Analysis Overview
SHA256
c7e5191b16640294ab397ba2287168307c8e727480ba9586565c9114536785fb
Threat Level: Known bad
The file c7e5191b16640294ab397ba2287168307c8e727480ba9586565c9114536785fb was found to be: Known bad.
Malicious Activity Summary
Qulab Stealer & Clipper
ACProtect 1.3x - 1.4x DLL software
Sets file to hidden
UPX packed file
Reads user/profile data of web browsers
Loads dropped DLL
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Looks up external IP address via web service
AutoIT Executable
Drops file in System32 directory
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious behavior: RenamesItself
Views/modifies file attributes
NTFS ADS
MITRE ATT&CK Matrix V6
Analysis: static1
Detonation Overview
Reported
2022-05-07 21:09
Signatures
AutoIT Executable
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2022-05-07 21:09
Reported
2022-05-07 21:36
Platform
win7-20220414-en
Max time kernel
153s
Max time network
218s
Command Line
Signatures
Qulab Stealer & Clipper
ACProtect 1.3x - 1.4x DLL software
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Sets file to hidden
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-wow64-legacy.resources\mciseq.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-wow64-legacy.resources\mciseq.exe | N/A |
Reads user/profile data of web browsers
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | ipapi.co | N/A | N/A |
| N/A | ipapi.co | N/A | N/A |
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\SysWOW64\winmgmts:\localhost\ | C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-wow64-legacy.resources\mciseq.exe | N/A |
NTFS ADS
| Description | Indicator | Process | Target |
| File opened for modification | C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-wow64-legacy.resources\winmgmts:\localhost\ | C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-wow64-legacy.resources\mciseq.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Local\Temp\winmgmts:\localhost\ | C:\Users\Admin\AppData\Local\Temp\c7e5191b16640294ab397ba2287168307c8e727480ba9586565c9114536785fb.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-wow64-legacy.resources\mciseq.exe | N/A |
Suspicious behavior: RenamesItself
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\c7e5191b16640294ab397ba2287168307c8e727480ba9586565c9114536785fb.exe | N/A |
Suspicious use of WriteProcessMemory
Views/modifies file attributes
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\attrib.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\c7e5191b16640294ab397ba2287168307c8e727480ba9586565c9114536785fb.exe
"C:\Users\Admin\AppData\Local\Temp\c7e5191b16640294ab397ba2287168307c8e727480ba9586565c9114536785fb.exe"
C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-wow64-legacy.resources\mciseq.exe
C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-wow64-legacy.resources\mciseq.exe
C:\Windows\system32\taskeng.exe
taskeng.exe {836912E7-120C-4017-89FD-86F98A84F0CA} S-1-5-21-1083475884-596052423-1669053738-1000:WYZSGDWS\Admin:Interactive:[1]
C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-wow64-legacy.resources\mciseq.exe
C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-wow64-legacy.resources\mciseq.exe
C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-wow64-legacy.resources\mciseq.module.exe
C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-wow64-legacy.resources\mciseq.module.exe a -y -mx9 -ssw "C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-wow64-legacy.resources\ENU_687FE9737473A97E9D41.7z" "C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-wow64-legacy.resources\1\*"
C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-wow64-legacy.resources\mciseq.exe
C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-wow64-legacy.resources\mciseq.exe
C:\Windows\SysWOW64\attrib.exe
attrib +s +h "C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-wow64-legacy.resources"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | ipapi.co | udp |
| US | 8.8.8.8:53 | api.telegram.org | udp |
| NL | 149.154.167.220:443 | api.telegram.org | tcp |
| US | 104.26.9.44:443 | ipapi.co | tcp |
| NL | 149.154.167.220:443 | api.telegram.org | tcp |
| NL | 149.154.167.220:443 | api.telegram.org | tcp |
| NL | 149.154.167.220:443 | api.telegram.org | tcp |
| RU | 193.233.30.150:65233 | tcp | |
| RU | 193.233.30.150:65233 | tcp |
Files
memory/324-54-0x0000000075EF1000-0x0000000075EF3000-memory.dmp
memory/1004-55-0x0000000000000000-mapping.dmp
memory/1232-57-0x0000000000000000-mapping.dmp
\Users\Admin\AppData\Roaming\wow64_microsoft-windows-wow64-legacy.resources\mciseq.sqlite3.module.dll
| MD5 | 8c127ce55bfbb55eb9a843c693c9f240 |
| SHA1 | 75c462c935a7ff2c90030c684440d61d48bb1858 |
| SHA256 | 4f93f3543139febb91e0c95dc9351008e9147a484732ee5962c7df64f6868028 |
