4f45fa1686e9ded78d6b3f2ea6d7f21a92f09be8af2f0f4bebff992ee4e4d74b

General

Target

win32quickq.exe
Size

98.7MB
MD5

274b5005729ff3ca3a84bdde29ed25df
SHA1

10ced7c4d0e30cc4c778c2b6f699d0da15634785
SHA256

4f45fa1686e9ded78d6b3f2ea6d7f21a92f09be8af2f0f4bebff992ee4e4d74b
SHA512

7ea1c9e10cdc609590db8301feb78bea0225be0412a4d31c9d286d152a8b6b1ae4e11068838a23621e744e7e4c16999a9b144c549f5878ecb71ef0aa74383f69
SSDEEP

3145728:nHFnG0mmO2y9E/IVswt2FKgFeCmn8b7OEzw:HL60as5YgtFmEz

Score

7^/10

discovery evasion persistence trojan

Malware Config

Signatures

Executes dropped EXE 3 IoCs

Processes:

sg.tmpuyd.exeQTalk.exe

pid process

3640 sg.tmp
1992 uyd.exe
644 QTalk.exe

pid	process
3640	sg.tmp
1992	uyd.exe
644	QTalk.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

uyd.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Çý¶¯ÈËÉú = "C:\\Users\\Public\\Documents\\sougou\\PTvrst.exe"	uyd.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

uyd.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA uyd.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	uyd.exe

Drops file in Program Files directory 4 IoCs

Processes:

sg.tmp

description	ioc	process
File created	C:\Program Files (x86)\uyd.exe	sg.tmp
File opened for modification	C:\Program Files (x86)\uyd.exe	sg.tmp
File created	C:\Program Files (x86)\win32-quickq.exe	sg.tmp
File opened for modification	C:\Program Files (x86)\win32-quickq.exe	sg.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

win32quickq.exewin32quickq.exeuyd.exeQTalk.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	win32quickq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	win32quickq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uyd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QTalk.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

uyd.exewin32quickq.exe

pid process

1992 uyd.exe
1992 uyd.exe
1652 win32quickq.exe
1652 win32quickq.exe

pid	process
1992	uyd.exe
1992	uyd.exe
1652	win32quickq.exe
1652	win32quickq.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

Processes:

win32quickq.exewin32quickq.exesg.tmp

description	pid	process
Token: SeBackupPrivilege	1652	win32quickq.exe
Token: SeRestorePrivilege	1652	win32quickq.exe
Token: 33	1652	win32quickq.exe
Token: SeIncBasePriorityPrivilege	1652	win32quickq.exe
Token: SeCreateGlobalPrivilege	1652	win32quickq.exe
Token: 33	1652	win32quickq.exe
Token: SeIncBasePriorityPrivilege	1652	win32quickq.exe
Token: 33	1652	win32quickq.exe
Token: SeIncBasePriorityPrivilege	1652	win32quickq.exe
Token: SeBackupPrivilege	1144	win32quickq.exe
Token: SeRestorePrivilege	1144	win32quickq.exe
Token: 33	1144	win32quickq.exe
Token: SeIncBasePriorityPrivilege	1144	win32quickq.exe
Token: 33	1652	win32quickq.exe
Token: SeIncBasePriorityPrivilege	1652	win32quickq.exe
Token: SeRestorePrivilege	3640	sg.tmp
Token: 35	3640	sg.tmp
Token: SeSecurityPrivilege	3640	sg.tmp
Token: SeSecurityPrivilege	3640	sg.tmp
Token: 33	1652	win32quickq.exe
Token: SeIncBasePriorityPrivilege	1652	win32quickq.exe
Token: SeDebugPrivilege	1652	win32quickq.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

uyd.exeQTalk.exe

pid process

1992 uyd.exe
1992 uyd.exe
644 QTalk.exe
644 QTalk.exe

pid	process
1992	uyd.exe
1992	uyd.exe
644	QTalk.exe
644	QTalk.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

