Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
10-09-2024 13:35
Static task
static1
Behavioral task
behavioral1
Sample
win32quickq.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
win32quickq.exe
Resource
win10v2004-20240802-en
General
-
Target
win32quickq.exe
-
Size
98.8MB
-
MD5
84c5c0f072140a6f345e4673ae3d9cfd
-
SHA1
cab780e0bc79ad5e30db288992d1e33ed285e012
-
SHA256
c2d4be685a8d7c43049d0ed965418d0e2cf52f348c5b562244e62a2cf173b9a5
-
SHA512
224f9576f25ea8f3b464a8bf138394e3f122f5d2204d7f9531907e3507defcb218e140393594ef4e1dd47791e13b12812a6a3aab9e5fdee3ba7fe10aeff344c4
-
SSDEEP
3145728:nHhrbcP7qpNIcQKhJyGogndBMSjaT5GPUofj:HTtvTyUdBpc/of
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload 1 IoCs
resource yara_rule behavioral2/memory/3412-63-0x0000000010000000-0x0000000010029000-memory.dmp fatalrat -
Executes dropped EXE 6 IoCs
pid Process 1796 sg.tmp 3936 uyd.exe 1488 QTalk.exe 3932 spolsvt.exe 3412 spolsvt.exe 1964 svcoth.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Çý¶¯ÈËÉú = "C:\\Users\\Public\\Documents\\sougou\\PTvrst.exe" uyd.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA uyd.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1488 set thread context of 3932 1488 QTalk.exe 99 PID 3932 set thread context of 3412 3932 spolsvt.exe 100 PID 3932 set thread context of 1964 3932 spolsvt.exe 101 -
Drops file in Program Files directory 5 IoCs
description ioc Process File created C:\Program Files (x86)\uyd.exe sg.tmp File opened for modification C:\Program Files (x86)\uyd.exe sg.tmp File created C:\Program Files (x86)\win32-quickq.exe sg.tmp File opened for modification C:\Program Files (x86)\win32-quickq.exe sg.tmp File opened for modification C:\Program Files (x86)\Internet Explorer\images win32quickq.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spolsvt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language win32quickq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uyd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QTalk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spolsvt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svcoth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language win32quickq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language win32quickq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language win32quickq.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3936 uyd.exe 3936 uyd.exe 1320 win32quickq.exe 1320 win32quickq.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: SeBackupPrivilege 1320 win32quickq.exe Token: SeRestorePrivilege 1320 win32quickq.exe Token: 33 1320 win32quickq.exe Token: SeIncBasePriorityPrivilege 1320 win32quickq.exe Token: SeCreateGlobalPrivilege 1320 win32quickq.exe Token: 33 1320 win32quickq.exe Token: SeIncBasePriorityPrivilege 1320 win32quickq.exe Token: 33 1320 win32quickq.exe Token: SeIncBasePriorityPrivilege 1320 win32quickq.exe Token: SeBackupPrivilege 4220 win32quickq.exe Token: SeRestorePrivilege 4220 win32quickq.exe Token: 33 4220 win32quickq.exe Token: SeIncBasePriorityPrivilege 4220 win32quickq.exe Token: 33 1320 win32quickq.exe Token: SeIncBasePriorityPrivilege 1320 win32quickq.exe Token: SeRestorePrivilege 1796 sg.tmp Token: 35 1796 sg.tmp Token: SeSecurityPrivilege 1796 sg.tmp Token: SeSecurityPrivilege 1796 sg.tmp Token: 33 1320 win32quickq.exe Token: SeIncBasePriorityPrivilege 1320 win32quickq.exe Token: SeDebugPrivilege 1320 win32quickq.exe Token: SeDebugPrivilege 3412 spolsvt.exe Token: 33 1320 win32quickq.exe Token: SeIncBasePriorityPrivilege 1320 win32quickq.exe Token: 33 1320 win32quickq.exe Token: SeIncBasePriorityPrivilege 1320 win32quickq.exe Token: SeBackupPrivilege 3120 win32quickq.exe Token: SeRestorePrivilege 3120 win32quickq.exe Token: SeBackupPrivilege 1492 win32quickq.exe Token: 33 3120 win32quickq.exe Token: SeIncBasePriorityPrivilege 3120 win32quickq.exe Token: SeRestorePrivilege 1492 win32quickq.exe Token: 33 1492 win32quickq.exe Token: SeIncBasePriorityPrivilege 1492 win32quickq.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 3936 uyd.exe 3936 uyd.exe 1488 QTalk.exe 1488 QTalk.exe 3932 spolsvt.exe -
