Analysis
-
max time kernel
119s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
07-08-2024 15:49
Behavioral task
behavioral1
Sample
win32-quickq.exe
Resource
win7-20240705-en
windows7-x64
20 signatures
150 seconds
Behavioral task
behavioral2
Sample
win32-quickq.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
16 signatures
150 seconds
General
-
Target
win32-quickq.exe
-
Size
96.1MB
-
MD5
86070741782fef50023aedd4d9ae7749
-
SHA1
803654c7a33fa34fadec369c2cb56220f6e97699
-
SHA256
7ff792e6fbf711a1230e8d5d49eac55d26567796435655af08eceebf27093368
-
SHA512
4e06f424636fb4d345e7917974c72aaec3561df18af81d17ce248a12670991cb014838efb05d5ac8369561f9a957b297cc6679be8dd0b4f952186d42da656b55
-
SSDEEP
3145728:gwgwEHtKqYKDPoAmL1EcgpDYPSvinKZzH:lnawAmpg64BZz
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2036-103-0x0000000010000000-0x000000001002A000-memory.dmp fatalrat -
Processes:
resource yara_rule behavioral1/files/0x0005000000019249-31.dat aspack_v212_v242 -
Deletes itself 1 IoCs
Processes:
cmd.exepid Process 3332 cmd.exe -
Executes dropped EXE 6 IoCs
Processes:
sg.tmpubc.exeQTalk.exespolsvt.exespolsvt.exesvcoth.exepid Process 856 sg.tmp 2660 ubc.exe 1996 QTalk.exe 2256 spolsvt.exe 2036 spolsvt.exe 1564 svcoth.exe -
Loads dropped DLL 9 IoCs
Processes:
win32-quickq.exeubc.exeQTalk.exespolsvt.exepid Process 1840 win32-quickq.exe 1840 win32-quickq.exe 2660 ubc.exe 1996 QTalk.exe 1996 QTalk.exe 2256 spolsvt.exe 2256 spolsvt.exe 2256 spolsvt.exe 2256 spolsvt.exe -
Processes:
resource yara_rule behavioral1/memory/1840-0-0x0000000000400000-0x00000000005DA000-memory.dmp upx behavioral1/memory/2092-8-0x0000000000400000-0x00000000005DA000-memory.dmp upx behavioral1/memory/2092-11-0x0000000000400000-0x00000000005DA000-memory.dmp upx behavioral1/memory/1840-133-0x0000000000400000-0x00000000005DA000-memory.dmp upx behavioral1/memory/3288-164-0x0000000000400000-0x00000000005DA000-memory.dmp upx behavioral1/memory/1840-163-0x0000000000400000-0x00000000005DA000-memory.dmp upx behavioral1/memory/3228-160-0x0000000000400000-0x00000000005DA000-memory.dmp upx behavioral1/memory/3228-166-0x0000000000400000-0x00000000005DA000-memory.dmp upx behavioral1/memory/3288-168-0x0000000000400000-0x00000000005DA000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
ubc.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Çý¶¯ÈËÉú = "C:\\Users\\Public\\Documents\\sougou\\PTvrst.exe" ubc.exe -
Processes:
ubc.exedescription ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ubc.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
QTalk.exespolsvt.exedescription pid Process procid_target PID 1996 set thread context of 2256 1996 QTalk.exe 40 PID 2256 set thread context of 2036 2256 spolsvt.exe 41 PID 2256 set thread context of 1564 2256 spolsvt.exe 42 -
Drops file in Program Files directory 64 IoCs
Processes:
win32-quickq.exesg.tmpdescription ioc Process File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOffNotificationInTray.gif win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeUpdater.dll win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\PDFSigQFormalRep.pdf win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-Bold.otf win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt.hyp win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can03.ths win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\zdingbat.txt win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\cryptocme2.dll win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\bl.gif win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\main.css win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\trash.gif win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can129.hsp win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1257.TXT