Analysis
-
max time kernel
92s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
15-11-2024 04:41
Behavioral task
behavioral1
Sample
5e23d6302299ec9322e61d05bc8ec3860b415509e97cb0160f3afed05094279a.exe
Resource
win7-20240903-en
windows7-x64
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
5e23d6302299ec9322e61d05bc8ec3860b415509e97cb0160f3afed05094279a.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
17 signatures
150 seconds
General
-
Target
5e23d6302299ec9322e61d05bc8ec3860b415509e97cb0160f3afed05094279a.exe
-
Size
102.8MB
-
MD5
e6892d590425742a2b10f89409b39e64
-
SHA1
683d3dd2b47ef4dddc65662779e31abde519c965
-
SHA256
5e23d6302299ec9322e61d05bc8ec3860b415509e97cb0160f3afed05094279a
-
SHA512
ce4371c6213db1281e7ebb4a46c14cd901069ec0221e9a7411a84a8bac27787190bf949db15f357a10373dbf4224e77ff20ffa0bc0f712726e454be90652163b
-
SSDEEP
1572864:zWCctvS7T3H6WCpsrxXGmjJoGe/ywdUa4nIvHiRG5E7w8LUxFBIMVNLnfUdAie:3cgjaoImF7w9iIvZ5uUxTIy9nIAie
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatalrat family
-
Fatal Rat payload 1 IoCs
resource yara_rule behavioral2/memory/1616-46-0x0000000010000000-0x000000001002A000-memory.dmp fatalrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation 5e23d6302299ec9322e61d05bc8ec3860b415509e97cb0160f3afed05094279a.exe -
Executes dropped EXE 5 IoCs
pid Process 4784 u1.exe 1704 QTalk.exe 1644 spolsvt.exe 1616 spolsvt.exe 2660 svcoth.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Çý¶¯ÈËÉú = "C:\\Users\\Public\\Documents\\sougou\\PTvrst.exe" u1.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA u1.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1704 set thread context of 1644 1704 QTalk.exe 88 PID 1644 set thread context of 1616 1644 spolsvt.exe 91 PID 1644 set thread context of 2660 1644 spolsvt.exe 97 -
resource yara_rule behavioral2/memory/3500-0-0x0000000000400000-0x000000000046D000-memory.dmp upx behavioral2/memory/3500-70-0x0000000000400000-0x000000000046D000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\open_original_form.gif 5e23d6302299ec9322e61d05bc8ec3860b415509e97cb0160f3afed05094279a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_selectlist_checkmark_18.svg 5e23d6302299ec9322e61d05bc8ec3860b415509e97cb0160f3afed05094279a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ar-ae 5e23d6302299ec9322e61d05bc8ec3860b415509e97cb0160f3afed05094279a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png 5e23d6302299ec9322e61d05bc8ec3860b415509e97cb0160f3afed05094279a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\fr-ma\ui-strings.js 5e23d6302299ec9322e61d05bc8ec3860b415509e97cb0160f3afed05094279a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark 5e23d6302299ec9322e61d05bc8ec3860b415509e97cb0160f3afed05094279a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\images\themes 5e23d6302299ec9322e61d05bc8ec3860b415509e97cb0160f3afed05094279a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\hu-hu 5e23d6302299ec9322e61d05bc8ec3860b415509e97cb0160f3afed05094279a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\zh-cn\ui-strings.js 5e23d6302299ec9322e61d05bc8ec3860b415509e97cb0160f3afed05094279a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\es-es\ui-strings.js 5e23d6302299ec9322e61d05bc8ec3860b415509e97cb0160f3afed05094279a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\uk-ua 5e23d6302299ec9322e61d05bc8ec3860b415509e97cb0160f3afed05094279a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\fr-fr\ui-strings.js 5e23d6302299ec9322e61d05bc8ec3860b415509e97cb0160f3afed05094279a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\illustrations.png 5e23d6302299ec9322e61d05bc8ec3860b415509e97cb0160f3afed05094279a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\exportpdf-rna-tool-view.js 5e23d6302299ec9322e61d05bc8ec3860b415509e97cb0160f3afed05094279a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\pl-pl\AppStore_icon.svg 5e23d6302299ec9322e61d05bc8ec3860b415509e97cb0160f3afed05094279a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\sl-sl 5e23d6302299ec9322e61d05bc8ec3860b415509e97cb0160f3afed05094279a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\svgCheckboxSelected.svg 5e23d6302299ec9322e61d05bc8ec3860b415509e97cb0160f3afed05094279a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\S_IlluDCFilesEmpty_180x180.svg 