b82b2c3d4d15d50244a4352dce0ff9efa8f35
-
SHA256
8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419
-
SHA512
7cf4db29571fdb290294655d90448e5eccc8260bfee488721170aeb060d6a79ef55113b4b8df3c428c6329dcbabd1322f12dec25309a1acea7903e57293fc8c2
-
SSDEEP
393216:Y1X6WuA5qyz6CAx8HUtClFqxMzohB2OOvz9S/RjePL/B24fvI:Y9T5R6XrtMNohXez9/DQsI
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload 1 IoCs
resource yara_rule behavioral1/memory/3000-78-0x0000000010000000-0x000000001002A000-memory.dmp fatalrat -
resource yara_rule behavioral1/files/0x0009000000016d89-6.dat aspack_v212_v242 -
Deletes itself 1 IoCs
pid Process 1028 cmd.exe -
Executes dropped EXE 5 IoCs
pid Process 3024 uzj.exe 2608 PTvrst.exe 3012 spolsvt.exe 3000 spolsvt.exe 2784 svcoth.exe -
Loads dropped DLL 5 IoCs
pid Process 2376 letsvpn-latest.exe 3024 uzj.exe 2608 PTvrst.exe 3012 spolsvt.exe 3012 spolsvt.exe -
resource yara_rule behavioral1/memory/2376-0-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/memory/2376-96-0x0000000000400000-0x0000000000433000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\sougoupinyin = "C:\\Users\\Public\\Documents\\sougou\\PTvrst.exe" uzj.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA uzj.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2608 set thread context of 3012 2608 PTvrst.exe 32 PID 3012 set thread context of 3000 3012 spolsvt.exe 34 PID 3012 set thread context of 2784 3012 spolsvt.exe 38 -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\letsvpn-latest.exe letsvpn-latest.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\ccme_base.dll letsvpn-latest.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\DefaultID.pdf letsvpn-latest.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\AdobePDF417.pmp letsvpn-latest.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\VDK10.STP letsvpn-latest.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\ViewerPS.dll letsvpn-latest.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\CMap\Identity-H letsvpn-latest.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe letsvpn-latest.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AGMGPUOptIn.ini letsvpn-latest.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\DVA.api letsvpn-latest.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia.api letsvpn-latest.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\cryptocme2.dll letsvpn-latest.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\icucnv36.dll letsvpn-latest.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Search5.api letsvpn-latest.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\tl.gif letsvpn-latest.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\ended_review_or_form.gif letsvpn-latest.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\main.css letsvpn-latest.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader letsvpn-latest.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe letsvpn-latest.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\MakeAccessible.api letsvpn-latest.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\Flash.mpp letsvpn-latest.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d letsvpn-latest.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_super.gif letsvpn-latest.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\info.gif letsvpn-latest.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroTextExtractor.exe letsvpn-latest.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser letsvpn-latest.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\VDK10.RSD letsvpn-latest.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe letsvpn-latest.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\rt3d.dll letsvpn-latest.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_same_reviewers.gif letsvpn-latest.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\ahclient.dll letsvpn-latest.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\AUMProduct.cer letsvpn-latest.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\eula.ini letsvpn-latest.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\adobepdf.xdc letsvpn-latest.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Checkers.api letsvpn-latest.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\eBook.api letsvpn-latest.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\Vdk10.rst letsvpn-latest.