Suspicious use of WriteProcessMemory 50 IoCs
description pid Process procid_target PID 1320 wrote to memory of 4592 1320 win32quickq.exe 86 PID 1320 wrote to memory of 4592 1320 win32quickq.exe 86 PID 1320 wrote to memory of 4220 1320 win32quickq.exe 88 PID 1320 wrote to memory of 4220 1320 win32quickq.exe 88 PID 1320 wrote to memory of 4220 1320 win32quickq.exe 88 PID 1320 wrote to memory of 1796 1320 win32quickq.exe 89 PID 1320 wrote to memory of 1796 1320 win32quickq.exe 89 PID 1320 wrote to memory of 1796 1320 win32quickq.exe 89 PID 1320 wrote to memory of 3936 1320 win32quickq.exe 93 PID 1320 wrote to memory of 3936 1320 win32quickq.exe 93 PID 1320 wrote to memory of 3936 1320 win32quickq.exe 93 PID 3936 wrote to memory of 1488 3936 uyd.exe 98 PID 3936 wrote to memory of 1488 3936 uyd.exe 98 PID 3936 wrote to memory of 1488 3936 uyd.exe 98 PID 1488 wrote to memory of 3932 1488 QTalk.exe 99 PID 1488 wrote to memory of 3932 1488 QTalk.exe 99 PID 1488 wrote to memory of 3932 1488 QTalk.exe 99 PID 1488 wrote to memory of 3932 1488 QTalk.exe 99 PID 1488 wrote to memory of 3932 1488 QTalk.exe 99 PID 1488 wrote to memory of 3932 1488 QTalk.exe 99 PID 1488 wrote to memory of 3932 1488 QTalk.exe 99 PID 1488 wrote to memory of 3932 1488 QTalk.exe 99 PID 3932 wrote to memory of 3412 3932 spolsvt.exe 100 PID 3932 wrote to memory of 3412 3932 spolsvt.exe 100 PID 3932 wrote to memory of 3412 3932 spolsvt.exe 100 PID 3932 wrote to memory of 3412 3932 spolsvt.exe 100 PID 3932 wrote to memory of 3412 3932 spolsvt.exe 100 PID 3932 wrote to memory of 3412 3932 spolsvt.exe 100 PID 3932 wrote to memory of 3412 3932 spolsvt.exe 100 PID 3932 wrote to memory of 3412 3932 spolsvt.exe 100 PID 3932 wrote to memory of 1964 3932 spolsvt.exe 101 PID 3932 wrote to memory of 1964 3932 spolsvt.exe 101 PID 3932 wrote to memory of 1964 3932 spolsvt.exe 101 PID 3932 wrote to memory of 1964 3932 spolsvt.exe 101 PID 3932 wrote to memory of 1964 3932 spolsvt.exe 101 PID 3932 wrote to memory of 1964 3932 spolsvt.exe 101 PID 3932 wrote to memory of 1964 3932 spolsvt.exe 101 PID 3932 wrote to memory of 1964 3932 spolsvt.exe 101 PID 3932 wrote to memory of 1964 3932 spolsvt.exe 101 PID 3932 wrote to memory of 1964 3932 spolsvt.exe 101 PID 1320 wrote to memory of 3120 1320 win32quickq.exe 106 PID 1320 wrote to memory of 3120 1320 win32quickq.exe 106 PID 1320 wrote to memory of 3120 1320 win32quickq.exe 106 PID 1320 wrote to memory of 1492 1320 win32quickq.exe 107 PID 1320 wrote to memory of 1492 1320 win32quickq.exe 107 PID 1320 wrote to memory of 1492 1320 win32quickq.exe 107 PID 3120 wrote to memory of 4280 3120 win32quickq.exe 108 PID 3120 wrote to memory of 4280 3120 win32quickq.exe 108 PID 1492 wrote to memory of 4696 1492 win32quickq.exe 110 PID 1492 wrote to memory of 4696 1492 win32quickq.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\win32quickq.exe"C:\Users\Admin\AppData\Local\Temp\win32quickq.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Windows\SYSTEM32\cmd.execmd.exe /c set2⤵PID:4592
-
-
C:\Users\Admin\AppData\Local\Temp\win32quickq.exePECMD**pecmd-cmd* PUTF -dd -skipb=1627136 -len=101934409 "C:\Users\Admin\AppData\Local\Temp\~3405029343176400120.tmp",,C:\Users\Admin\AppData\Local\Temp\win32quickq.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4220