5e23d6302299ec9322e61d05bc8ec3860b415509e97cb0160f3afed05094279a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\fr-fr 5e23d6302299ec9322e61d05bc8ec3860b415509e97cb0160f3afed05094279a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\dot_2x.png 5e23d6302299ec9322e61d05bc8ec3860b415509e97cb0160f3afed05094279a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\ms_get.svg 5e23d6302299ec9322e61d05bc8ec3860b415509e97cb0160f3afed05094279a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\core_icons_retina.png 5e23d6302299ec9322e61d05bc8ec3860b415509e97cb0160f3afed05094279a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\pt-br\ui-strings.js 5e23d6302299ec9322e61d05bc8ec3860b415509e97cb0160f3afed05094279a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\sk-sk\ui-strings.js 5e23d6302299ec9322e61d05bc8ec3860b415509e97cb0160f3afed05094279a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\vi_get.svg 5e23d6302299ec9322e61d05bc8ec3860b415509e97cb0160f3afed05094279a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_ie8.gif 5e23d6302299ec9322e61d05bc8ec3860b415509e97cb0160f3afed05094279a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ca-es 5e23d6302299ec9322e61d05bc8ec3860b415509e97cb0160f3afed05094279a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\zh-tw\ui-strings.js 5e23d6302299ec9322e61d05bc8ec3860b415509e97cb0160f3afed05094279a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\root 5e23d6302299ec9322e61d05bc8ec3860b415509e97cb0160f3afed05094279a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\ro-ro 5e23d6302299ec9322e61d05bc8ec3860b415509e97cb0160f3afed05094279a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\es-es 5e23d6302299ec9322e61d05bc8ec3860b415509e97cb0160f3afed05094279a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\adc_logo.png 5e23d6302299ec9322e61d05bc8ec3860b415509e97cb0160f3afed05094279a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\media_poster.jpg 5e23d6302299ec9322e61d05bc8ec3860b415509e97cb0160f3afed05094279a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\de-de\AppStore_icon.svg 5e23d6302299ec9322e61d05bc8ec3860b415509e97cb0160f3afed05094279a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\hr-hr\ui-strings.js 5e23d6302299ec9322e61d05bc8ec3860b415509e97cb0160f3afed05094279a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ru-ru 5e23d6302299ec9322e61d05bc8ec3860b415509e97cb0160f3afed05094279a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\root\ui-strings.js 5e23d6302299ec9322e61d05bc8ec3860b415509e97cb0160f3afed05094279a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ja-jp\ui-strings.js 5e23d6302299ec9322e61d05bc8ec3860b415509e97cb0160f3afed05094279a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\cloud_icon.png 5e23d6302299ec9322e61d05bc8ec3860b415509e97cb0160f3afed05094279a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_sortedby_selected_18.svg 5e23d6302299ec9322e61d05bc8ec3860b415509e97cb0160f3afed05094279a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark 5e23d6302299ec9322e61d05bc8ec3860b415509e97cb0160f3afed05094279a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images 5e23d6302299ec9322e61d05bc8ec3860b415509e97cb0160f3afed05094279a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\fr-fr 5e23d6302299ec9322e61d05bc8ec3860b415509e97cb0160f3afed05094279a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_ellipses-hover.svg 5e23d6302299ec9322e61d05bc8ec3860b415509e97cb0160f3afed05094279a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev 5e23d6302299ec9322e61d05bc8ec3860b415509e97cb0160f3afed05094279a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs 5e23d6302299ec9322e61d05bc8ec3860b415509e97cb0160f3afed05094279a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\plugin.js 5e23d6302299ec9322e61d05bc8ec3860b415509e97cb0160f3afed05094279a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\s_radio_unselected_18.svg 5e23d6302299ec9322e61d05bc8ec3860b415509e97cb0160f3afed05094279a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\fi-fi\ui-strings.js 5e23d6302299ec9322e61d05bc8ec3860b415509e97cb0160f3afed05094279a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ja-jp 5e23d6302299ec9322e61d05bc8ec3860b415509e97cb0160f3afed05094279a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js 