Analysis
-
max time kernel
122s -
max time network
160s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-09-2024 09:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
win32-quickq.exe
Resource
win7-20240903-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
win32-quickq.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
win32-quickq.exe
-
Size
97.6MB
-
MD5
c9af3d48d25d3df466fe41c40bf1f1c3
-
SHA1
515d1d06163d8a9466ae9e2c5bfc621b08e00cc4
-
SHA256
7017d08b045c35306e20675850eb40dcef6c3d5a4b2cbefe30eddb613ba9580e
-
SHA512
afeba24477cd741622485f67b3c810e23feae3ad3eae0d3f2a9853ef7fc0f65dd94a2febda09265751fc6949503065181b727aeb01bc344980d82d876d43958d
-
SSDEEP
3145728:NavhTKlk5M0b76BS3W35ddwwbo1174rlM+t6j:N0XXs6WH2wKaO+tW
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2616-72-0x0000000010000000-0x0000000010029000-memory.dmp fatalrat -
Deletes itself 1 IoCs
Processes:
cmd.exepid Process 1060 cmd.exe -
Executes dropped EXE 5 IoCs
Processes:
uyd.exeQTalk.exespolsvt.exespolsvt.exesvcoth.exepid Process 2324 uyd.exe 3012 QTalk.exe 2992 spolsvt.exe 2616 spolsvt.exe 1460 svcoth.exe -
Loads dropped DLL 8 IoCs
Processes:
win32-quickq.exeuyd.exeQTalk.exespolsvt.exepid Process 2060 win32-quickq.exe 2324 uyd.exe 3012 QTalk.exe 3012 QTalk.exe 2992 spolsvt.exe 2992 spolsvt.exe 2992 spolsvt.exe 2992 spolsvt.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
uyd.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Çý¶¯ÈËÉú = "C:\\Users\\Public\\Documents\\sougou\\PTvrst.exe" uyd.exe -
Processes:
uyd.exedescription ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA uyd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
QTalk.exespolsvt.exedescription pid Process procid_target PID 3012 set thread context of 2992 3012 QTalk.exe 34 PID 2992 set thread context of 2616 2992 spolsvt.exe 35 PID 2992 set thread context of 1460 2992 spolsvt.exe 36 -
Drops file in Program Files directory 64 IoCs
Processes:
win32-quickq.exedescription ioc Process File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_super.gif win32-quickq.exe File opened for modification C:\Program Files (x86)\win32-quickq.exe win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Spelling.api win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Updater.api win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\ADMPlugin.apl win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\distribute_form.gif win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\atl.dll win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AGMGPUOptIn.ini win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\drvDX9.x3d win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\br.gif win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\license.html win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\MakeAccessible.api win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\weblink.api win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\vdk150.dll win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\QRCode.pmp win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\Real.mpp win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\PPKLite.api win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\drvSOFT.x3d win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prcr.x3d win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\tesselate.x3d win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRdIF.dll win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\README.TXT win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Search5.api win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\drvDX8.x3d win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\VDK10.LIC win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOnNotificationInAcrobat.gif win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\cryptocme2.dll win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\PDFSigQFormalRep.pdf win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\Words.pdf