Analysis
-
max time kernel
120s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
31-08-2024 13:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
win32-quickq_1.exe
Resource
win7-20240704-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
win32-quickq_1.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
win32-quickq_1.exe
-
Size
98.7MB
-
MD5
04aa93ac264dad188b6ff159cecd91bb
-
SHA1
fa0195948980e2c87b19fa204dcf59fcbc3b617a
-
SHA256
4a857879a18963c27be6897ff664345350c73fa03d9b6d4abd5fc3cbb340f65b
-
SHA512
84edfddda0c508ce2ecd2cafab0dd25bbcc0a629e746629f496e9652ac865e2801093d54db085f6da5af5b3875fa87fabf90664694bf1152653c502fccc04f82
-
SSDEEP
3145728:nHjklfmY8m9A8zcpSKpTVfmYOo683CMD7++t6:HjksCofphNO4nm+t
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1196-90-0x0000000010000000-0x000000001002A000-memory.dmp fatalrat -
Deletes itself 1 IoCs
Processes:
cmd.exepid Process 1680 cmd.exe -
Executes dropped EXE 6 IoCs
Processes:
sg.tmpuyd.exeQTalk.exespolsvt.exespolsvt.exesvcoth.exepid Process 2220 sg.tmp 2160 uyd.exe 1908 QTalk.exe 2124 spolsvt.exe 1196 spolsvt.exe 2864 svcoth.exe -
Loads dropped DLL 9 IoCs
Processes:
win32-quickq_1.exeuyd.exeQTalk.exespolsvt.exepid Process 2032 win32-quickq_1.exe 2032 win32-quickq_1.exe 2160 uyd.exe 1908 QTalk.exe 1908 QTalk.exe 2124 spolsvt.exe 2124 spolsvt.exe 2124 spolsvt.exe 2124 spolsvt.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
uyd.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Çý¶¯ÈËÉú = "C:\\Users\\Public\\Documents\\sougou\\PTvrst.exe" uyd.exe -
Processes:
uyd.exedescription ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA uyd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
QTalk.exespolsvt.exedescription pid Process procid_target PID 1908 set thread context of 2124 1908 QTalk.exe 39 PID 2124 set thread context of 1196 2124 spolsvt.exe 40 PID 2124 set thread context of 2864 2124 spolsvt.exe 41 -
Drops file in Program Files directory 64 IoCs
Processes:
win32-quickq_1.exesg.tmpdescription ioc Process File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\open_original_form.gif win32-quickq_1.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\stop_collection_data.gif win32-quickq_1.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOnNotificationInAcrobat.gif win32-quickq_1.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-Bold.otf win32-quickq_1.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AGMGPUOptIn.ini win32-quickq_1.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.dll win32-quickq_1.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\MyriadCAD.otf win32-quickq_1.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\RTC.der win32-quickq_1.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-BoldIt.otf win32-quickq_1.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\PDXFile_8.ico win32-quickq_1.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\eng32.clx win32-quickq_1.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-Oblique.otf win32-quickq_1.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-Bold.otf win32-quickq_1.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe win32-quickq_1.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\zdingbat.txt win32-quickq_1.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\atl.dll win32-quickq_1.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\DefaultID.pdf win32-quickq_1.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\br.gif win32-quickq_1.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_joined.gif win32-quickq_1.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\GREEK.TXT win32-quickq_1.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa.fca win32-quickq_1.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\JP2KLib.dll win32-quickq_1.