win32quickq.exeuyd.exe

description	pid	process	target process
PID 1652 wrote to memory of 3560	1652	win32quickq.exe	cmd.exe
PID 1652 wrote to memory of 3560	1652	win32quickq.exe	cmd.exe
PID 1652 wrote to memory of 1144	1652	win32quickq.exe	win32quickq.exe
PID 1652 wrote to memory of 1144	1652	win32quickq.exe	win32quickq.exe
PID 1652 wrote to memory of 1144	1652	win32quickq.exe	win32quickq.exe
PID 1652 wrote to memory of 3640	1652	win32quickq.exe	sg.tmp
PID 1652 wrote to memory of 3640	1652	win32quickq.exe	sg.tmp
PID 1652 wrote to memory of 3640	1652	win32quickq.exe	sg.tmp
PID 1652 wrote to memory of 1992	1652	win32quickq.exe	uyd.exe
PID 1652 wrote to memory of 1992	1652	win32quickq.exe	uyd.exe
PID 1652 wrote to memory of 1992	1652	win32quickq.exe	uyd.exe
PID 1992 wrote to memory of 644	1992	uyd.exe	QTalk.exe
PID 1992 wrote to memory of 644	1992	uyd.exe	QTalk.exe
PID 1992 wrote to memory of 644	1992	uyd.exe	QTalk.exe

C:\Users\Admin\AppData\Local\Temp\win32quickq.exe
"C:\Users\Admin\AppData\Local\Temp\win32quickq.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c set
  2⤵
  PID:3560
- C:\Users\Admin\AppData\Local\Temp\win32quickq.exe
  PECMD**pecmd-cmd* PUTF -dd -skipb=1627136 -len=101907377 "C:\Users\Admin\AppData\Local\Temp\~6906920909321723019.tmp",,C:\Users\Admin\AppData\Local\Temp\win32quickq.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1144
- C:\Users\Admin\AppData\Local\Temp\~3103004592952983181~\sg.tmp
  7zG_exe x "C:\Users\Admin\AppData\Local\Temp\~6906920909321723019.tmp" -y -aoa -o"C:\Program Files (x86)\"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of AdjustPrivilegeToken
  PID:3640
- C:\Program Files (x86)\uyd.exe
  "C:\Program Files (x86)\\uyd.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1992
- - C:\Users\Public\Documents\sougou\V4.6.80\Bin\QTalk.exe
    C:\Users\Public\Documents\sougou\V4.6.80\Bin\QTalk.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\uyd.exe

Filesize
5.5MB

MD5
d93c1d23a9fc68d89b3e3fcd43f0eb5b

SHA1
bc3220fb83d7dd0cddc538f7a33210db69786d20

SHA256
34951139a5201dd1d13d11c5aec344a25dedc79bc0fce0e7e59fdb46af10ca37

SHA512
730567800469641b24bca28af77a82462b0a7f3b16ea318fb945be106250b20db4fb3fb19b098a1cefed6d4b222989195eac606b028f4652332025b1554d7ab1

Download Submit
C:\Users\Admin\AppData\Local\Temp\~3103004592952983181~\sg.tmp

Filesize
715KB

MD5
7c4718943bd3f66ebdb47ccca72c7b1e

SHA1
f9edfaa7adb8fa528b2e61b2b251f18da10a6969

SHA256
4cc32d00338fc7b206a7c052297acf9ac304ae7de9d61a2475a116959c1524fc

SHA512
e18c40d646fa4948f90f7471da55489df431f255041ebb6dcef86346f91078c9b27894e27216a4b2fe2a1c5e501c7953c77893cf696930123d28a322d49e1516

Download Submit
C:\Users\Public\Documents\sougou\Mpec.mbt

Filesize
200KB

MD5
30dee94eb0bfe8583973deea47ab6fca

SHA1
5e2e9a31ae6a79549702d054ae5e3679bc1ff26c

SHA256
74f68093a3809acf0d39e34e4399bf508a335f09aca4d4e076de8ec79fdb1952

SHA512
414589f5d0afa3dfe781e60faf9bd1dd230a535ca5e97fa39c8f8a4659f74bb31e175ee0f6441577c29035b322271b944262cfb901219d9f86c29e380dcf6273

Download Submit
memory/644-43-0x0000000000400000-0x00000000009BE000-memory.dmp

Filesize
5.7MB

Download
memory/1992-26-0x0000000000400000-0x00000000009BE000-memory.dmp

Filesize
5.7MB

Download
memory/1992-36-0x0000000000400000-0x00000000009BE000-memory.dmp

Filesize
5.7MB

Download
memory/1992-44-0x0000000000400000-0x00000000009BE000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads