Malware Analysis Report

2024-09-23 04:53

Sample ID 220507-zzkjzsefh2
Target c7e5191b16640294ab397ba2287168307c8e727480ba9586565c9114536785fb
SHA256 c7e5191b16640294ab397ba2287168307c8e727480ba9586565c9114536785fb
Tags
qulab discovery evasion ransomware spyware stealer upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

c7e5191b16640294ab397ba2287168307c8e727480ba9586565c9114536785fb

Threat Level: Known bad

The file c7e5191b16640294ab397ba2287168307c8e727480ba9586565c9114536785fb was found to be: Known bad.

Malicious Activity Summary

qulab discovery evasion ransomware spyware stealer upx

Qulab Stealer & Clipper

ACProtect 1.3x - 1.4x DLL software

Sets file to hidden

UPX packed file

Reads user/profile data of web browsers

Loads dropped DLL

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Looks up external IP address via web service

AutoIT Executable

Drops file in System32 directory

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious behavior: RenamesItself

Views/modifies file attributes

NTFS ADS

MITRE ATT&CK Matrix V6

Analysis: static1

Detonation Overview

Reported

2022-05-07 21:09

Signatures

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-05-07 21:09

Reported

2022-05-07 21:36

Platform

win7-20220414-en

Max time kernel

153s

Max time network

218s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c7e5191b16640294ab397ba2287168307c8e727480ba9586565c9114536785fb.exe"

Signatures

Qulab Stealer & Clipper

stealer qulab

ACProtect 1.3x - 1.4x DLL software

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Sets file to hidden

evasion

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Checks installed software on the system

discovery

Looks up external IP address via web service

Description Indicator Process Target
N/A ipapi.co N/A N/A
N/A ipapi.co N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\winmgmts:\localhost\ C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-wow64-legacy.resources\mciseq.exe N/A

NTFS ADS

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-wow64-legacy.resources\winmgmts:\localhost\ C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-wow64-legacy.resources\mciseq.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Temp\winmgmts:\localhost\ C:\Users\Admin\AppData\Local\Temp\c7e5191b16640294ab397ba2287168307c8e727480ba9586565c9114536785fb.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-wow64-legacy.resources\mciseq.exe N/A

Suspicious behavior: RenamesItself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\c7e5191b16640294ab397ba2287168307c8e727480ba9586565c9114536785fb.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 324 wrote to memory of 1004 N/A C:\Users\Admin\AppData\Local\Temp\c7e5191b16640294ab397ba2287168307c8e727480ba9586565c9114536785fb.exe C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-wow64-legacy.resources\mciseq.exe
PID 324 wrote to memory of 1004 N/A C:\Users\Admin\AppData\Local\Temp\c7e5191b16640294ab397ba2287168307c8e727480ba9586565c9114536785fb.exe C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-wow64-legacy.resources\mciseq.exe
PID 324 wrote to memory of 1004 N/A C:\Users\Admin\AppData\Local\Temp\c7e5191b16640294ab397ba2287168307c8e727480ba9586565c9114536785fb.exe C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-wow64-legacy.resources\mciseq.exe
PID 324 wrote to memory of 1004 N/A C:\Users\Admin\AppData\Local\Temp\c7e5191b16640294ab397ba2287168307c8e727480ba9586565c9114536785fb.exe C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-wow64-legacy.resources\mciseq.exe
PID 1496 wrote to memory of 1232 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-wow64-legacy.resources\mciseq.exe
PID 1496 wrote to memory of 1232 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-wow64-legacy.resources\mciseq.exe
PID 1496 wrote to memory of 1232 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-wow64-legacy.resources\mciseq.exe
PID 1496 wrote to memory of 1232 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-wow64-legacy.resources\mciseq.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\c7e5191b16640294ab397ba2287168307c8e727480ba9586565c9114536785fb.exe

"C:\Users\Admin\AppData\Local\Temp\c7e5191b16640294ab397ba2287168307c8e727480ba9586565c9114536785fb.exe"

C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-wow64-legacy.resources\mciseq.exe

C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-wow64-legacy.resources\mciseq.exe

C:\Windows\system32\taskeng.exe

taskeng.exe {836912E7-120C-4017-89FD-86F98A84F0CA} S-1-5-21-1083475884-596052423-1669053738-1000:WYZSGDWS\Admin:Interactive:[1]

C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-wow64-legacy.resources\mciseq.exe

C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-wow64-legacy.resources\mciseq.exe

C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-wow64-legacy.resources\mciseq.module.exe

C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-wow64-legacy.resources\mciseq.module.exe a -y -mx9 -ssw "C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-wow64-legacy.resources\ENU_687FE9737473A97E9D41.7z" "C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-wow64-legacy.resources\1\*"

C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-wow64-legacy.resources\mciseq.exe

C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-wow64-legacy.resources\mciseq.exe

C:\Windows\SysWOW64\attrib.exe

attrib +s +h "C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-wow64-legacy.resources"

Network

Country Destination Domain Proto
US 8.8.8.8:53 ipapi.co udp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 104.26.9.44:443 ipapi.co tcp
NL 149.154.167.220:443 api.telegram.org tcp
NL 149.154.167.220:443 api.telegram.org tcp
NL 149.154.167.220:443 api.telegram.org tcp
RU 193.233.30.150:65233 tcp
RU 193.233.30.150:65233 tcp