win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\adobepdf.xdc win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOnNotificationInAcrobat.gif win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\FDFFile_8.ico win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CROATIAN.TXT win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AXE8SharedExpat.dll win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\rss.gif win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CENTEURO.TXT win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\tl.gif win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\engphon.env win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ROMAN.TXT win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.pdf win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\pdf.gif win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt32.clx win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\form_responses.gif win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt55.ths win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Onix32.dll win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_super.gif win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can.hyp win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa37.hyp win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroSign.prc win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_browser.gif win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\ReadMe.htm win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\PDFFile_8.ico win32-quickq.exe File created C:\Program Files (x86)\win32-quickq.exe sg.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\DefaultID.pdf win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\warning.gif win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-Regular.otf win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\SY______.PFB win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\eng.hyp win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\eula.ini win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_joined.gif win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_US.txt win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeLinguistic.dll win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\ccme_base.dll win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\br.gif win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AXSLE.dll win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\create_form.gif win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-BoldOblique.otf win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SecStoreFile.ico win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1258.TXT win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-Oblique.otf win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_US_POSIX.txt win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\icudt26l.dat win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_shared.gif win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\ZX______.PFB win32-quickq.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\helpmap.txt win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\logsession.dll win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\open_original_form.gif win32-quickq.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
spolsvt.exewin32-quickq.exewin32-quickq.exewin32-quickq.exeubc.exeQTalk.exespolsvt.exesvcoth.exewin32-quickq.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spolsvt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language win32-quickq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language win32-quickq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language win32-quickq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ubc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QTalk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spolsvt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svcoth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language win32-quickq.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
spolsvt.exedescription ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 spolsvt.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz spolsvt.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 52 IoCs
Processes:
win32-quickq.exespolsvt.exepid Process 1840 win32-quickq.exe 2036 spolsvt.exe 2036 spolsvt.exe 2036 spolsvt.exe 2036 spolsvt.exe 2036 spolsvt.exe 2036 spolsvt.exe 2036 spolsvt.exe 2036 spolsvt.exe 2036 spolsvt.exe 2036 spolsvt.exe 2036 spolsvt.exe 2036 spolsvt.exe 2036 spolsvt.exe 2036 spolsvt.exe 2036 spolsvt.exe 2036 spolsvt.exe 2036 spolsvt.exe 2036 spolsvt.exe 2036 spolsvt.exe 2036 spolsvt.exe 2036 spolsvt.exe 2036 spolsvt.exe 2036 spolsvt.exe 2036 spolsvt.exe 2036 spolsvt.exe 2036 spolsvt.exe 2036 spolsvt.exe 2036 spolsvt.exe 2036 spolsvt.exe 2036 spolsvt.exe 2036 spolsvt.exe 2036 spolsvt.exe 2036 spolsvt.exe 2036 spolsvt.exe 2036 spolsvt.exe 2036 spolsvt.exe 2036 spolsvt.exe 2036 spolsvt.exe 2036 spolsvt.exe 2036 spolsvt.exe 2036 spolsvt.exe 2036 spolsvt.exe 2036 spolsvt.exe 2036 spolsvt.exe 2036 spolsvt.exe 2036 spolsvt.exe 2036 spolsvt.exe 2036 spolsvt.exe 2036 spolsvt.exe 2036 spolsvt.exe 2036 spolsvt.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
Processes:
win32-quickq.exewin32-quickq.exesg.tmpspolsvt.exewin32-quickq.exewin32-quickq.exedescription pid Process Token: SeBackupPrivilege 1840 win32-quickq.exe Token: SeRestorePrivilege 1840 win32-quickq.exe Token: 33 1840 win32-quickq.exe Token: SeIncBasePriorityPrivilege 1840 win32-quickq.exe Token: SeCreateGlobalPrivilege 1840 win32-quickq.exe Token: 33 1840 win32-quickq.exe Token: SeIncBasePriorityPrivilege 1840 win32-quickq.exe Token: 33 1840 win32-quickq.exe Token: SeIncBasePriorityPrivilege 1840 win32-quickq.exe Token: SeBackupPrivilege 2092 win32-quickq.exe Token: SeRestorePrivilege 2092 win32-quickq.exe Token: 33 2092 win32-quickq.exe Token: SeIncBasePriorityPrivilege 2092 win32-quickq.exe Token: 33 1840 win32-quickq.exe Token: SeIncBasePriorityPrivilege 1840 win32-quickq.exe Token: SeRestorePrivilege 856 sg.tmp Token: 35 856 sg.tmp Token: SeSecurityPrivilege 856 sg.tmp Token: SeSecurityPrivilege 856 sg.tmp Token: 33 1840 win32-quickq.exe Token: SeIncBasePriorityPrivilege 1840 win32-quickq.exe Token: SeDebugPrivilege 1840 win32-quickq.exe Token: SeDebugPrivilege 2036 spolsvt.exe Token: 33 1840 win32-quickq.exe Token: SeIncBasePriorityPrivilege 1840 win32-quickq.exe Token: 33 1840 win32-quickq.exe Token: SeIncBasePriorityPrivilege 1840 win32-quickq.exe Token: SeBackupPrivilege 3228 win32-quickq.exe Token: SeRestorePrivilege 3228 win32-quickq.exe Token: 33 3228 win32-quickq.exe Token: SeIncBasePriorityPrivilege 3228 win32-quickq.exe Token: SeBackupPrivilege 3288 win32-quickq.exe Token: SeRestorePrivilege 3288 win32-quickq.exe Token: 33 3288 win32-quickq.exe Token: SeIncBasePriorityPrivilege 3288 win32-quickq.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
ubc.exeQTalk.exepid Process 2660 ubc.exe 2660 ubc.exe 1996 QTalk.exe 1996 QTalk.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
