fatalrat | 8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419

Analysis

max time kernel
119s
max time network
146s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
21-07-2024 08:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe
Size

17.8MB
MD5

982df76237c9ff52ad1d2cda5176fbc3
SHA1

fc7b82b2c3d4d15d50244a4352dce0ff9efa8f35
SHA256

8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419
SHA512

7cf4db29571fdb290294655d90448e5eccc8260bfee488721170aeb060d6a79ef55113b4b8df3c428c6329dcbabd1322f12dec25309a1acea7903e57293fc8c2
SSDEEP

393216:Y1X6WuA5qyz6CAx8HUtClFqxMzohB2OOvz9S/RjePL/B24fvI:Y9T5R6XrtMNohXez9/DQsI

Score

10^/10

fatalrat aspackv2 evasion infostealer persistence rat trojan upx

Malware Config

Signatures

FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
infostealer rat fatalrat

Fatal Rat payload 1 IoCs

rat infostealer

Processes:

resource	yara_rule
behavioral1/memory/2800-80-0x0000000010000000-0x000000001002A000-memory.dmp	fatalrat

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
C:\Program Files (x86)\uzj.exe	aspack_v212_v242

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2956 cmd.exe
Executes dropped EXE 5 IoCs

Processes:

uzj.exePTvrst.exespolsvt.exespolsvt.exesvcoth.exe

pid process

2488 uzj.exe
2720 PTvrst.exe
2744 spolsvt.exe
2800 spolsvt.exe
1388 svcoth.exe
Loads dropped DLL 5 IoCs

Processes:

8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exeuzj.exePTvrst.exespolsvt.exe

pid process

2036 8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe
2488 uzj.exe
2720 PTvrst.exe
2744 spolsvt.exe
2744 spolsvt.exe

pid	process
2956	cmd.exe

pid	process
2036	8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe
2488	uzj.exe
2720	PTvrst.exe
2744	spolsvt.exe
2744	spolsvt.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2036-0-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/memory/2036-96-0x0000000000400000-0x0000000000433000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

uzj.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\sougoupinyin = "C:\\Users\\Public\\Documents\\sougou\\PTvrst.exe"	uzj.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

uzj.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA uzj.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	uzj.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

PTvrst.exespolsvt.exe

description	pid	process	target process
PID 2720 set thread context of 2744	2720	PTvrst.exe	spolsvt.exe
PID 2744 set thread context of 2800	2744	spolsvt.exe	spolsvt.exe
PID 2744 set thread context of 1388	2744	spolsvt.exe	svcoth.exe

Drops file in Program Files directory 64 IoCs

Processes:

8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\VDK10.STD	8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe
File opened for modification	C:\Program Files (x86)\uzj.exe	8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe	8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\BIBUtils.dll	8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll	8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates	8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia.api	8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_sent.gif	8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_same_reviewers.gif	8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\cryptocme2.sig	8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annots.api	8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Checkers.api	8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prcr.x3d	8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d	8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_joined.gif	8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_ok.gif	8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\BIB.dll	8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Accessibility.api	8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Spelling.api	8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\tesselate.x3d	8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins	8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\distribute_form.gif	8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\ahclient.dll	8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\AUMProduct.cer	8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Search5.api	8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\acro20.lng	8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\MyriadCAD.otf	8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\ADMPlugin.apl	8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker	8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.dll	8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeUpdater.dll	8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\AdobeID.pdf	8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\JP2KLib.dll	8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins	8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\drvSOFT.x3d	8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Esl\AiodLite.dll	8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR	8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\CoolType.dll	8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.dll	8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\QRCode.pmp	8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\main.css	8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AGM.dll	8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\eula.ini	8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP	8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf	8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\SendMail.api	8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome	8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe
File opened for modification	C:\Program Files (x86)\letsvpn-latest.exe	8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\eBook.api	8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\end_review.gif	8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_email.gif	8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOnNotificationInAcrobat.gif	8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\ReadMe.htm	8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\tr.gif	8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\warning.gif	8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AGMGPUOptIn.ini	8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\PDFSigQFormalRep.pdf	8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\AdobePDF417.pmp	8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\Vdk10.rst	8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\VDK10.SYX	8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\add_reviewer.gif	8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Onix32.dll	8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\HLS.api	8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia	8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

spolsvt.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	spolsvt.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	spolsvt.exe

