Analysis
-
max time kernel
139s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
21-07-2024 08:55
Behavioral task
behavioral1
Sample
8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe
Resource
win7-20240705-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
16 signatures
150 seconds
General
-
Target
8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe
-
Size
17.8MB
-
MD5
982df76237c9ff52ad1d2cda5176fbc3
-
SHA1
fc7b82b2c3d4d15d50244a4352dce0ff9efa8f35
-
SHA256
8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419
-
SHA512
7cf4db29571fdb290294655d90448e5eccc8260bfee488721170aeb060d6a79ef55113b4b8df3c428c6329dcbabd1322f12dec25309a1acea7903e57293fc8c2
-
SSDEEP
393216:Y1X6WuA5qyz6CAx8HUtClFqxMzohB2OOvz9S/RjePL/B24fvI:Y9T5R6XrtMNohXez9/DQsI
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload 1 IoCs
resource yara_rule behavioral2/memory/4424-61-0x0000000010000000-0x000000001002A000-memory.dmp fatalrat -
resource yara_rule behavioral2/files/0x00070000000234bf-7.dat aspack_v212_v242 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Control Panel\International\Geo\Nation 8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe -
Executes dropped EXE 5 IoCs
pid Process 3584 uzj.exe 224 PTvrst.exe 2516 spolsvt.exe 4424 spolsvt.exe 4940 svcoth.exe -
resource yara_rule behavioral2/memory/3792-0-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral2/memory/3792-84-0x0000000000400000-0x0000000000433000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sougoupinyin = "C:\\Users\\Public\\Documents\\sougou\\PTvrst.exe" uzj.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA uzj.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 224 set thread context of 2516 224 PTvrst.exe 89 PID 2516 set thread context of 4424 2516 spolsvt.exe 92 PID 2516 set thread context of 4940 2516 spolsvt.exe 96 -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\PlayStore_icon.svg 8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ca-es 8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\fi-fi\ui-strings.js 8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\hr-hr\ui-strings.js 8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\rhp_world_icon_hover.png 8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\S_IlluDCFilesEmpty_180x180.svg 8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\nb-no\ui-strings.js 8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\de-de\ui-strings.js 8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\zh-cn 8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ru-ru 8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\hu-hu 8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\fi-fi\ui-strings.js 8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileAcrobatCard_Dark.pdf 8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\uk-ua\ui-strings.js 8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\it_get.svg 8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\nb-no 8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\Confirmation2x.png 8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\pt-br 8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\zh-tw\ui-strings.js 8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\aic_file_icons_retina_thumb.png 8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\example_icons.png 8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\zh-tw 8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\hr-hr\ui-strings.js 8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ui-strings.js 8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\A3DUtils.dll 8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\vscroll-thumb.png 8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\sk-sk 8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ui-strings.js 8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ca-es\ui-strings.js 8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\root 8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\selection-actions.png 8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sv-se 