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe win32-quickq_1.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_email.gif win32-quickq_1.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_US_POSIX.txt win32-quickq_1.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\PDFSigQFormalRep.pdf win32-quickq_1.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_super.gif win32-quickq_1.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOnNotificationInTray.gif win32-quickq_1.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can129.hsp win32-quickq_1.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa03.hsp win32-quickq_1.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1252.TXT win32-quickq_1.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeLinguistic.dll win32-quickq_1.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_sent.gif win32-quickq_1.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\CMap\Identity-V win32-quickq_1.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SecStoreFile.ico win32-quickq_1.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf win32-quickq_1.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1251.TXT win32-quickq_1.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\ccme_base.dll win32-quickq_1.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\bl.gif win32-quickq_1.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\end_review.gif win32-quickq_1.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\XDPFile_8.ico win32-quickq_1.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\SaslPrepProfile_norm_bidi.spp win32-quickq_1.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CENTEURO.TXT win32-quickq_1.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AXE8SharedExpat.dll win32-quickq_1.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\icucnv36.dll win32-quickq_1.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\ZY______.PFB win32-quickq_1.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can.hyp win32-quickq_1.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\adobepdf.xdc win32-quickq_1.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\pmd.cer win32-quickq_1.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\engphon.env win32-quickq_1.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1257.TXT win32-quickq_1.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\info.gif win32-quickq_1.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_browser.gif win32-quickq_1.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_issue.gif win32-quickq_1.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroSign.prc win32-quickq_1.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\create_form.gif win32-quickq_1.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\ended_review_or_form.gif win32-quickq_1.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_super.gif win32-quickq_1.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\symbol.txt win32-quickq_1.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ROMAN.TXT win32-quickq_1.exe File created C:\Program Files (x86)\win32-quickq.exe sg.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\cryptocme2.sig win32-quickq_1.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\distribute_form.gif win32-quickq_1.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\FDFFile_8.ico win32-quickq_1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
