qulab | 4b3846fe93b8895a294f047d583aa9479b613276c3fe9322a5a5666e78b27adb

Analysis

max time kernel
158s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-en-20220112
submitted
05/02/2022, 05:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4b3846fe93b8895a294f047d583aa9479b613276c3fe9322a5a5666e78b27adb.exe
Size 7.1MB
Sample220205-fm24qaggan
SHA256 4b3846fe93b8895a294f047d583aa9479b613276c3fe9322a5a5666e78b27adb
MD5 09526cb4b6f6e38ec5b312bc4f055672
SHA1 d509e3913d93e712be39e1df09245f1a9e3f5825
SHA512 0371b7bac83bc59fce4286292a65d905799833ec7e5195695aa140d4ae44682b6e0136944a331150ed17b1b7d92ea0ac36f0ff2962800485439813007c369d87
MD5 SHA1 SHA512

Score

10^/10

qulab discovery evasion persistence ransomware spyware stealer upx vmprotect

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-mccs-syncres.resources\1\Information.txt

qulab

Ransom Note

# /===============================\ # |=== QULAB CLIPPER + STEALER ===| # |===============================| # |==== BUY CLIPPER + STEALER ====| # |=== http://teleg.run/QulabZ ===| # \===============================/ Date: 05.02.2022, 06:02:29 OS: Windows 10 X64 / Build: 19041 UserName: Admin ComputerName: RIBCQUHQ Processor: Intel Core Processor (Broadwell) VideoCard: Microsoft Basic Display Adapter Memory: 2.00 Gb KeyBoard Layout ID: 00000409 Resolution: 1280x720x32, 64 GHz Other Information: <error> Soft / Windows Components / Windows Updates: - Crypto-Bot 5.0.0.8 - Google Chrome - Microsoft Edge - Microsoft Edge Update - Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 - Java Auto Updater - Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.30.30704 - Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.30.30704 - Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.40660 - Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.40660 - Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 - Adobe Acrobat Reader DC - Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 - Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 - Microsoft Visual C++ 2022 X86 Additional Runtime - 14.30.30704 - Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 - Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.40660 - Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.40660 - Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 - Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.30.30704 Process List: - [System Process] / PID: 0 - System / PID: 4 - Registry / PID: 92 - smss.exe / PID: 356 - csrss.exe / PID: 444 - wininit.exe / PID: 520 - csrss.exe / PID: 528 - winlogon.exe / PID: 616 - services.exe / PID: 656 - lsass.exe / PID: 668 - svchost.exe / PID: 784 - fontdrvhost.exe / PID: 792 - fontdrvhost.exe / PID: 796 - svchost.exe / PID: 912 - dwm.exe / PID: 996 - svchost.exe / PID: 408 - svchost.exe / PID: 684 - svchost.exe / PID: 732 - svchost.exe / PID: 1032 - svchost.exe / PID: 1172 - svchost.exe / PID: 1356 - svchost.exe / PID: 1460 - svchost.exe / PID: 1528 - spoolsv.exe / PID: 1656 - svchost.exe / PID: 1680 - svchost.exe / PID: 1764 - svchost.exe / PID: 1780 - svchost.exe / PID: 2008 - OfficeClickToRun.exe / PID: 1280 - svchost.exe / PID: 2164 - sihost.exe / PID: 2220 - svchost.exe / PID: 2236 - taskhostw.exe / PID: 2284 - explorer.exe / PID: 2440 - svchost.exe / PID: 2536 - dllhost.exe / PID: 2744 - dllhost.exe / PID: 2848 - StartMenuExperienceHost.exe / PID: 2936 - RuntimeBroker.exe / PID: 2996 - SearchApp.exe / PID: 3068 - RuntimeBroker.exe / PID: 2776 - RuntimeBroker.exe / PID: 3300 - MoUsoCoreWorker.exe / PID: 3852 - sppsvc.exe / PID: 3636 - svchost.exe / PID: 3024 - SppExtComObj.Exe / PID: 392 - svchost.exe / PID: 4060 - svchost.exe / PID: 1836 - RuntimeBroker.exe / PID: 3396 - svchost.exe / PID: 3140 - 4b3846fe93b8895a294f047d583aa9479b613276c3fe9322a5a5666e78b27adb.exe / PID: 3468 - WmiPrvSE.exe / PID: 2120 - WmiPrvSE.exe / PID: 1252 - svchost.exe / PID: 3672 - Explorer.exe / PID: 2580 - MSMPEG2ENC.exe / PID: 3740

URLs

http://teleg.run/QulabZ

Signatures

Qulab Stealer & Clipper
Infostealer and clipper created with AutoIt.
stealer qulab