win32-quickq.exeubc.exeQTalk.exespolsvt.exewin32-quickq.exewin32-quickq.exedescription pid Process procid_target PID 1840 wrote to memory of 2108 1840 win32-quickq.exe 31 PID 1840 wrote to memory of 2108 1840 win32-quickq.exe 31 PID 1840 wrote to memory of 2108 1840 win32-quickq.exe 31 PID 1840 wrote to memory of 2108 1840 win32-quickq.exe 31 PID 1840 wrote to memory of 2092 1840 win32-quickq.exe 33 PID 1840 wrote to memory of 2092 1840 win32-quickq.exe 33 PID 1840 wrote to memory of 2092 1840 win32-quickq.exe 33 PID 1840 wrote to memory of 2092 1840 win32-quickq.exe 33 PID 1840 wrote to memory of 856 1840 win32-quickq.exe 34 PID 1840 wrote to memory of 856 1840 win32-quickq.exe 34 PID 1840 wrote to memory of 856 1840 win32-quickq.exe 34 PID 1840 wrote to memory of 856 1840 win32-quickq.exe 34 PID 1840 wrote to memory of 2660 1840 win32-quickq.exe 36 PID 1840 wrote to memory of 2660 1840 win32-quickq.exe 36 PID 1840 wrote to memory of 2660 1840 win32-quickq.exe 36 PID 1840 wrote to memory of 2660 1840 win32-quickq.exe 36 PID 2660 wrote to memory of 1996 2660 ubc.exe 39 PID 2660 wrote to memory of 1996 2660 ubc.exe 39 PID 2660 wrote to memory of 1996 2660 ubc.exe 39 PID 2660 wrote to memory of 1996 2660 ubc.exe 39 PID 1996 wrote to memory of 2256 1996 QTalk.exe 40 PID 1996 wrote to memory of 2256 1996 QTalk.exe 40 PID 1996 wrote to memory of 2256 1996 QTalk.exe 40 PID 1996 wrote to memory of 2256 1996 QTalk.exe 40 PID 1996 wrote to memory of 2256 1996 QTalk.exe 40 PID 1996 wrote to memory of 2256 1996 QTalk.exe 40 PID 1996 wrote to memory of 2256 1996 QTalk.exe 40 PID 1996 wrote to memory of 2256 1996 QTalk.exe 40 PID 1996 wrote to memory of 2256 1996 QTalk.exe 40 PID 2256 wrote to memory of 2036 2256 spolsvt.exe 41 PID 2256 wrote to memory of 2036 2256 spolsvt.exe 41 PID 2256 wrote to memory of 2036 2256 spolsvt.exe 41 PID 2256 wrote to memory of 2036 2256 spolsvt.exe 41 PID 2256 wrote to memory of 2036 2256 spolsvt.exe 41 PID 2256 wrote to memory of 2036 2256 spolsvt.exe 41 PID 2256 wrote to memory of 2036 2256 spolsvt.exe 41 PID 2256 wrote to memory of 2036 2256 spolsvt.exe 41 PID 2256 wrote to memory of 2036 2256 spolsvt.exe 41 PID 2256 wrote to memory of 1564 2256 spolsvt.exe 42 PID 2256 wrote to memory of 1564 2256 spolsvt.exe 42 PID 2256 wrote to memory of 1564 2256 spolsvt.exe 42 PID 2256 wrote to memory of 1564 2256 spolsvt.exe 42 PID 2256 wrote to memory of 1564 2256 spolsvt.exe 42 PID 2256 wrote to memory of 1564 2256 spolsvt.exe 42 PID 2256 wrote to memory of 1564 2256 spolsvt.exe 42 PID 2256 wrote to memory of 1564 2256 spolsvt.exe 42 PID 2256 wrote to memory of 1564 2256 spolsvt.exe 42 PID 2256 wrote to memory of 1564 2256 spolsvt.exe 42 PID 2256 wrote to memory of 1564 2256 spolsvt.exe 42 PID 1840 wrote to memory of 3228 1840 win32-quickq.exe 43 PID 1840 wrote to memory of 3228 1840 win32-quickq.exe 43 PID 1840 wrote to memory of 3228 1840 win32-quickq.exe 43 PID 1840 wrote to memory of 3228 1840 win32-quickq.exe 43 PID 1840 wrote to memory of 3288 1840 win32-quickq.exe 44 PID 1840 wrote to memory of 3288 1840 win32-quickq.exe 44 PID 1840 wrote to memory of 3288 1840 win32-quickq.exe 44 PID 1840 wrote to memory of 3288 1840 win32-quickq.exe 44 PID 3228 wrote to memory of 3332 3228 win32-quickq.exe 45 PID 3228 wrote to memory of 3332 3228 win32-quickq.exe 45 PID 3228 wrote to memory of 3332 3228 win32-quickq.exe 45 PID 3228 wrote to memory of 3332 3228 win32-quickq.exe 45 PID 3288 wrote to memory of 3364 3288 win32-quickq.exe 47 PID 3288 wrote to memory of 3364 3288 win32-quickq.exe 47 PID 3288 wrote to memory of 3364 3288 win32-quickq.exe 47
Processes
-
C:\Users\Admin\AppData\Local\Temp\win32-quickq.exe"C:\Users\Admin\AppData\Local\Temp\win32-quickq.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Windows\system32\cmd.execmd.exe /c set2⤵PID:2108
-
-
C:\Users\Admin\AppData\Local\Temp\win32-quickq.exePECMD**pecmd-cmd* PUTF -dd -skipb=1205760 -len=99517037 "C:\Users\Admin\AppData\Local\Temp\~2837315189964106549.tmp",,C:\Users\Admin\AppData\Local\Temp\win32-quickq.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2092