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\drvDX8.x3d letsvpn-latest.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\BIBUtils.dll letsvpn-latest.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts letsvpn-latest.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\README.TXT letsvpn-latest.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf letsvpn-latest.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\sqlite.dll letsvpn-latest.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOnNotificationInAcrobat.gif letsvpn-latest.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\DataMatrix.pmp letsvpn-latest.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\acro20.lng letsvpn-latest.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_email.gif letsvpn-latest.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\Words.pdf letsvpn-latest.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\PPKLite.api letsvpn-latest.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\drvSOFT.x3d letsvpn-latest.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOffNotificationInAcrobat.gif letsvpn-latest.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\CoolType.dll letsvpn-latest.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\icudt36.dll letsvpn-latest.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm letsvpn-latest.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf letsvpn-latest.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe letsvpn-latest.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\end_review.gif letsvpn-latest.exe File created C:\Program Files (x86)\uzj.exe letsvpn-latest.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.dll letsvpn-latest.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeLinguistic.dll letsvpn-latest.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\JSByteCodeWin.bin letsvpn-latest.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\email_all.gif letsvpn-latest.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\PDFPrevHndlr.dll letsvpn-latest.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\DigSig.api letsvpn-latest.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 spolsvt.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz spolsvt.exe -
Suspicious behavior: EnumeratesProcesses 52 IoCs
pid Process 3024 uzj.exe 3000 spolsvt.exe 3000 spolsvt.exe 3000 spolsvt.exe 3000 spolsvt.exe 3000 spolsvt.exe 3000 spolsvt.exe 3000 spolsvt.exe 3000 spolsvt.exe 3000 spolsvt.exe 3000 spolsvt.exe 3000 spolsvt.exe 3000 spolsvt.exe 3000 spolsvt.exe 3000 spolsvt.exe 3000 spolsvt.exe 3000 spolsvt.exe 3000 spolsvt.exe 3000 spolsvt.exe 3000 spolsvt.exe 3000 spolsvt.exe 3000 spolsvt.exe 3000 spolsvt.exe 3000 spolsvt.exe 3000 spolsvt.exe 3000 spolsvt.exe 3000 spolsvt.exe 3000 spolsvt.exe 3000 spolsvt.exe 3000 spolsvt.exe 3000 spolsvt.exe 3000 spolsvt.exe 3000 spolsvt.exe 3000 spolsvt.exe 3000 spolsvt.exe 3000 spolsvt.exe 3000 spolsvt.exe 3000 spolsvt.exe 3000 spolsvt.exe 3000 spolsvt.exe 3000 spolsvt.exe 3000 spolsvt.exe 3000 spolsvt.exe 3000 spolsvt.exe 3000 spolsvt.exe 3000 spolsvt.exe 3000 spolsvt.exe 3000 spolsvt.exe 3000 spolsvt.exe 3000 spolsvt.exe 3000 spolsvt.exe 3000 spolsvt.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3000 spolsvt.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3024 uzj.exe 3024 uzj.exe 2608 PTvrst.exe 2608 PTvrst.exe -
Suspicious use of WriteProcessMemory 53 IoCs
description pid Process procid_target PID 2376 wrote to memory of 3024 2376 letsvpn-latest.exe 30 PID 2376 wrote to memory of 3024 2376 letsvpn-latest.exe 30 PID 2376 wrote to memory of 3024 2376 letsvpn-latest.exe 30 PID 2376 wrote to memory of 3024 2376 letsvpn-latest.exe 30 PID 3024 wrote to memory of 2608 3024 uzj.exe 31 PID 3024 wrote to memory of 2608 3024 uzj.exe 31 PID 3024 wrote to memory of 2608 3024 uzj.exe 31 PID 3024 wrote to memory of 2608 3024 uzj.exe 31 PID 3024 wrote to memory of 2608 3024 uzj.exe 31 PID 3024 wrote to memory of 2608 3024 uzj.exe 31 PID 3024 wrote to memory of 2608 3024 uzj.exe 31 PID 2608 wrote to memory of 3012 2608 PTvrst.exe 32 PID 2608 wrote to memory of 3012 2608 PTvrst.exe 32 PID 2608 wrote to memory of 3012 2608 PTvrst.exe 32 PID 2608 wrote to memory of 3012 2608 PTvrst.exe 32 PID 2608 wrote to memory of 3012 2608 PTvrst.exe 32 PID 2608 wrote to memory of 3012 