uyd.exesvcoth.exewin32-quickq_1.exespolsvt.exespolsvt.exewin32-quickq_1.exewin32-quickq_1.exewin32-quickq_1.exeQTalk.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uyd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svcoth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language win32-quickq_1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spolsvt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spolsvt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language win32-quickq_1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language win32-quickq_1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language win32-quickq_1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QTalk.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
spolsvt.exedescription ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 spolsvt.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz spolsvt.exe -
Suspicious behavior: EnumeratesProcesses 57 IoCs
Processes:
uyd.exewin32-quickq_1.exespolsvt.exepid Process 2160 uyd.exe 2032 win32-quickq_1.exe 1196 spolsvt.exe 1196 spolsvt.exe 1196 spolsvt.exe 1196 spolsvt.exe 1196 spolsvt.exe 1196 spolsvt.exe 1196 spolsvt.exe 1196 spolsvt.exe 1196 spolsvt.exe 1196 spolsvt.exe 1196 spolsvt.exe 1196 spolsvt.exe 1196 spolsvt.exe 1196 spolsvt.exe 1196 spolsvt.exe 1196 spolsvt.exe 1196 spolsvt.exe 1196 spolsvt.exe 1196 spolsvt.exe 1196 spolsvt.exe 1196 spolsvt.exe 1196 spolsvt.exe 1196 spolsvt.exe 1196 spolsvt.exe 1196 spolsvt.exe 1196 spolsvt.exe 1196 spolsvt.exe 1196 spolsvt.exe 1196 spolsvt.exe 1196 spolsvt.exe 1196 spolsvt.exe 1196 spolsvt.exe 1196 spolsvt.exe 1196 spolsvt.exe 1196 spolsvt.exe 1196 spolsvt.exe 1196 spolsvt.exe 1196 spolsvt.exe 1196 spolsvt.exe 1196 spolsvt.exe 1196 spolsvt.exe 1196 spolsvt.exe 1196 spolsvt.exe 1196 spolsvt.exe 1196 spolsvt.exe 1196 spolsvt.exe 1196 spolsvt.exe 1196 spolsvt.exe 1196 spolsvt.exe 1196 spolsvt.exe 1196 spolsvt.exe 1196 spolsvt.exe 1196 spolsvt.exe 1196 spolsvt.exe 1196 spolsvt.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
Processes:
win32-quickq_1.exewin32-quickq_1.exesg.tmpspolsvt.exewin32-quickq_1.exewin32-quickq_1.exedescription pid Process Token: SeBackupPrivilege 2032 win32-quickq_1.exe Token: SeRestorePrivilege 2032 win32-quickq_1.exe Token: 33 2032 win32-quickq_1.exe Token: SeIncBasePriorityPrivilege 2032 win32-quickq_1.exe Token: SeCreateGlobalPrivilege 2032 win32-quickq_1.exe Token: 33 2032 win32-quickq_1.exe Token: SeIncBasePriorityPrivilege 2032 win32-quickq_1.exe Token: 33 2032 win32-quickq_1.exe Token: SeIncBasePriorityPrivilege 2032 win32-quickq_1.exe Token: SeBackupPrivilege 2776 win32-quickq_1.exe Token: SeRestorePrivilege 2776 win32-quickq_1.exe Token: 33 2776 win32-quickq_1.exe Token: SeIncBasePriorityPrivilege 2776 win32-quickq_1.exe Token: 33 2032 win32-quickq_1.exe Token: SeIncBasePriorityPrivilege 2032 win32-quickq_1.exe Token: SeRestorePrivilege 2220 sg.tmp Token: 35 2220 sg.tmp Token: SeSecurityPrivilege 2220 sg.tmp Token: SeSecurityPrivilege 2220 sg.tmp Token: 33 2032 win32-quickq_1.exe Token: SeIncBasePriorityPrivilege 2032 win32-quickq_1.exe Token: SeDebugPrivilege 2032 win32-quickq_1.exe Token: SeDebugPrivilege 1196 spolsvt.exe Token: 33 2032 win32-quickq_1.exe Token: SeIncBasePriorityPrivilege 2032 win32-quickq_1.exe Token: 33 2032 win32-quickq_1.exe Token: SeIncBasePriorityPrivilege 2032 win32-quickq_1.exe Token: SeBackupPrivilege 1408 win32-quickq_1.exe Token: SeRestorePrivilege 1408 win32-quickq_1.exe Token: 33 1408 win32-quickq_1.exe Token: SeIncBasePriorityPrivilege 1408 win32-quickq_1.exe Token: SeBackupPrivilege 1048 win32-quickq_1.exe Token: SeRestorePrivilege 1048 win32-quickq_1.exe Token: 33 1048 win32-quickq_1.exe Token: SeIncBasePriorityPrivilege 1048 win32-quickq_1.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
uyd.exeQTalk.exespolsvt.exepid Process 2160 uyd.exe 2160 uyd.exe 1908 QTalk.exe 1908 QTalk.exe 2124 spolsvt.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