| SHA512 | d3578bd7ef01f9e25983c24eb9bb33f25c37d650cc79b823c3ec19f196d4a00deb506c1e1f774f15e5664d5263b02570fec11b322022b90a0ff1b10943188a02 |
\Users\Admin\AppData\Roaming\wow64_microsoft-windows-wow64-legacy.resources\mciseq.sqlite3.module.dll
| MD5 | 8c127ce55bfbb55eb9a843c693c9f240 |
| SHA1 | 75c462c935a7ff2c90030c684440d61d48bb1858 |
| SHA256 | 4f93f3543139febb91e0c95dc9351008e9147a484732ee5962c7df64f6868028 |
| SHA512 | d3578bd7ef01f9e25983c24eb9bb33f25c37d650cc79b823c3ec19f196d4a00deb506c1e1f774f15e5664d5263b02570fec11b322022b90a0ff1b10943188a02 |
\Users\Admin\AppData\Roaming\wow64_microsoft-windows-wow64-legacy.resources\mciseq.module.exe
| MD5 | 946285055913d457fda78a4484266e96 |
| SHA1 | 668661955bf3c20b9dc8cdaa7ec6e8dbbbd63285 |
| SHA256 | 23ca34a7d22fdb7d36014928c089c982cdfb903e9143aea60d38f228c9594beb |
| SHA512 | 30a490b774d5736215b340d3a192825dc1dfbb7c8d9974c8ab2a09eff2429ed7cf99969ec6d651c8056549798da092ffa600681288dbd7c6f60515acd3630d95 |
C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-wow64-legacy.resources\mciseq.module.exe
| MD5 | 946285055913d457fda78a4484266e96 |
| SHA1 | 668661955bf3c20b9dc8cdaa7ec6e8dbbbd63285 |
| SHA256 | 23ca34a7d22fdb7d36014928c089c982cdfb903e9143aea60d38f228c9594beb |
| SHA512 | 30a490b774d5736215b340d3a192825dc1dfbb7c8d9974c8ab2a09eff2429ed7cf99969ec6d651c8056549798da092ffa600681288dbd7c6f60515acd3630d95 |
memory/960-63-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-wow64-legacy.resources\1\Screen.jpg
| MD5 | ac56417b8d12be0f31458a3df92cf1d6 |
| SHA1 | 8799efaba7cfb12a3002a471bbfebe81ba68ee17 |
| SHA256 | d789d806b69686f9dbf6122fc77176c24b0ecb5230b4eec6109dfcbb86157d7d |
| SHA512 | 82706288866806ab3bfb5342d7cb4fa6e6f96328b46c0e2a74cb0370f2a97dc530565241ee1b46d3dc8ad8c242d1d96d46e686b82b2ae12223e6b7c08f8fb096 |
C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-wow64-legacy.resources\1\Information.txt
| MD5 | 11de323911568453ef3a77bcecbaf59a |
| SHA1 | c9d11c292678e0582038577434530cb8f282a462 |
| SHA256 | a125f8c890adc530bf51ee9aaa925eccbac6b8f4c562b1c4661835ece855af98 |
| SHA512 | 155aa3de732ac0456136dbaaa2dd79e463c75e7dc9894212c69f0c80f04e34825c5d803fe3d12af9abb8cf77ba5cf05b6545a9449b2ecf59d4cd097e52d6b358 |
\Users\Admin\AppData\Roaming\wow64_microsoft-windows-wow64-legacy.resources\mciseq.module.exe
| MD5 | 946285055913d457fda78a4484266e96 |
| SHA1 | 668661955bf3c20b9dc8cdaa7ec6e8dbbbd63285 |
| SHA256 | 23ca34a7d22fdb7d36014928c089c982cdfb903e9143aea60d38f228c9594beb |
| SHA512 | 30a490b774d5736215b340d3a192825dc1dfbb7c8d9974c8ab2a09eff2429ed7cf99969ec6d651c8056549798da092ffa600681288dbd7c6f60515acd3630d95 |
memory/2032-67-0x0000000000000000-mapping.dmp
memory/548-69-0x0000000000000000-mapping.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2022-05-07 21:09
Reported
2022-05-07 21:34
Platform
win10v2004-20220414-en
Max time kernel
180s
Max time network
190s
Command Line
Signatures
NTFS ADS
| Description | Indicator | Process | Target |
| File opened for modification | C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-wow64-legacy.resources\winmgmts:\localhost\ | C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-wow64-legacy.resources\mciseq.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Local\Temp\winmgmts:\localhost\ | C:\Users\Admin\AppData\Local\Temp\c7e5191b16640294ab397ba2287168307c8e727480ba9586565c9114536785fb.exe | N/A |
Suspicious behavior: RenamesItself
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\c7e5191b16640294ab397ba2287168307c8e727480ba9586565c9114536785fb.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 3600 wrote to memory of 4704 | N/A | C:\Users\Admin\AppData\Local\Temp\c7e5191b16640294ab397ba2287168307c8e727480ba9586565c9114536785fb.exe | C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-wow64-legacy.resources\mciseq.exe |
| PID 3600 wrote to memory of 4704 | N/A | C:\Users\Admin\AppData\Local\Temp\c7e5191b16640294ab397ba2287168307c8e727480ba9586565c9114536785fb.exe | C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-wow64-legacy.resources\mciseq.exe |
| PID 3600 wrote to memory of 4704 | N/A | C:\Users\Admin\AppData\Local\Temp\c7e5191b16640294ab397ba2287168307c8e727480ba9586565c9114536785fb.exe | C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-wow64-legacy.resources\mciseq.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\c7e5191b16640294ab397ba2287168307c8e727480ba9586565c9114536785fb.exe
"C:\Users\Admin\AppData\Local\Temp\c7e5191b16640294ab397ba2287168307c8e727480ba9586565c9114536785fb.exe"
C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-wow64-legacy.resources\mciseq.exe
C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-wow64-legacy.resources\mciseq.exe
Network
| Country | Destination | Domain | Proto |
| NL | 104.110.191.133:80 | tcp | |
| NL | 104.110.191.133:80 | tcp | |
| US | 52.182.141.63:443 | tcp |
Files
memory/4704-130-0x0000000000000000-mapping.dmp