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0007000000022138-149.dat	acprotect
behavioral2/files/0x0007000000022138-150.dat	acprotect

Executes dropped EXE 6 IoCs

pid	Process
2196	Qulab.exe
1652	MSMPEG2ENC.exe
2136	Predator.exe
2580	Explorer.exe
3740	MSMPEG2ENC.exe
2544	MSMPEG2ENC.module.exe

Sets file to hidden 1 TTPs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1158
Sets service image path in registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0007000000022138-149.dat	upx
behavioral2/files/0x0007000000022138-150.dat	upx
behavioral2/files/0x000600000002216c-151.dat	upx

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/files/0x000600000002211d-131.dat	vmprotect
behavioral2/files/0x000600000002211d-138.dat	vmprotect
behavioral2/memory/2580-147-0x0000000000400000-0x0000000000C37000-memory.dmp	vmprotect

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation	4b3846fe93b8895a294f047d583aa9479b613276c3fe9322a5a5666e78b27adb.exe

Drops startup file 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explorer.lnk	4b3846fe93b8895a294f047d583aa9479b613276c3fe9322a5a5666e78b27adb.exe

Loads dropped DLL 2 IoCs

pid	Process
3740	MSMPEG2ENC.exe
3740	MSMPEG2ENC.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
55	ipapi.co
56	ipapi.co

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\winmgmts:\localhost\	MSMPEG2ENC.exe

autoit_exe 4 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x0006000000022123-134.dat	autoit_exe
behavioral2/files/0x0006000000022123-135.dat	autoit_exe
behavioral2/files/0x0006000000022123-136.dat	autoit_exe
behavioral2/files/0x0006000000022123-140.dat	autoit_exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MusNotifyIcon.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MusNotifyIcon.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4068"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "2.671785"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132886872868189314"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	WaaSMedicAgent.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	4b3846fe93b8895a294f047d583aa9479b613276c3fe9322a5a5666e78b27adb.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Win\winmgmts:\localhost\	Qulab.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-mccs-syncres.resources\winmgmts:\localhost\	MSMPEG2ENC.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2580	Explorer.exe
2580	Explorer.exe
2580	Explorer.exe
2580	Explorer.exe
3740	MSMPEG2ENC.exe
3740	MSMPEG2ENC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	2544	MSMPEG2ENC.module.exe
Token: 35	2544	MSMPEG2ENC.module.exe
Token: SeSecurityPrivilege	2544	MSMPEG2ENC.module.exe
Token: SeSecurityPrivilege	2544	MSMPEG2ENC.module.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 3468 wrote to memory of 3932	3468	4b3846fe93b8895a294f047d583aa9479b613276c3fe9322a5a5666e78b27adb.exe	62
PID 3468 wrote to memory of 3932	3468	4b3846fe93b8895a294f047d583aa9479b613276c3fe9322a5a5666e78b27adb.exe	62
PID 3468 wrote to memory of 3932	3468	4b3846fe93b8895a294f047d583aa9479b613276c3fe9322a5a5666e78b27adb.exe	62
PID 3932 wrote to memory of 3400	3932	cmd.exe	64
PID 3932 wrote to memory of 3400	3932	cmd.exe	64
PID 3932 wrote to memory of 3400	3932	cmd.exe	64
PID 3932 wrote to memory of 2468	3932	cmd.exe	65
PID 3932 wrote to memory of 2468	3932	cmd.exe	65
PID 3932 wrote to memory of 2468	3932	cmd.exe	65
PID 3468 wrote to memory of 2196	3468	4b3846fe93b8895a294f047d583aa9479b613276c3fe9322a5a5666e78b27adb.exe	69
PID 3468 wrote to memory of 2196	3468	4b3846fe93b8895a294f047d583aa9479b613276c3fe9322a5a5666e78b27adb.exe	69
PID 3468 wrote to memory of 2196	3468	4b3846fe93b8895a294f047d583aa9479b613276c3fe9322a5a5666e78b27adb.exe	69
PID 2196 wrote to memory of 1652	2196	Qulab.exe	72
PID 2196 wrote to memory of 1652	2196	Qulab.exe	72
PID 2196 wrote to memory of 1652	2196	Qulab.exe	72
PID 3468 wrote to memory of 2136	3468	4b3846fe93b8895a294f047d583aa9479b613276c3fe9322a5a5666e78b27adb.exe	73
PID 3468 wrote to memory of 2136	3468	4b3846fe93b8895a294f047d583aa9479b613276c3fe9322a5a5666e78b27adb.exe	73
PID 3468 wrote to memory of 2136	3468	4b3846fe93b8895a294f047d583aa9479b613276c3fe9322a5a5666e78b27adb.exe	73
PID 3468 wrote to memory of 2580	3468	4b3846fe93b8895a294f047d583aa9479b613276c3fe9322a5a5666e78b27adb.exe	78
PID 3468 wrote to memory of 2580	3468	4b3846fe93b8895a294f047d583aa9479b613276c3fe9322a5a5666e78b27adb.exe	78
PID 3468 wrote to memory of 2580	3468	4b3846fe93b8895a294f047d583aa9479b613276c3fe9322a5a5666e78b27adb.exe	78
PID 3740 wrote to memory of 2544	3740	MSMPEG2ENC.exe	81
PID 3740 wrote to memory of 2544	3740	MSMPEG2ENC.exe	81
PID 3740 wrote to memory of 2544	3740	MSMPEG2ENC.exe	81
PID 3740 wrote to memory of 3112	3740	MSMPEG2ENC.exe	83
PID 3740 wrote to memory of 3112	3740	MSMPEG2ENC.exe	83
PID 3740 wrote to memory of 3112	3740	MSMPEG2ENC.exe	83