win32-quickq_1.exeuyd.exeQTalk.exespolsvt.exewin32-quickq_1.exewin32-quickq_1.exedescription pid Process procid_target PID 2032 wrote to memory of 1696 2032 win32-quickq_1.exe 30 PID 2032 wrote to memory of 1696 2032 win32-quickq_1.exe 30 PID 2032 wrote to memory of 1696 2032 win32-quickq_1.exe 30 PID 2032 wrote to memory of 1696 2032 win32-quickq_1.exe 30 PID 2032 wrote to memory of 2776 2032 win32-quickq_1.exe 32 PID 2032 wrote to memory of 2776 2032 win32-quickq_1.exe 32 PID 2032 wrote to memory of 2776 2032 win32-quickq_1.exe 32 PID 2032 wrote to memory of 2776 2032 win32-quickq_1.exe 32 PID 2032 wrote to memory of 2220 2032 win32-quickq_1.exe 33 PID 2032 wrote to memory of 2220 2032 win32-quickq_1.exe 33 PID 2032 wrote to memory of 2220 2032 win32-quickq_1.exe 33 PID 2032 wrote to memory of 2220 2032 win32-quickq_1.exe 33 PID 2032 wrote to memory of 2160 2032 win32-quickq_1.exe 35 PID 2032 wrote to memory of 2160 2032 win32-quickq_1.exe 35 PID 2032 wrote to memory of 2160 2032 win32-quickq_1.exe 35 PID 2032 wrote to memory of 2160 2032 win32-quickq_1.exe 35 PID 2160 wrote to memory of 1908 2160 uyd.exe 38 PID 2160 wrote to memory of 1908 2160 uyd.exe 38 PID 2160 wrote to memory of 1908 2160 uyd.exe 38 PID 2160 wrote to memory of 1908 2160 uyd.exe 38 PID 1908 wrote to memory of 2124 1908 QTalk.exe 39 PID 1908 wrote to memory of 2124 1908 QTalk.exe 39 PID 1908 wrote to memory of 2124 1908 QTalk.exe 39 PID 1908 wrote to memory of 2124 1908 QTalk.exe 39 PID 1908 wrote to memory of 2124 1908 QTalk.exe 39 PID 1908 wrote to memory of 2124 1908 QTalk.exe 39 PID 1908 wrote to memory of 2124 1908 QTalk.exe 39 PID 1908 wrote to memory of 2124 1908 QTalk.exe 39 PID 1908 wrote to memory of 2124 1908 QTalk.exe 39 PID 2124 wrote to memory of 1196 2124 spolsvt.exe 40 PID 2124 wrote to memory of 1196 2124 spolsvt.exe 40 PID 2124 wrote to memory of 1196 2124 spolsvt.exe 40 PID 2124 wrote to memory of 1196 2124 spolsvt.exe 40 PID 2124 wrote to memory of 1196 2124 spolsvt.exe 40 PID 2124 wrote to memory of 1196 2124 spolsvt.exe 40 PID 2124 wrote to memory of 1196 2124 spolsvt.exe 40 PID 2124 wrote to memory of 1196 2124 spolsvt.exe 40 PID 2124 wrote to memory of 1196 2124 spolsvt.exe 40 PID 2124 wrote to memory of 2864 2124 spolsvt.exe 41 PID 2124 wrote to memory of 2864 2124 spolsvt.exe 41 PID 2124 wrote to memory of 2864 2124 spolsvt.exe 41 PID 2124 wrote to memory of 2864 2124 spolsvt.exe 41 PID 2124 wrote to memory of 2864 2124 spolsvt.exe 41 PID 2124 wrote to memory of 2864 2124 spolsvt.exe 41 PID 2124 wrote to memory of 2864 2124 spolsvt.exe 41 PID 2124 wrote to memory of 2864 2124 spolsvt.exe 41 PID 2124 wrote to memory of 2864 2124 spolsvt.exe 41 PID 2124 wrote to memory of 2864 2124 spolsvt.exe 41 PID 2124 wrote to memory of 2864 2124 spolsvt.exe 41 PID 2032 wrote to memory of 1408 2032 win32-quickq_1.exe 42 PID 2032 wrote to memory of 1408 2032 win32-quickq_1.exe 42 PID 2032 wrote to memory of 1408 2032 win32-quickq_1.exe 42 PID 2032 wrote to memory of 1408 2032 win32-quickq_1.exe 42 PID 2032 wrote to memory of 1048 2032 win32-quickq_1.exe 43 PID 2032 wrote to memory of 1048 2032 win32-quickq_1.exe 43 PID 2032 wrote to memory of 1048 2032 win32-quickq_1.exe 43 PID 2032 wrote to memory of 1048 2032 win32-quickq_1.exe 43 PID 1408 wrote to memory of 328 1408 win32-quickq_1.exe 44 PID 1408 wrote to memory of 328 1408 win32-quickq_1.exe 44 PID 1408 wrote to memory of 328 1408 win32-quickq_1.exe 44 PID 1408 wrote to memory of 328 1408 win32-quickq_1.exe 44 PID 1048 wrote to memory of 1680 1048 win32-quickq_1.exe 45 PID 1048 wrote to memory of 1680 1048 win32-quickq_1.exe 45 PID 1048 wrote to memory of 1680 1048 win32-quickq_1.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\win32-quickq_1.exe"C:\Users\Admin\AppData\Local\Temp\win32-quickq_1.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Windows\system32\cmd.execmd.exe /c set2⤵PID:1696
-
-