2608 PTvrst.exe 32 PID 2608 wrote to memory of 3012 2608 PTvrst.exe 32 PID 2608 wrote to memory of 3012 2608 PTvrst.exe 32 PID 2608 wrote to memory of 3012 2608 PTvrst.exe 32 PID 2608 wrote to memory of 3012 2608 PTvrst.exe 32 PID 2608 wrote to memory of 3012 2608 PTvrst.exe 32 PID 2608 wrote to memory of 3012 2608 PTvrst.exe 32 PID 3012 wrote to memory of 3000 3012 spolsvt.exe 34 PID 3012 wrote to memory of 3000 3012 spolsvt.exe 34 PID 3012 wrote to memory of 3000 3012 spolsvt.exe 34 PID 3012 wrote to memory of 3000 3012 spolsvt.exe 34 PID 3012 wrote to memory of 3000 3012 spolsvt.exe 34 PID 3012 wrote to memory of 3000 3012 spolsvt.exe 34 PID 3012 wrote to memory of 3000 3012 spolsvt.exe 34 PID 3012 wrote to memory of 3000 3012 spolsvt.exe 34 PID 3012 wrote to memory of 3000 3012 spolsvt.exe 34 PID 3012 wrote to memory of 3000 3012 spolsvt.exe 34 PID 3012 wrote to memory of 3000 3012 spolsvt.exe 34 PID 3012 wrote to memory of 3000 3012 spolsvt.exe 34 PID 2376 wrote to memory of 1028 2376 letsvpn-latest.exe 35 PID 2376 wrote to memory of 1028 2376 letsvpn-latest.exe 35 PID 2376 wrote to memory of 1028 2376 letsvpn-latest.exe 35 PID 2376 wrote to memory of 1028 2376 letsvpn-latest.exe 35 PID 3012 wrote to memory of 2784 3012 spolsvt.exe 38 PID 3012 wrote to memory of 2784 3012 spolsvt.exe 38 PID 3012 wrote to memory of 2784 3012 spolsvt.exe 38 PID 3012 wrote to memory of 2784 3012 spolsvt.exe 38 PID 3012 wrote to memory of 2784 3012 spolsvt.exe 38 PID 3012 wrote to memory of 2784 3012 spolsvt.exe 38 PID 3012 wrote to memory of 2784 3012 spolsvt.exe 38 PID 3012 wrote to memory of 2784 3012 spolsvt.exe 38 PID 3012 wrote to memory of 2784 3012 spolsvt.exe 38 PID 3012 wrote to memory of 2784 3012 spolsvt.exe 38 PID 3012 wrote to memory of 2784 3012 spolsvt.exe 38 PID 3012 wrote to memory of 2784 3012 spolsvt.exe 38 PID 3012 wrote to memory of 2784 3012 spolsvt.exe 38 PID 3012 wrote to memory of 2784 3012 spolsvt.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\letsvpn-latest.exe"C:\Users\Admin\AppData\Local\Temp\letsvpn-latest.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Program Files (x86)\uzj.exe"C:\Program Files (x86)\uzj.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Public\Documents\sougou\PTvrst.exeC:\Users\Public\Documents\sougou\PTvrst.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Public\Documents\sougou\spolsvt.exeC:\Users\Public\Documents\sougou\spolsvt.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Users\Public\Documents\dd\spolsvt.exeC:\Users\Public\Documents\dd\spolsvt.exe5⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3000
-
-
C:\Users\Public\Documents\uu\svcoth.exeC:\Users\Public\Documents\uu\svcoth.exe5⤵
- Executes dropped EXE
PID:2784
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "2⤵
- Deletes itself
PID:1028
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
200B
MD549392034c34a69a3d76f8b0a73b40279
SHA165a9e49b2bd4d1af694ef07bf73096c1985a0ff8
SHA256b1a2d0b53be9fc6e3a3a7a394192cc640b08d5b59097624feba6f519072c54a0
SHA5129cd6ab4d4e5e0b2e60b1b9bb7cd382eb66afbb6079d7bf560708a43c1bee662d6fa2a2b491bc316abbaff80b425c2bdb69740cad60d543eeef056800afdc0068
-
Filesize
196KB
MD5e3ed6c93f7296d2716191dc34e4c62b1
SHA13921c051dc50365d018f5b9cd7cfdc585bfda2f3
SHA25648b700a1c7f950271a2c7a0ef9a3503c50221d7703f7e07b6d2997ae2f67c81c
SHA512dccdd41657f53d0d4746c84271175d4c92b29fc5b86d3a384523dd61645a9239f2666d62568c89aabc77b78dead6c9c9d027a780b90fc9b497ad88580dc90ac1
-
Filesize
9KB
MD5523d5c39f9d8d2375c3df68251fa2249
SHA1d4ed365c44bec9246fc1a65a32a7791792647a10
SHA25620e3dc90a3e83b6202e2a7f4603b60e5e859639cb68693426c400b13aaeabd78
SHA512526e1bba30d03f1ac177c6ab7409187a730969c429cebef15da68ffcf44b3b93227781eebc827b2f7a0fa17c391e00a0e532263fd0167aeaeb0456f96cfe3ae4
-
Filesize
3.4MB
MD5175d6f3e75b3cecdc5633ae0524ef496
SHA1745459089543ef9e523af038064085b2e4af0fee
SHA256033f23eac17d2a06675459abe2ded52b42f29cfa720c2ccfb507bac2d38988f0
SHA5125f32dba9ad45cbc6845bfe4f25102947c103072a4258e7e10dd94c888c180fa5d23e80091a5e6b43c7aaa5976133ac83ea17656e4b9c0d2ee1eca8ef5dcdc79f
-
Filesize
16KB
MD5cdce4713e784ae069d73723034a957ff
SHA19a393a6bab6568f1a774fb753353223f11367e09
SHA256b29e48102ecb3d3614e8980a8b8cc63dd2b993c6346f466479244ec2b47b69d8
SHA5120a3a59a305cc2a6fad4e1315b0bcc5a4129595dfe1e8b703363fa02528d2d7c48d3fd22d365708be84a5557cf1916873df9563c454732f93f94a66e7e3b9fb0f