5e23d6302299ec9322e61d05bc8ec3860b415509e97cb0160f3afed05094279a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar 5e23d6302299ec9322e61d05bc8ec3860b415509e97cb0160f3afed05094279a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\arrow-right-pressed.gif 5e23d6302299ec9322e61d05bc8ec3860b415509e97cb0160f3afed05094279a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\sv-se 5e23d6302299ec9322e61d05bc8ec3860b415509e97cb0160f3afed05094279a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\fr-ma 5e23d6302299ec9322e61d05bc8ec3860b415509e97cb0160f3afed05094279a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\CompleteCheckmark2x.png 5e23d6302299ec9322e61d05bc8ec3860b415509e97cb0160f3afed05094279a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls 5e23d6302299ec9322e61d05bc8ec3860b415509e97cb0160f3afed05094279a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\s_empty_folder_state.svg 5e23d6302299ec9322e61d05bc8ec3860b415509e97cb0160f3afed05094279a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\sv-se\ui-strings.js 5e23d6302299ec9322e61d05bc8ec3860b415509e97cb0160f3afed05094279a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\nl-nl 5e23d6302299ec9322e61d05bc8ec3860b415509e97cb0160f3afed05094279a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\reviews_sent.gif 5e23d6302299ec9322e61d05bc8ec3860b415509e97cb0160f3afed05094279a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\large_trefoil.png 5e23d6302299ec9322e61d05bc8ec3860b415509e97cb0160f3afed05094279a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\aic_file_icons_highcontrast.png 5e23d6302299ec9322e61d05bc8ec3860b415509e97cb0160f3afed05094279a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_filter-hover_32.svg 5e23d6302299ec9322e61d05bc8ec3860b415509e97cb0160f3afed05094279a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5e23d6302299ec9322e61d05bc8ec3860b415509e97cb0160f3afed05094279a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language u1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QTalk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spolsvt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spolsvt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svcoth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 spolsvt.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz spolsvt.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4784 u1.exe 4784 u1.exe 1616 spolsvt.exe 1616 spolsvt.exe 1616 spolsvt.exe 1616 spolsvt.exe 1616 spolsvt.exe 1616 spolsvt.exe 1616 spolsvt.exe 1616 spolsvt.exe 1616 spolsvt.exe 1616 spolsvt.exe 1616 spolsvt.exe 1616 spolsvt.exe 1616 spolsvt.exe 1616 spolsvt.exe 1616 spolsvt.exe 1616 spolsvt.exe 1616 spolsvt.exe 1616 spolsvt.exe 1616 spolsvt.exe 1616 spolsvt.exe 1616 spolsvt.exe 1616 spolsvt.exe 1616 spolsvt.exe 1616 spolsvt.exe 1616 spolsvt.exe 1616 spolsvt.exe 1616 spolsvt.exe 1616 spolsvt.exe 1616 spolsvt.exe 1616 spolsvt.exe 1616 spolsvt.exe 1616 spolsvt.exe 1616 spolsvt.exe 1616 spolsvt.exe 1616 spolsvt.exe 1616 spolsvt.exe 1616 spolsvt.exe 1616 spolsvt.exe 1616 spolsvt.exe 1616 spolsvt.exe 1616 spolsvt.exe 1616 spolsvt.exe 1616 spolsvt.exe 1616 spolsvt.exe 1616 spolsvt.exe 1616 spolsvt.exe 1616 spolsvt.exe 1616 spolsvt.exe 1616 spolsvt.exe 1616 spolsvt.exe 1616 spolsvt.exe 1616 spolsvt.exe 1616 spolsvt.exe 1616 spolsvt.exe 1616 spolsvt.exe 1616 spolsvt.exe 1616 spolsvt.exe 1616 spolsvt.exe 1616 spolsvt.exe 1616 spolsvt.exe 1616 spolsvt.exe 1616 spolsvt.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1616 spolsvt.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4784 u1.exe 4784 u1.exe 1704 QTalk.exe 1704 QTalk.exe -
Suspicious use of WriteProcessMemory 35 IoCs