Views/modifies file attributes 1 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
3400	attrib.exe
2468	attrib.exe
3112	attrib.exe

C:\Users\Admin\AppData\Local\Temp\4b3846fe93b8895a294f047d583aa9479b613276c3fe9322a5a5666e78b27adb.exe
"C:\Users\Admin\AppData\Local\Temp\4b3846fe93b8895a294f047d583aa9479b613276c3fe9322a5a5666e78b27adb.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3468
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Win\Hide.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3932
- - C:\Windows\SysWOW64\attrib.exe
    attrib +s +h "C:\Win\*.*"
    3⤵
    - Views/modifies file attributes
    PID:3400
- - C:\Windows\SysWOW64\attrib.exe
    attrib +s +h "C:\Win"
    3⤵
    - Views/modifies file attributes
    PID:2468
- C:\Win\Qulab.exe
  "C:\Win\Qulab.exe"
  2⤵
  - Executes dropped EXE
  - NTFS ADS
  - Suspicious use of WriteProcessMemory
  PID:2196
- - C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-mccs-syncres.resources\MSMPEG2ENC.exe
    C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-mccs-syncres.resources\MSMPEG2ENC.exe
    3⤵
    - Executes dropped EXE
    - NTFS ADS
    PID:1652
- C:\Win\Predator.exe
  "C:\Win\Predator.exe"
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Win\Explorer.exe
  "C:\Win\Explorer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2580

C:\Windows\system32\MusNotifyIcon.exe
%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 13
1⤵
- Checks processor information in registry
PID:1620

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe cd8035357de956df0df805827b42e014 jUyafFce4E+YioqOnVdfwg.0.1.0.0.0
1⤵
- Modifies data under HKEY_USERS
PID:2332

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:3672

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-mccs-syncres.resources\MSMPEG2ENC.exe
C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-mccs-syncres.resources\MSMPEG2ENC.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3740
- C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-mccs-syncres.resources\MSMPEG2ENC.module.exe
  C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-mccs-syncres.resources\MSMPEG2ENC.module.exe a -y -mx9 -ssw "C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-mccs-syncres.resources\41646D696E524942435155485157494E5F313058.7z" "C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-mccs-syncres.resources\1\*"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2544
- C:\Windows\SysWOW64\attrib.exe
  attrib +s +h "C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-mccs-syncres.resources"
  2⤵
  - Views/modifies file attributes
  PID:3112

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2580-141-0x0000000000EB0000-0x0000000000EB1000-memory.dmp

Download

memory/2580-146-0x00000000028B0000-0x00000000028B1000-memory.dmp

Download

memory/2580-147-0x0000000000400000-0x0000000000C37000-memory.dmp

Download

memory/2580-143-0x0000000002880000-0x0000000002881000-memory.dmp

Download

memory/2580-142-0x0000000000EC0000-0x0000000000EC1000-memory.dmp

Download

memory/2580-144-0x0000000002890000-0x0000000002891000-memory.dmp

Download

memory/2580-145-0x00000000028A0000-0x00000000028A1000-memory.dmp

Download

memory/2580-139-0x0000000000D90000-0x0000000000D91000-memory.dmp

Download

memory/3740-155-0x0000000006F50000-0x0000000006F51000-memory.dmp

Download

memory/3740-154-0x0000000006F30000-0x0000000006F31000-memory.dmp

Download

memory/3740-156-0x0000000006F40000-0x0000000006F41000-memory.dmp

Download

memory/3740-157-0x0000000006F60000-0x0000000006F61000-memory.dmp

Download