-
-
C:\Users\Admin\AppData\Local\Temp\~3955091938021514997~\sg.tmp7zG_exe x "C:\Users\Admin\AppData\Local\Temp\~3405029343176400120.tmp" -y -aoa -o"C:\Program Files (x86)\"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:1796
-
-
C:\Program Files (x86)\uyd.exe"C:\Program Files (x86)\\uyd.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\Users\Public\Documents\sougou\V4.6.80\Bin\QTalk.exeC:\Users\Public\Documents\sougou\V4.6.80\Bin\QTalk.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Users\Public\Documents\sougou\spolsvt.exeC:\Users\Public\Documents\sougou\spolsvt.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Users\Public\Documents\dd\spolsvt.exeC:\Users\Public\Documents\dd\spolsvt.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3412
-
-
C:\Users\Public\Documents\uu\svcoth.exeC:\Users\Public\Documents\uu\svcoth.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1964
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\win32quickq.exePECMD**pecmd-cmd* EXEC -wd:C: -hide cmd /c "C:\Users\Admin\AppData\Local\Temp\~1949520462713580339.cmd"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Windows\SYSTEM32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\~1949520462713580339.cmd"3⤵PID:4280
-
-
-
C:\Users\Admin\AppData\Local\Temp\win32quickq.exePECMD**pecmd-cmd* EXEC -wd:C: -hide cmd /c "C:\Users\Admin\AppData\Local\Temp\~7284484766979817280.cmd"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Windows\SYSTEM32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\~7284484766979817280.cmd"3⤵PID:4696
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.6MB
MD52295488c4b91a2e19e098945b5d52bf7
SHA12b2c51cf640e158b9a811bb520e1d5f0844ea021
SHA25641bd610f99dfe3d52e864906ea891f2df5f4072726591697bfc678bfa26ecd69
SHA512b47bab5f79d64eaaa6dea25cc6d69dc1aca6fd8ca39dc7813660eb20df2d592fdbf28b8671e01a0f0cbc388ed638aae397bbe056a926cc1dda8d0ff8611e02a4
-
Filesize
280B
MD542ff656bd4ee3e19a5828940041fdfdb
SHA12e3c7f0fd42dd48b014e82e9e5edf50664ae5698
SHA256b326705c28abc9947182f84830e0e680d35551157b408a0f9cfd137279a02838
SHA5124ba36b5e44c94df09b91b3557237dae6b74a9fe04da686f157938446cf635c464f616126e937400ee4d577708b3bdcb7f88cec8df23d344bfd7105b75f9ec7b0
-
Filesize
715KB
MD57c4718943bd3f66ebdb47ccca72c7b1e
SHA1f9edfaa7adb8fa528b2e61b2b251f18da10a6969
SHA2564cc32d00338fc7b206a7c052297acf9ac304ae7de9d61a2475a116959c1524fc
SHA512e18c40d646fa4948f90f7471da55489df431f255041ebb6dcef86346f91078c9b27894e27216a4b2fe2a1c5e501c7953c77893cf696930123d28a322d49e1516
-
Filesize
362B
MD513bb142679ce7ca3ce1d4dc687af143b
SHA19262caa373410a9fa18c77687e8744f32dc2f168
SHA256fef360b47ad4a4281858d4bed55e3af2af656adacd9c490d9d4183dd5771f05d
SHA5123fc152a58776df83560bf4a7f3eff1f5cef981225077dc0ba1d409202b92e6b54fb72c7d3c6bc602bc83364d262d72a89b246070004bd13d860a4f8db93b82dc
-
Filesize
16KB
MD5cdce4713e784ae069d73723034a957ff
SHA19a393a6bab6568f1a774fb753353223f11367e09
SHA256b29e48102ecb3d3614e8980a8b8cc63dd2b993c6346f466479244ec2b47b69d8
SHA5120a3a59a305cc2a6fad4e1315b0bcc5a4129595dfe1e8b703363fa02528d2d7c48d3fd22d365708be84a5557cf1916873df9563c454732f93f94a66e7e3b9fb0f
-
Filesize
219KB
MD56fa8f3c5e7670094a1f66035bdce541c
SHA1122fcba8f761eb3695a948b68be2cb803a43d903
SHA256f2a8b444d6cc5d3a88d10e5d2388e91a17248a1191d8780c62761bae10574c45
SHA5129e6d3b2d764e2ad716c9246c574af62eec2a6e76f1b95db7c8ac684372e6660a43d8dd2bbcabffe66013ea99612114dea28a62caaef530add20725a230672e67
-
Filesize
9KB
MD5523d5c39f9d8d2375c3df68251fa2249
SHA1d4ed365c44bec9246fc1a65a32a7791792647a10
SHA25620e3dc90a3e83b6202e2a7f4603b60e5e859639cb68693426c400b13aaeabd78
SHA512526e1bba30d03f1ac177c6ab7409187a730969c429cebef15da68ffcf44b3b93227781eebc827b2f7a0fa17c391e00a0e532263fd0167aeaeb0456f96cfe3ae4