description pid Process procid_target PID 3500 wrote to memory of 4784 3500 5e23d6302299ec9322e61d05bc8ec3860b415509e97cb0160f3afed05094279a.exe 86 PID 3500 wrote to memory of 4784 3500 5e23d6302299ec9322e61d05bc8ec3860b415509e97cb0160f3afed05094279a.exe 86 PID 3500 wrote to memory of 4784 3500 5e23d6302299ec9322e61d05bc8ec3860b415509e97cb0160f3afed05094279a.exe 86 PID 4784 wrote to memory of 1704 4784 u1.exe 87 PID 4784 wrote to memory of 1704 4784 u1.exe 87 PID 4784 wrote to memory of 1704 4784 u1.exe 87 PID 1704 wrote to memory of 1644 1704 QTalk.exe 88 PID 1704 wrote to memory of 1644 1704 QTalk.exe 88 PID 1704 wrote to memory of 1644 1704 QTalk.exe 88 PID 1704 wrote to memory of 1644 1704 QTalk.exe 88 PID 1704 wrote to memory of 1644 1704 QTalk.exe 88 PID 1704 wrote to memory of 1644 1704 QTalk.exe 88 PID 1704 wrote to memory of 1644 1704 QTalk.exe 88 PID 1704 wrote to memory of 1644 1704 QTalk.exe 88 PID 1644 wrote to memory of 1616 1644 spolsvt.exe 91 PID 1644 wrote to memory of 1616 1644 spolsvt.exe 91 PID 1644 wrote to memory of 1616 1644 spolsvt.exe 91 PID 1644 wrote to memory of 1616 1644 spolsvt.exe 91 PID 1644 wrote to memory of 1616 1644 spolsvt.exe 91 PID 1644 wrote to memory of 1616 1644 spolsvt.exe 91 PID 1644 wrote to memory of 1616 1644 spolsvt.exe 91 PID 1644 wrote to memory of 1616 1644 spolsvt.exe 91 PID 1644 wrote to memory of 2660 1644 spolsvt.exe 97 PID 1644 wrote to memory of 2660 1644 spolsvt.exe 97 PID 1644 wrote to memory of 2660 1644 spolsvt.exe 97 PID 1644 wrote to memory of 2660 1644 spolsvt.exe 97 PID 1644 wrote to memory of 2660 1644 spolsvt.exe 97 PID 1644 wrote to memory of 2660 1644 spolsvt.exe 97 PID 1644 wrote to memory of 2660 1644 spolsvt.exe 97 PID 1644 wrote to memory of 2660 1644 spolsvt.exe 97 PID 1644 wrote to memory of 2660 1644 spolsvt.exe 97 PID 1644 wrote to memory of 2660 1644 spolsvt.exe 97 PID 3500 wrote to memory of 2288 3500 5e23d6302299ec9322e61d05bc8ec3860b415509e97cb0160f3afed05094279a.exe 98 PID 3500 wrote to memory of 2288 3500 5e23d6302299ec9322e61d05bc8ec3860b415509e97cb0160f3afed05094279a.exe 98 PID 3500 wrote to memory of 2288 3500 5e23d6302299ec9322e61d05bc8ec3860b415509e97cb0160f3afed05094279a.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e23d6302299ec9322e61d05bc8ec3860b415509e97cb0160f3afed05094279a.exe"C:\Users\Admin\AppData\Local\Temp\5e23d6302299ec9322e61d05bc8ec3860b415509e97cb0160f3afed05094279a.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Program Files (x86)\u1.exe"C:\Program Files (x86)\u1.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Users\Public\Documents\sougou\V4.6.80\Bin\QTalk.exeC:\Users\Public\Documents\sougou\V4.6.80\Bin\QTalk.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Users\Public\Documents\sougou\spolsvt.exeC:\Users\Public\Documents\sougou\spolsvt.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Users\Public\Documents\dd\spolsvt.exeC:\Users\Public\Documents\dd\spolsvt.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1616
-
-
C:\Users\Public\Documents\uu\svcoth.exeC:\Users\Public\Documents\uu\svcoth.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2660
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "2⤵
- System Location Discovery: System Language Discovery
PID:2288
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.1MB
MD50d808b4aa4329dd4091c0414333aca75
SHA150f045202090292f00a82b1efb3cde09f848a9dd
SHA2569392da86d8c1d1fa48dab2d0c5a53c05de74eccdb302a043f7829f09911f8c5d
SHA512427552d251d65289c97b9593efa87092ec2bdace1d5e39448e98439fff7469414aff0755f915edccae780ef9cf0433993f083deee44be2d41587a14c959daa7b
-
Filesize
300B
MD5ed7240cf3bd75c0791a71af822338029
SHA1b44f0b389bf28785016f8d92907ff357d0d2b204
SHA2567789e4e7246c480f93358d39f393101636e849ef64067a96b7544e94571a9f70
SHA5120038da27924d9787d23732d27465606f54f76430367408995d71420327bc5370e38aad65400baa80e15832fae7b32d654712042d003dcf2b0f23d5ab31fddc66
-
Filesize
16KB
MD5cdce4713e784ae069d73723034a957ff
SHA19a393a6bab6568f1a774fb753353223f11367e09
SHA256b29e48102ecb3d3614e8980a8b8cc63dd2b993c6346f466479244ec2b47b69d8
SHA5120a3a59a305cc2a6fad4e1315b0bcc5a4129595dfe1e8b703363fa02528d2d7c48d3fd22d365708be84a5557cf1916873df9563c454732f93f94a66e7e3b9fb0f
-
Filesize
196KB
MD5f1776f8a75946d171ad83bbd93f94d96
SHA1c6b2d9ab4a49f3e905185f9730727301a1729313
SHA2569c7689cd94796a74a1b7397818a10d1896f40ef7fa84c006c8ba3927f8ffe967
SHA512520e6aee04c074c5acd1e9e90ec33969a9ec7598bd5c0e36833a2830b23ec392257e38b371fd3489e0c6b57d9640c56b7d90c7e8970d9e6dd02176cce27c871c
-
Filesize
9KB
MD5523d5c39f9d8d2375c3df68251fa2249
SHA1d4ed365c44bec9246fc1a65a32a7791792647a10
SHA25620e3dc90a3e83b6202e2a7f4603b60e5e859639cb68693426c400b13aaeabd78
SHA512526e1bba30d03f1ac177c6ab7409187a730969c429cebef15da68ffcf44b3b93227781eebc827b2f7a0fa17c391e00a0e532263fd0167aeaeb0456f96cfe3ae4