8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ui-strings.js 8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\fi-fi 8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-gb 8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\hr-hr\ui-strings.js 8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\sk-sk 8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\sl-si\ui-strings.js 8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\css\main.css 8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\multi-tab-file-view.png 8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\en-il\ui-strings.js 8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sv-se 8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\adobe_spinner.gif 8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\check.cur 8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\cs-cz 8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\nl-nl\ui-strings.js 8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\edit-pdf.png 8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\fr-fr 8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark 8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\selection-actions.png 8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images 8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sl-si\ui-strings.js 8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sv-se 8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app 8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\he-il\ui-strings.js 8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\he-il 8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_filter-focus_32.svg 8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sl-sl 8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ja-jp 8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins 8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\css 8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\virgo_mycomputer_folder_icon.svg 8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\sv-se\ui-strings.js 8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\delete.svg 8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 spolsvt.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz spolsvt.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3584 uzj.exe 3584 uzj.exe 4424 spolsvt.exe 4424 spolsvt.exe 4424 spolsvt.exe 4424 spolsvt.exe 4424 spolsvt.exe 4424 spolsvt.exe 4424 spolsvt.exe 4424 spolsvt.exe 4424 spolsvt.exe 4424 spolsvt.exe 4424 spolsvt.exe 4424 spolsvt.exe 4424 spolsvt.exe 4424 spolsvt.exe 4424 spolsvt.exe 4424 spolsvt.exe 4424 spolsvt.exe 4424 spolsvt.exe 4424 spolsvt.exe 4424 spolsvt.exe 4424 spolsvt.exe 4424 spolsvt.exe 4424 spolsvt.exe 4424 spolsvt.exe 4424 spolsvt.exe 4424 spolsvt.exe 4424 spolsvt.exe 4424 spolsvt.exe 4424 spolsvt.exe 4424 spolsvt.exe 4424 spolsvt.exe 4424 spolsvt.exe 4424 spolsvt.exe 4424 spolsvt.exe 4424 spolsvt.exe 4424 spolsvt.exe 4424 spolsvt.exe 4424 spolsvt.exe 4424 spolsvt.exe 4424 spolsvt.exe 4424 spolsvt.exe 4424 spolsvt.exe 4424 spolsvt.exe 4424 spolsvt.exe 4424 spolsvt.exe 4424 spolsvt.exe 4424 spolsvt.exe 4424 spolsvt.exe 4424 spolsvt.exe 4424 spolsvt.exe 4424 spolsvt.exe 4424 spolsvt.exe 4424 spolsvt.exe 4424 spolsvt.exe 4424 spolsvt.exe 4424 spolsvt.exe 4424 spolsvt.exe 4424 spolsvt.exe 4424 spolsvt.exe 4424 spolsvt.exe 4424 spolsvt.exe 4424 spolsvt.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4424 spolsvt.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3584 uzj.exe 3584 uzj.exe 224 PTvrst.exe 224 PTvrst.exe -
Suspicious use of WriteProcessMemory 35 IoCs