Suspicious behavior: EnumeratesProcesses 52 IoCs

Processes:

uzj.exespolsvt.exe

pid	process
2488	uzj.exe
2800	spolsvt.exe
2800	spolsvt.exe
2800	spolsvt.exe
2800	spolsvt.exe
2800	spolsvt.exe
2800	spolsvt.exe
2800	spolsvt.exe
2800	spolsvt.exe
2800	spolsvt.exe
2800	spolsvt.exe
2800	spolsvt.exe
2800	spolsvt.exe
2800	spolsvt.exe
2800	spolsvt.exe
2800	spolsvt.exe
2800	spolsvt.exe
2800	spolsvt.exe
2800	spolsvt.exe
2800	spolsvt.exe
2800	spolsvt.exe
2800	spolsvt.exe
2800	spolsvt.exe
2800	spolsvt.exe
2800	spolsvt.exe
2800	spolsvt.exe
2800	spolsvt.exe
2800	spolsvt.exe
2800	spolsvt.exe
2800	spolsvt.exe
2800	spolsvt.exe
2800	spolsvt.exe
2800	spolsvt.exe
2800	spolsvt.exe
2800	spolsvt.exe
2800	spolsvt.exe
2800	spolsvt.exe
2800	spolsvt.exe
2800	spolsvt.exe
2800	spolsvt.exe
2800	spolsvt.exe
2800	spolsvt.exe
2800	spolsvt.exe
2800	spolsvt.exe
2800	spolsvt.exe
2800	spolsvt.exe
2800	spolsvt.exe
2800	spolsvt.exe
2800	spolsvt.exe
2800	spolsvt.exe
2800	spolsvt.exe
2800	spolsvt.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

spolsvt.exe

description pid process

Token: SeDebugPrivilege 2800 spolsvt.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

uzj.exePTvrst.exe

pid process

2488 uzj.exe
2488 uzj.exe
2720 PTvrst.exe
2720 PTvrst.exe

description	pid	process
Token: SeDebugPrivilege	2800	spolsvt.exe

Suspicious use of WriteProcessMemory 53 IoCs

Processes:

8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exeuzj.exePTvrst.exespolsvt.exe