win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\VDK10.CMP win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\VDK10.SYX win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\open_original_form.gif win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_browser.gif win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroTextExtractor.exe win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\pe.dll win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\adobepdf.xdc win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\Flash.mpp win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\VDK10.RSD win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_shared.gif win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOffNotificationInAcrobat.gif win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\ended_review_or_form.gif win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\ViewerPS.dll win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_distributed.gif win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\BIB.dll win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\PDFPrevHndlr.dll win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\MyriadCAD.otf win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Esl win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Accessibility.api win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\bl.gif win32-quickq.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\main.css win32-quickq.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
svcoth.execmd.exewin32-quickq.exeuyd.exeQTalk.exespolsvt.exespolsvt.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svcoth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language win32-quickq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uyd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QTalk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spolsvt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spolsvt.exe -
Suspicious behavior: EnumeratesProcesses 56 IoCs
Processes:
uyd.exespolsvt.exepid Process 2324 uyd.exe 2616 spolsvt.exe 2616 spolsvt.exe 2616 spolsvt.exe 2616 spolsvt.exe 2616 spolsvt.exe 2616 spolsvt.exe 2616 spolsvt.exe 2616 spolsvt.exe 2616 spolsvt.exe 2616 spolsvt.exe 2616 spolsvt.exe 2616 spolsvt.exe 2616 spolsvt.exe 2616 spolsvt.exe 2616 spolsvt.exe 2616 spolsvt.exe 2616 spolsvt.exe 2616 spolsvt.exe 2616 spolsvt.exe 2616 spolsvt.exe 2616 spolsvt.exe 2616 spolsvt.exe 2616 spolsvt.exe 2616 spolsvt.exe 2616 spolsvt.exe 2616 spolsvt.exe 2616 spolsvt.exe 2616 spolsvt.exe 2616 spolsvt.exe 2616 spolsvt.exe 2616 spolsvt.exe 2616 spolsvt.exe 2616 spolsvt.exe 2616 spolsvt.exe 2616 spolsvt.exe 2616 spolsvt.exe 2616 spolsvt.exe 2616 spolsvt.exe 2616 spolsvt.exe 2616 spolsvt.exe 2616 spolsvt.exe 2616 spolsvt.exe 2616 spolsvt.exe 2616 spolsvt.exe 2616 spolsvt.exe 2616 spolsvt.exe 2616 spolsvt.exe 2616 spolsvt.exe 2616 spolsvt.exe 2616 spolsvt.exe 2616 spolsvt.exe 2616 spolsvt.exe 2616 spolsvt.exe 2616 spolsvt.exe 2616 spolsvt.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
spolsvt.exedescription pid Process Token: SeDebugPrivilege 2616 spolsvt.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
uyd.exeQTalk.exespolsvt.exepid Process 2324 uyd.exe 2324 uyd.exe 3012 QTalk.exe 3012 QTalk.exe 2992 spolsvt.exe -
Suspicious use of WriteProcessMemory 41 IoCs
Processes:
win32-quickq.exeuyd.exeQTalk.exespolsvt.exedescription pid Process procid_target PID 2060 wrote to memory of 2324 2060 win32-quickq.exe 31 PID 2060 wrote to memory of 2324 2060 win32-quickq.exe 31 PID 2060 wrote to memory of 2324 2060 win32-quickq.exe 31 PID 2060 wrote to memory of 2324 2060 win32-quickq.exe 31 PID 2324 wrote to memory of 3012 2324 uyd.exe 33 PID 2324 wrote to memory of 3012 2324 uyd.exe 33 PID 2324 wrote to memory of 3012 2324 uyd.exe 33 PID 2324 wrote to memory of 3012 2324 uyd.exe 33 PID 3012 wrote to memory of 2992 3012 QTalk.exe 34 PID 3012 wrote to memory of 2992 3012 QTalk.exe 34 PID 3012 wrote to memory of 2992 3012 QTalk.exe 34 PID 3012 