description pid Process procid_target PID 3792 wrote to memory of 3584 3792 8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe 87 PID 3792 wrote to memory of 3584 3792 8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe 87 PID 3792 wrote to memory of 3584 3792 8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe 87 PID 3584 wrote to memory of 224 3584 uzj.exe 88 PID 3584 wrote to memory of 224 3584 uzj.exe 88 PID 3584 wrote to memory of 224 3584 uzj.exe 88 PID 224 wrote to memory of 2516 224 PTvrst.exe 89 PID 224 wrote to memory of 2516 224 PTvrst.exe 89 PID 224 wrote to memory of 2516 224 PTvrst.exe 89 PID 224 wrote to memory of 2516 224 PTvrst.exe 89 PID 224 wrote to memory of 2516 224 PTvrst.exe 89 PID 224 wrote to memory of 2516 224 PTvrst.exe 89 PID 224 wrote to memory of 2516 224 PTvrst.exe 89 PID 224 wrote to memory of 2516 224 PTvrst.exe 89 PID 2516 wrote to memory of 4424 2516 spolsvt.exe 92 PID 2516 wrote to memory of 4424 2516 spolsvt.exe 92 PID 2516 wrote to memory of 4424 2516 spolsvt.exe 92 PID 2516 wrote to memory of 4424 2516 spolsvt.exe 92 PID 2516 wrote to memory of 4424 2516 spolsvt.exe 92 PID 2516 wrote to memory of 4424 2516 spolsvt.exe 92 PID 2516 wrote to memory of 4424 2516 spolsvt.exe 92 PID 2516 wrote to memory of 4424 2516 spolsvt.exe 92 PID 2516 wrote to memory of 4940 2516 spolsvt.exe 96 PID 2516 wrote to memory of 4940 2516 spolsvt.exe 96 PID 2516 wrote to memory of 4940 2516 spolsvt.exe 96 PID 2516 wrote to memory of 4940 2516 spolsvt.exe 96 PID 2516 wrote to memory of 4940 2516 spolsvt.exe 96 PID 2516 wrote to memory of 4940 2516 spolsvt.exe 96 PID 2516 wrote to memory of 4940 2516 spolsvt.exe 96 PID 2516 wrote to memory of 4940 2516 spolsvt.exe 96 PID 2516 wrote to memory of 4940 2516 spolsvt.exe 96 PID 2516 wrote to memory of 4940 2516 spolsvt.exe 96 PID 3792 wrote to memory of 3928 3792 8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe 97 PID 3792 wrote to memory of 3928 3792 8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe 97 PID 3792 wrote to memory of 3928 3792 8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe"C:\Users\Admin\AppData\Local\Temp\8493010c4ae899dcc634bd726ecc4c96d469e2a0ba1d37ba8323d3c12f42a419.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3792 -
C:\Program Files (x86)\uzj.exe"C:\Program Files (x86)\uzj.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Users\Public\Documents\sougou\PTvrst.exeC:\Users\Public\Documents\sougou\PTvrst.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Users\Public\Documents\sougou\spolsvt.exeC:\Users\Public\Documents\sougou\spolsvt.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Public\Documents\dd\spolsvt.exeC:\Users\Public\Documents\dd\spolsvt.exe5⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4424
-
-
C:\Users\Public\Documents\uu\svcoth.exeC:\Users\Public\Documents\uu\svcoth.exe5⤵
- Executes dropped EXE
PID:4940
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "2⤵PID:3928
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.4MB
MD5175d6f3e75b3cecdc5633ae0524ef496
SHA1745459089543ef9e523af038064085b2e4af0fee
SHA256033f23eac17d2a06675459abe2ded52b42f29cfa720c2ccfb507bac2d38988f0
SHA5125f32dba9ad45cbc6845bfe4f25102947c103072a4258e7e10dd94c888c180fa5d23e80091a5e6b43c7aaa5976133ac83ea17656e4b9c0d2ee1eca8ef5dcdc79f
-
Filesize
300B
MD5956809fc147bd70d6bdb638c4bda40f8
SHA12ac47982a2d38690035d04006c432da7e7f86173
SHA2568b8b86bcc2f18614027aac9921eacf0b761a504203208cddcc88ebca2d469a97
SHA512dabf158e4bbfef2f7a6825d9f8d088012f4bf157dba69e12c7acf0a6231e6de6579160d79bf8549fb969be48b603dd6561c58ad7347f66f2defc5eb59f5be17d
-
Filesize
16KB
MD5cdce4713e784ae069d73723034a957ff
SHA19a393a6bab6568f1a774fb753353223f11367e09
SHA256b29e48102ecb3d3614e8980a8b8cc63dd2b993c6346f466479244ec2b47b69d8
SHA5120a3a59a305cc2a6fad4e1315b0bcc5a4129595dfe1e8b703363fa02528d2d7c48d3fd22d365708be84a5557cf1916873df9563c454732f93f94a66e7e3b9fb0f
-
Filesize
196KB
MD5e3ed6c93f7296d2716191dc34e4c62b1
SHA13921c051dc50365d018f5b9cd7cfdc585bfda2f3
SHA25648b700a1c7f950271a2c7a0ef9a3503c50221d7703f7e07b6d2997ae2f67c81c
SHA512dccdd41657f53d0d4746c84271175d4c92b29fc5b86d3a384523dd61645a9239f2666d62568c89aabc77b78dead6c9c9d027a780b90fc9b497ad88580dc90ac1
-
Filesize
9KB
MD5523d5c39f9d8d2375c3df68251fa2249
SHA1d4ed365c44bec9246fc1a65a32a7791792647a10
SHA25620e3dc90a3e83b6202e2a7f4603b60e5e859639cb68693426c400b13aaeabd78
SHA512526e1bba30d03f1ac177c6ab7409187a730969c429cebef15da68ffcf44b3b93227781eebc827b2f7a0fa17c391e00a0e532263fd0167aeaeb0456f96cfe3ae4