C:\Users\Admin\AppData\Local\Temp\win32-quickq_1.exePECMD**pecmd-cmd* PUTF -dd -skipb=1627136 -len=101900229 "C:\Users\Admin\AppData\Local\Temp\~8455503808067910000.tmp",,C:\Users\Admin\AppData\Local\Temp\win32-quickq_1.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2776
-
-
C:\Users\Admin\AppData\Local\Temp\~4378553936779697675~\sg.tmp7zG_exe x "C:\Users\Admin\AppData\Local\Temp\~8455503808067910000.tmp" -y -aoa -o"C:\Program Files (x86)\"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2220
-
-
C:\Program Files (x86)\uyd.exe"C:\Program Files (x86)\\uyd.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Users\Public\Documents\sougou\V4.6.80\Bin\QTalk.exeC:\Users\Public\Documents\sougou\V4.6.80\Bin\QTalk.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Users\Public\Documents\sougou\spolsvt.exeC:\Users\Public\Documents\sougou\spolsvt.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Users\Public\Documents\dd\spolsvt.exeC:\Users\Public\Documents\dd\spolsvt.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1196
-
-
C:\Users\Public\Documents\uu\svcoth.exeC:\Users\Public\Documents\uu\svcoth.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2864
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\win32-quickq_1.exePECMD**pecmd-cmd* EXEC -wd:C: -hide cmd /c "C:\Users\Admin\AppData\Local\Temp\~5839619836062413879.cmd"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\~5839619836062413879.cmd"3⤵PID:328
-
-
-
C:\Users\Admin\AppData\Local\Temp\win32-quickq_1.exePECMD**pecmd-cmd* EXEC -wd:C: -hide cmd /c "C:\Users\Admin\AppData\Local\Temp\~8475897841850454490.cmd"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\~8475897841850454490.cmd"3⤵
- Deletes itself
PID:1680
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.5MB
MD552a442f3ec0cc6160b36b4c2cee0c96b
SHA1fcdcde577a1d08592f7c7fda24d53b877423e983
SHA256f1ef9b4b561851c3d8a7ecb9e32f65639233008c5799e1e889bdf5e6fac34446
SHA512e3718caaa784dcfdad5efec6dadef056923a96cad961f4a35766f067f4f648dbb8164e9c013b5854b5afb75d4630a0e0a6465c29c9564fcd80c970c26cd82e42
-
Filesize
280B
MD542ff656bd4ee3e19a5828940041fdfdb
SHA12e3c7f0fd42dd48b014e82e9e5edf50664ae5698
SHA256b326705c28abc9947182f84830e0e680d35551157b408a0f9cfd137279a02838
SHA5124ba36b5e44c94df09b91b3557237dae6b74a9fe04da686f157938446cf635c464f616126e937400ee4d577708b3bdcb7f88cec8df23d344bfd7105b75f9ec7b0
-
Filesize
371B
MD5add56cb152aa026cea55fbc27df898f8
SHA1d59e2c9fccc7bd67ae36169a85ab14ce94068461
SHA256631ee56fa2a73bc6d333580c237b3d18663ae269d26073bf1224266fa0b664b0
SHA5127f17831b0e19795cb60c66544a10ae7451bb1d7ffecb0ade1af352ccb360ff177af2be88c381d45f53b34912117fe8ddd64ce485f87f0e2e9f48f18ae939e5c8
-
Filesize
16KB
MD5cdce4713e784ae069d73723034a957ff
SHA19a393a6bab6568f1a774fb753353223f11367e09
SHA256b29e48102ecb3d3614e8980a8b8cc63dd2b993c6346f466479244ec2b47b69d8
SHA5120a3a59a305cc2a6fad4e1315b0bcc5a4129595dfe1e8b703363fa02528d2d7c48d3fd22d365708be84a5557cf1916873df9563c454732f93f94a66e7e3b9fb0f
-
Filesize
221KB
MD5e2b34ec017d44af92fcfeb6ec1442f5c
SHA11cc5e4c708417b9f148b98db95b9f0733ac60a3d
SHA256986438d1af76d1a47409b9a7e25e9f0516d89320ad1e03468b04530b46aad9ba
SHA5127d3e163ea3f3029498951385fa52f18a5e334ae263692e51d96cdd7e25624ddc9c21909f5c0eefaa2ff1845fc2d944c52ec95c619656fc1f60cdbf0c11888482
-
Filesize
715KB
MD57c4718943bd3f66ebdb47ccca72c7b1e
SHA1f9edfaa7adb8fa528b2e61b2b251f18da10a6969
SHA2564cc32d00338fc7b206a7c052297acf9ac304ae7de9d61a2475a116959c1524fc
SHA512e18c40d646fa4948f90f7471da55489df431f255041ebb6dcef86346f91078c9b27894e27216a4b2fe2a1c5e501c7953c77893cf696930123d28a322d49e1516
-
Filesize
9KB
MD5523d5c39f9d8d2375c3df68251fa2249
SHA1d4ed365c44bec9246fc1a65a32a7791792647a10
SHA25620e3dc90a3e83b6202e2a7f4603b60e5e859639cb68693426c400b13aaeabd78
SHA512526e1bba30d03f1ac177c6ab7409187a730969c429cebef15da68ffcf44b3b93227781eebc827b2f7a0fa17c391e00a0e532263fd0167aeaeb0456f96cfe3ae4