Files

memory/324-54-0x0000000075EF1000-0x0000000075EF3000-memory.dmp

memory/1004-55-0x0000000000000000-mapping.dmp

memory/1232-57-0x0000000000000000-mapping.dmp

\Users\Admin\AppData\Roaming\wow64_microsoft-windows-wow64-legacy.resources\mciseq.sqlite3.module.dll

MD5 8c127ce55bfbb55eb9a843c693c9f240
SHA1 75c462c935a7ff2c90030c684440d61d48bb1858
SHA256 4f93f3543139febb91e0c95dc9351008e9147a484732ee5962c7df64f6868028
SHA512 d3578bd7ef01f9e25983c24eb9bb33f25c37d650cc79b823c3ec19f196d4a00deb506c1e1f774f15e5664d5263b02570fec11b322022b90a0ff1b10943188a02

\Users\Admin\AppData\Roaming\wow64_microsoft-windows-wow64-legacy.resources\mciseq.sqlite3.module.dll

MD5 8c127ce55bfbb55eb9a843c693c9f240
SHA1 75c462c935a7ff2c90030c684440d61d48bb1858
SHA256 4f93f3543139febb91e0c95dc9351008e9147a484732ee5962c7df64f6868028
SHA512 d3578bd7ef01f9e25983c24eb9bb33f25c37d650cc79b823c3ec19f196d4a00deb506c1e1f774f15e5664d5263b02570fec11b322022b90a0ff1b10943188a02

\Users\Admin\AppData\Roaming\wow64_microsoft-windows-wow64-legacy.resources\mciseq.module.exe

MD5 946285055913d457fda78a4484266e96
SHA1 668661955bf3c20b9dc8cdaa7ec6e8dbbbd63285
SHA256 23ca34a7d22fdb7d36014928c089c982cdfb903e9143aea60d38f228c9594beb
SHA512 30a490b774d5736215b340d3a192825dc1dfbb7c8d9974c8ab2a09eff2429ed7cf99969ec6d651c8056549798da092ffa600681288dbd7c6f60515acd3630d95

C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-wow64-legacy.resources\mciseq.module.exe

MD5 946285055913d457fda78a4484266e96
SHA1 668661955bf3c20b9dc8cdaa7ec6e8dbbbd63285
SHA256 23ca34a7d22fdb7d36014928c089c982cdfb903e9143aea60d38f228c9594beb
SHA512 30a490b774d5736215b340d3a192825dc1dfbb7c8d9974c8ab2a09eff2429ed7cf99969ec6d651c8056549798da092ffa600681288dbd7c6f60515acd3630d95

memory/960-63-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-wow64-legacy.resources\1\Screen.jpg

MD5 ac56417b8d12be0f31458a3df92cf1d6
SHA1 8799efaba7cfb12a3002a471bbfebe81ba68ee17
SHA256 d789d806b69686f9dbf6122fc77176c24b0ecb5230b4eec6109dfcbb86157d7d
SHA512 82706288866806ab3bfb5342d7cb4fa6e6f96328b46c0e2a74cb0370f2a97dc530565241ee1b46d3dc8ad8c242d1d96d46e686b82b2ae12223e6b7c08f8fb096

C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-wow64-legacy.resources\1\Information.txt

MD5 11de323911568453ef3a77bcecbaf59a
SHA1 c9d11c292678e0582038577434530cb8f282a462
SHA256 a125f8c890adc530bf51ee9aaa925eccbac6b8f4c562b1c4661835ece855af98
SHA512 155aa3de732ac0456136dbaaa2dd79e463c75e7dc9894212c69f0c80f04e34825c5d803fe3d12af9abb8cf77ba5cf05b6545a9449b2ecf59d4cd097e52d6b358

\Users\Admin\AppData\Roaming\wow64_microsoft-windows-wow64-legacy.resources\mciseq.module.exe

MD5 946285055913d457fda78a4484266e96
SHA1 668661955bf3c20b9dc8cdaa7ec6e8dbbbd63285
SHA256 23ca34a7d22fdb7d36014928c089c982cdfb903e9143aea60d38f228c9594beb
SHA512 30a490b774d5736215b340d3a192825dc1dfbb7c8d9974c8ab2a09eff2429ed7cf99969ec6d651c8056549798da092ffa600681288dbd7c6f60515acd3630d95

memory/2032-67-0x0000000000000000-mapping.dmp

memory/548-69-0x0000000000000000-mapping.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-05-07 21:09

Reported

2022-05-07 21:34

Platform

win10v2004-20220414-en

Max time kernel

180s

Max time network

190s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c7e5191b16640294ab397ba2287168307c8e727480ba9586565c9114536785fb.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\c7e5191b16640294ab397ba2287168307c8e727480ba9586565c9114536785fb.exe

"C:\Users\Admin\AppData\Local\Temp\c7e5191b16640294ab397ba2287168307c8e727480ba9586565c9114536785fb.exe"

C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-wow64-legacy.resources\mciseq.exe

C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-wow64-legacy.resources\mciseq.exe

Network

Country Destination Domain Proto
NL 104.110.191.133:80 tcp
NL 104.110.191.133:80 tcp
US 52.182.141.63:443 tcp

Files

memory/4704-130-0x0000000000000000-mapping.dmp