-
-
C:\Users\Admin\AppData\Local\Temp\~8272606958580807488~\sg.tmp7zG_exe x "C:\Users\Admin\AppData\Local\Temp\~2837315189964106549.tmp" -y -aoa -o"C:\Program Files (x86)\"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:856
-
-
C:\Program Files (x86)\ubc.exe"C:\Program Files (x86)\\ubc.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Public\Documents\sougou\V4.6.80\Bin\QTalk.exeC:\Users\Public\Documents\sougou\V4.6.80\Bin\QTalk.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Public\Documents\sougou\spolsvt.exeC:\Users\Public\Documents\sougou\spolsvt.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Users\Public\Documents\dd\spolsvt.exeC:\Users\Public\Documents\dd\spolsvt.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2036
-
-
C:\Users\Public\Documents\uu\svcoth.exeC:\Users\Public\Documents\uu\svcoth.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1564
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\win32-quickq.exePECMD**pecmd-cmd* EXEC -wd:C: -hide cmd /c "C:\Users\Admin\AppData\Local\Temp\~7419308530091295175.cmd"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\~7419308530091295175.cmd"3⤵
- Deletes itself
PID:3332 -
C:\Windows\system32\PING.EXEping -n 2 127.0.0.14⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3396
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\win32-quickq.exePECMD**pecmd-cmd* EXEC -wd:C: -hide cmd /c "C:\Users\Admin\AppData\Local\Temp\~7022595940636935794.cmd"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\~7022595940636935794.cmd"3⤵PID:3364
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
786KB
MD54f927a44963d8b315693cdf2c4695dd3
SHA171aa9de5a5882f0f5d8c4bb7ba980f9b3c68e11d
SHA25673f4ea90010122716aa80f43a9d40bf2d5b38f023199f26ec04d4a866e113d3d
SHA5124cbb156404badcd37d8a2c1a1e57017e63ea7b498c6b913685026ce175eca683724956b691ee31b944f4aa5b752aa6a8d21b45391ca65ba76811debd8efe7f9c
-
Filesize
280B
MD542ff656bd4ee3e19a5828940041fdfdb
SHA12e3c7f0fd42dd48b014e82e9e5edf50664ae5698
SHA256b326705c28abc9947182f84830e0e680d35551157b408a0f9cfd137279a02838
SHA5124ba36b5e44c94df09b91b3557237dae6b74a9fe04da686f157938446cf635c464f616126e937400ee4d577708b3bdcb7f88cec8df23d344bfd7105b75f9ec7b0
-
Filesize
365B
MD56108321ae8ebdf91ffa59bc72b4652b7
SHA1c678d1a33139f8016c014dea6f5763671539ee59
SHA256bd559493a4648bc69da3165aafc195ab519af9d10bf8454bf10d7bb5913bf0f5
SHA5121d74b13759270b8f131f076ccf37b972c9d070e9bfe3ebab91b603d2227e873b96b580ea1901e88060eb8432757277c42de7f97886e5d8b7b00674de1d011710
-
Filesize
715KB
MD57c4718943bd3f66ebdb47ccca72c7b1e
SHA1f9edfaa7adb8fa528b2e61b2b251f18da10a6969
SHA2564cc32d00338fc7b206a7c052297acf9ac304ae7de9d61a2475a116959c1524fc
SHA512e18c40d646fa4948f90f7471da55489df431f255041ebb6dcef86346f91078c9b27894e27216a4b2fe2a1c5e501c7953c77893cf696930123d28a322d49e1516
-
Filesize
196KB
MD5fc51b596793d77c284e29c7b1371c1e9
SHA1af3bec0adbcb9ec9b10ed7c4f826fc5137d6db3f
SHA256157507c0e3aaababdb6087104a9841995c1cd5b06991bccf192cba68cbfb2281
SHA512e160812d3d8d33d2ca4df4177073e7a8dedfad443f49cd87316d049b1a9efcfe5de14d8aabb7c900a6b484181fe34a71f4ca70c31f7fcaf76679b649fffaa73d
-
Filesize
16KB
MD5cdce4713e784ae069d73723034a957ff
SHA19a393a6bab6568f1a774fb753353223f11367e09
SHA256b29e48102ecb3d3614e8980a8b8cc63dd2b993c6346f466479244ec2b47b69d8
SHA5120a3a59a305cc2a6fad4e1315b0bcc5a4129595dfe1e8b703363fa02528d2d7c48d3fd22d365708be84a5557cf1916873df9563c454732f93f94a66e7e3b9fb0f
-
Filesize
9KB
MD5523d5c39f9d8d2375c3df68251fa2249
SHA1d4ed365c44bec9246fc1a65a32a7791792647a10
SHA25620e3dc90a3e83b6202e2a7f4603b60e5e859639cb68693426c400b13aaeabd78
SHA512526e1bba30d03f1ac177c6ab7409187a730969c429cebef15da68ffcf44b3b93227781eebc827b2f7a0fa17c391e00a0e532263fd0167aeaeb0456f96cfe3ae4