description	pid	process	target process
PID 2036 wrote to memory of 2488	2036	8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe	uzj.exe
PID 2036 wrote to memory of 2488	2036	8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe	uzj.exe
PID 2036 wrote to memory of 2488	2036	8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe	uzj.exe
PID 2036 wrote to memory of 2488	2036	8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe	uzj.exe
PID 2488 wrote to memory of 2720	2488	uzj.exe	PTvrst.exe
PID 2488 wrote to memory of 2720	2488	uzj.exe	PTvrst.exe
PID 2488 wrote to memory of 2720	2488	uzj.exe	PTvrst.exe
PID 2488 wrote to memory of 2720	2488	uzj.exe	PTvrst.exe
PID 2488 wrote to memory of 2720	2488	uzj.exe	PTvrst.exe
PID 2488 wrote to memory of 2720	2488	uzj.exe	PTvrst.exe
PID 2488 wrote to memory of 2720	2488	uzj.exe	PTvrst.exe
PID 2720 wrote to memory of 2744	2720	PTvrst.exe	spolsvt.exe
PID 2720 wrote to memory of 2744	2720	PTvrst.exe	spolsvt.exe
PID 2720 wrote to memory of 2744	2720	PTvrst.exe	spolsvt.exe
PID 2720 wrote to memory of 2744	2720	PTvrst.exe	spolsvt.exe
PID 2720 wrote to memory of 2744	2720	PTvrst.exe	spolsvt.exe
PID 2720 wrote to memory of 2744	2720	PTvrst.exe	spolsvt.exe
PID 2720 wrote to memory of 2744	2720	PTvrst.exe	spolsvt.exe
PID 2720 wrote to memory of 2744	2720	PTvrst.exe	spolsvt.exe
PID 2720 wrote to memory of 2744	2720	PTvrst.exe	spolsvt.exe
PID 2720 wrote to memory of 2744	2720	PTvrst.exe	spolsvt.exe
PID 2720 wrote to memory of 2744	2720	PTvrst.exe	spolsvt.exe
PID 2720 wrote to memory of 2744	2720	PTvrst.exe	spolsvt.exe
PID 2744 wrote to memory of 2800	2744	spolsvt.exe	spolsvt.exe
PID 2744 wrote to memory of 2800	2744	spolsvt.exe	spolsvt.exe
PID 2744 wrote to memory of 2800	2744	spolsvt.exe	spolsvt.exe
PID 2744 wrote to memory of 2800	2744	spolsvt.exe	spolsvt.exe
PID 2744 wrote to memory of 2800	2744	spolsvt.exe	spolsvt.exe
PID 2744 wrote to memory of 2800	2744	spolsvt.exe	spolsvt.exe
PID 2744 wrote to memory of 2800	2744	spolsvt.exe	spolsvt.exe
PID 2744 wrote to memory of 2800	2744	spolsvt.exe	spolsvt.exe
PID 2744 wrote to memory of 2800	2744	spolsvt.exe	spolsvt.exe
PID 2744 wrote to memory of 2800	2744	spolsvt.exe	spolsvt.exe
PID 2744 wrote to memory of 2800	2744	spolsvt.exe	spolsvt.exe
PID 2744 wrote to memory of 2800	2744	spolsvt.exe	spolsvt.exe
PID 2036 wrote to memory of 2956	2036	8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe	cmd.exe
PID 2036 wrote to memory of 2956	2036	8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe	cmd.exe
PID 2036 wrote to memory of 2956	2036	8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe	cmd.exe
PID 2036 wrote to memory of 2956	2036	8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe	cmd.exe
PID 2744 wrote to memory of 1388	2744	spolsvt.exe	svcoth.exe
PID 2744 wrote to memory of 1388	2744	spolsvt.exe	svcoth.exe
PID 2744 wrote to memory of 1388	2744	spolsvt.exe	svcoth.exe
PID 2744 wrote to memory of 1388	2744	spolsvt.exe	svcoth.exe
PID 2744 wrote to memory of 1388	2744	spolsvt.exe	svcoth.exe
PID 2744 wrote to memory of 1388	2744	spolsvt.exe	svcoth.exe
PID 2744 wrote to memory of 1388	2744	spolsvt.exe	svcoth.exe
PID 2744 wrote to memory of 1388	2744	spolsvt.exe	svcoth.exe
PID 2744 wrote to memory of 1388	2744	spolsvt.exe	svcoth.exe
PID 2744 wrote to memory of 1388	2744	spolsvt.exe	svcoth.exe
PID 2744 wrote to memory of 1388	2744	spolsvt.exe	svcoth.exe
PID 2744 wrote to memory of 1388	2744	spolsvt.exe	svcoth.exe
PID 2744 wrote to memory of 1388	2744	spolsvt.exe	svcoth.exe
PID 2744 wrote to memory of 1388	2744	spolsvt.exe	svcoth.exe

C:\Users\Admin\AppData\Local\Temp\8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe
"C:\Users\Admin\AppData\Local\Temp\8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Program Files (x86)\uzj.exe
  "C:\Program Files (x86)\uzj.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2488
- - C:\Users\Public\Documents\sougou\PTvrst.exe
    C:\Users\Public\Documents\sougou\PTvrst.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2720
  - - C:\Users\Public\Documents\sougou\spolsvt.exe
      C:\Users\Public\Documents\sougou\spolsvt.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:2744
    - - C:\Users\Public\Documents\dd\spolsvt.exe
        
        C:\Users\Public\Documents\dd\spolsvt.exe
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2800
    - - C:\Users\Public\Documents\uu\svcoth.exe
        
        C:\Users\Public\Documents\uu\svcoth.exe
        5⤵
        Executes dropped EXE
        
        PID:1388
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
  2⤵
  - Deletes itself
  PID:2956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\uzj.exe

Filesize
3.4MB

MD5
175d6f3e75b3cecdc5633ae0524ef496

SHA1
745459089543ef9e523af038064085b2e4af0fee

SHA256
033f23eac17d2a06675459abe2ded52b42f29cfa720c2ccfb507bac2d38988f0

SHA512
5f32dba9ad45cbc6845bfe4f25102947c103072a4258e7e10dd94c888c180fa5d23e80091a5e6b43c7aaa5976133ac83ea17656e4b9c0d2ee1eca8ef5dcdc79f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd

Filesize
300B

MD5
956809fc147bd70d6bdb638c4bda40f8

SHA1
2ac47982a2d38690035d04006c432da7e7f86173

SHA256
8b8b86bcc2f18614027aac9921eacf0b761a504203208cddcc88ebca2d469a97

SHA512
dabf158e4bbfef2f7a6825d9f8d088012f4bf157dba69e12c7acf0a6231e6de6579160d79bf8549fb969be48b603dd6561c58ad7347f66f2defc5eb59f5be17d

Download Submit
C:\Users\Public\Documents\sougou\Mpec.mbt

Filesize
196KB

MD5
e3ed6c93f7296d2716191dc34e4c62b1

SHA1
3921c051dc50365d018f5b9cd7cfdc585bfda2f3

SHA256
48b700a1c7f950271a2c7a0ef9a3503c50221d7703f7e07b6d2997ae2f67c81c

SHA512
dccdd41657f53d0d4746c84271175d4c92b29fc5b86d3a384523dd61645a9239f2666d62568c89aabc77b78dead6c9c9d027a780b90fc9b497ad88580dc90ac1

Download Submit
C:\Users\Public\Documents\sougou\spolsvt.exe

Filesize
9KB

MD5
523d5c39f9d8d2375c3df68251fa2249

SHA1
d4ed365c44bec9246fc1a65a32a7791792647a10

SHA256
20e3dc90a3e83b6202e2a7f4603b60e5e859639cb68693426c400b13aaeabd78

SHA512
526e1bba30d03f1ac177c6ab7409187a730969c429cebef15da68ffcf44b3b93227781eebc827b2f7a0fa17c391e00a0e532263fd0167aeaeb0456f96cfe3ae4

Download Submit
\Users\Public\Documents\dd\spolsvt.exe

Filesize
16KB

MD5
cdce4713e784ae069d73723034a957ff

SHA1
9a393a6bab6568f1a774fb753353223f11367e09

SHA256
b29e48102ecb3d3614e8980a8b8cc63dd2b993c6346f466479244ec2b47b69d8

SHA512
0a3a59a305cc2a6fad4e1315b0bcc5a4129595dfe1e8b703363fa02528d2d7c48d3fd22d365708be84a5557cf1916873df9563c454732f93f94a66e7e3b9fb0f

Download Submit
memory/1388-113-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1388-107-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1388-111-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1388-115-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1388-119-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1388-109-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1388-105-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1388-106-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2036-96-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2036-10-0x0000000002A40000-0x0000000003053000-memory.dmp

Filesize
6.1MB

Download
memory/2036-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2488-12-0x0000000000400000-0x0000000000A13000-memory.dmp

Filesize
6.1MB

Download
memory/2488-15-0x0000000000401000-0x00000000004C4000-memory.dmp

Filesize
780KB

Download
memory/2488-14-0x0000000000400000-0x0000000000A13000-memory.dmp

Filesize
6.1MB

Download
memory/2488-13-0x0000000000400000-0x0000000000A13000-memory.dmp

Filesize
6.1MB

Download
memory/2488-78-0x0000000000400000-0x0000000000A13000-memory.dmp

Filesize
6.1MB

Download
memory/2488-35-0x00000000041B0000-0x00000000047C3000-memory.dmp

Filesize
6.1MB

Download
memory/2488-11-0x0000000000400000-0x0000000000A13000-memory.dmp

Filesize
6.1MB

Download
memory/2720-60-0x0000000000400000-0x0000000000A13000-memory.dmp

Filesize
6.1MB

Download
memory/2720-41-0x0000000000400000-0x0000000000A13000-memory.dmp

Filesize
6.1MB

Download
memory/2720-43-0x0000000000400000-0x0000000000A13000-memory.dmp

Filesize
6.1MB

Download
memory/2720-42-0x0000000000400000-0x0000000000A13000-memory.dmp

Filesize
6.1MB

Download
memory/2720-40-0x0000000000400000-0x0000000000A13000-memory.dmp

Filesize
6.1MB

Download
memory/2744-53-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2744-47-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2744-48-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2744-49-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2744-58-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2744-54-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2744-51-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2800-67-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2800-69-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2800-74-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2800-73-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2800-71-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2800-77-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2800-68-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2800-80-0x0000000010000000-0x000000001002A000-memory.dmp

Filesize
168KB

Download