wrote to memory of 2992 3012 QTalk.exe 34 PID 3012 wrote to memory of 2992 3012 QTalk.exe 34 PID 3012 wrote to memory of 2992 3012 QTalk.exe 34 PID 3012 wrote to memory of 2992 3012 QTalk.exe 34 PID 3012 wrote to memory of 2992 3012 QTalk.exe 34 PID 3012 wrote to memory of 2992 3012 QTalk.exe 34 PID 2992 wrote to memory of 2616 2992 spolsvt.exe 35 PID 2992 wrote to memory of 2616 2992 spolsvt.exe 35 PID 2992 wrote to memory of 2616 2992 spolsvt.exe 35 PID 2992 wrote to memory of 2616 2992 spolsvt.exe 35 PID 2992 wrote to memory of 2616 2992 spolsvt.exe 35 PID 2992 wrote to memory of 2616 2992 spolsvt.exe 35 PID 2992 wrote to memory of 2616 2992 spolsvt.exe 35 PID 2992 wrote to memory of 2616 2992 spolsvt.exe 35 PID 2992 wrote to memory of 2616 2992 spolsvt.exe 35 PID 2992 wrote to memory of 1460 2992 spolsvt.exe 36 PID 2992 wrote to memory of 1460 2992 spolsvt.exe 36 PID 2992 wrote to memory of 1460 2992 spolsvt.exe 36 PID 2992 wrote to memory of 1460 2992 spolsvt.exe 36 PID 2992 wrote to memory of 1460 2992 spolsvt.exe 36 PID 2992 wrote to memory of 1460 2992 spolsvt.exe 36 PID 2992 wrote to memory of 1460 2992 spolsvt.exe 36 PID 2992 wrote to memory of 1460 2992 spolsvt.exe 36 PID 2992 wrote to memory of 1460 2992 spolsvt.exe 36 PID 2992 wrote to memory of 1460 2992 spolsvt.exe 36 PID 2992 wrote to memory of 1460 2992 spolsvt.exe 36 PID 2060 wrote to memory of 1060 2060 win32-quickq.exe 37 PID 2060 wrote to memory of 1060 2060 win32-quickq.exe 37 PID 2060 wrote to memory of 1060 2060 win32-quickq.exe 37 PID 2060 wrote to memory of 1060 2060 win32-quickq.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\win32-quickq.exe"C:\Users\Admin\AppData\Local\Temp\win32-quickq.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Program Files (x86)\uyd.exe"C:\Program Files (x86)\uyd.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Public\Documents\sougou\V4.6.80\Bin\QTalk.exeC:\Users\Public\Documents\sougou\V4.6.80\Bin\QTalk.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Users\Public\Documents\sougou\spolsvt.exeC:\Users\Public\Documents\sougou\spolsvt.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Users\Public\Documents\dd\spolsvt.exeC:\Users\Public\Documents\dd\spolsvt.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2616
-
-
C:\Users\Public\Documents\uu\svcoth.exeC:\Users\Public\Documents\uu\svcoth.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1460
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:1060
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
196B
MD5f3848248f41ea288d04f0eb34161dd8a
SHA19ac3ba9def2cd910eca8ad2176f00483f1e0db7a
SHA2563ee009efc8a91e7feac1e8f225ca33df5ff3856169157f507b18c36345cb9ce5
SHA512bb9722a9ba9a6ecae5fee4ff8f04bb7244681d3cfa53827c97a6d4e069eb50c1cce984be3fc76f1c502a711938d889ee505ca96ba77e5c925c1c075cec8fc005
-
Filesize
219KB
MD56fa8f3c5e7670094a1f66035bdce541c
SHA1122fcba8f761eb3695a948b68be2cb803a43d903
SHA256f2a8b444d6cc5d3a88d10e5d2388e91a17248a1191d8780c62761bae10574c45
SHA5129e6d3b2d764e2ad716c9246c574af62eec2a6e76f1b95db7c8ac684372e6660a43d8dd2bbcabffe66013ea99612114dea28a62caaef530add20725a230672e67
-
Filesize
5.5MB
MD5636c9df6f6d098fd985734103b323d59
SHA1e2f1ff45dc82885a6e366817dddcde03082b81b8
SHA256a314a2121a2ec4c6c708fc856fd86772aa83695b92512fd7e441d6a7b73ad594
SHA51244ce637a8f4abb17bf982d2f6644a36e810e19ae056ef6d0c84324ce0e6ec99e96fd007ddfed61784e8e1b76b084a1936a747b0459ec772f65eabc24c33fef67
-
Filesize
16KB
MD5cdce4713e784ae069d73723034a957ff
SHA19a393a6bab6568f1a774fb753353223f11367e09
SHA256b29e48102ecb3d3614e8980a8b8cc63dd2b993c6346f466479244ec2b47b69d8
SHA5120a3a59a305cc2a6fad4e1315b0bcc5a4129595dfe1e8b703363fa02528d2d7c48d3fd22d365708be84a5557cf1916873df9563c454732f93f94a66e7e3b9fb0f
-
Filesize
9KB
MD5523d5c39f9d8d2375c3df68251fa2249
SHA1d4ed365c44bec9246fc1a65a32a7791792647a10
SHA25620e3dc90a3e83b6202e2a7f4603b60e5e859639cb68693426c400b13aaeabd78
SHA512526e1bba30d03f1ac177c6ab7409187a730969c429cebef15da68ffcf44b3b93227781eebc827b2f7a0fa17c391e00a0e532263fd0167aeaeb0456f96cfe3ae4