qulab | 19bb7a034d6d884ee350df147940446783b5b71e4a52ea54cd98f33ec411d9ee

General

Target

19bb7a034d6d884ee350df147940446783b5b71e4a52ea54cd98f33ec411d9ee.exe
Size

2.5MB
MD5

12bfb8030f170920a4cccca7fb38bf8c
SHA1

c0b3dd1d9f7c64d8f5c131344dad17534fe8ccf1
SHA256

19bb7a034d6d884ee350df147940446783b5b71e4a52ea54cd98f33ec411d9ee
SHA512

8bb21fc02b9c9aafd47f69923240ed714eb0c634871ae801c4670eb23b6bba39b4b5a8266fb801174e5aa74f25ef497948e5330129783f3731743df689d8bbed

Score

10^/10

qulab discovery evasion ransomware spyware stealer upx

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-naturallanguage6-0022\1\Information.txt

Family

qulab

Ransom Note

# /===============================\ # |=== QULAB CLIPPER + STEALER ===| # |===============================| # |==== BUY CLIPPER + STEALER ====| # |=== http://teleg.run/QulabZ ===| # \===============================/ Date: 08.06.2022, 08:56:40 Main Information: - OS: Windows 7 X64 / Build: 7601 - UserName: Admin - ComputerName: TVHJCWMH - Processor: Intel Core Processor (Broadwell) - VideoCard: Standard VGA Graphics Adapter - Memory: 2.00 Gb - KeyBoard Layout ID: 00000409 - Resolution: 1280x720x32, 1 GHz Other Information: <error> Soft / Windows Components / Windows Updates: - Adobe AIR - Google Chrome - Microsoft Office Professional Plus 2010 - Adobe AIR - Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 - Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.30.30704 - Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.30.30704 - Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.40660 - Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.40660 - Microsoft Office Professional Plus 2010 - Microsoft Office Access MUI (English) 2010 - Microsoft Office Excel MUI (English) 2010 - Microsoft Office PowerPoint MUI (English) 2010 - Microsoft Office Publisher MUI (English) 2010 - Microsoft Office Outlook MUI (English) 2010 - Microsoft Office Word MUI (English) 2010 - Microsoft Office Proof (English) 2010 - Microsoft Office Proof (French) 2010 - Microsoft Office Proof (Spanish) 2010 - Microsoft Office Proofing (English) 2010 - Microsoft Office InfoPath MUI (English) 2010 - Microsoft Office Shared MUI (English) 2010 - Microsoft Office OneNote MUI (English) 2010 - Microsoft Office Groove MUI (English) 2010 - Microsoft Office Shared Setup Metadata MUI (English) 2010 - Microsoft Office Access Setup Metadata MUI (English) 2010 - Update for Microsoft .NET Framework 4.7.2 (KB4087364) - Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 - Adobe Reader 9 - Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 - Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 - Microsoft Visual C++ 2022 X86 Additional Runtime - 14.30.30704 - Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 - Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.40660 - Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.40660 - Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 - Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.30.30704 Process List: - [System Process] / PID: 0 - System / PID: 4 - smss.exe / PID: 260 - csrss.exe / PID: 332 - wininit.exe / PID: 372 - csrss.exe / PID: 380 - winlogon.exe / PID: 420 - services.exe / PID: 464 - lsass.exe / PID: 480 - lsm.exe / PID: 488 - svchost.exe / PID: 592 - svchost.exe / PID: 668 - svchost.exe / PID: 744 - svchost.exe / PID: 808 - svchost.exe / PID: 840 - svchost.exe / PID: 880 - svchost.exe / PID: 324 - spoolsv.exe / PID: 296 - svchost.exe / PID: 1040 - taskhost.exe / PID: 1136 - dwm.exe / PID: 1232 - explorer.exe / PID: 1280 - svchost.exe / PID: 1228 - sppsvc.exe / PID: 1512 - cryptdlg.exe / PID: 1980

URLs

http://teleg.run/QulabZ

Signatures

Qulab Stealer & Clipper
Infostealer and clipper created with AutoIt.
stealer qulab

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
\Users\Admin\AppData\Roaming\x86_microsoft-windows-naturallanguage6-0022\cryptdlg.sqlite3.module.dll	acprotect
\Users\Admin\AppData\Roaming\x86_microsoft-windows-naturallanguage6-0022\cryptdlg.sqlite3.module.dll	acprotect

Executes dropped EXE 1 IoCs

Processes:

cryptdlg.module.exe

pid process

1200 cryptdlg.module.exe
Sets file to hidden 1 TTPs 1 IoCs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exe

pid process

852 attrib.exe

pid	process
1200	cryptdlg.module.exe

pid	process
852	attrib.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Roaming\x86_microsoft-windows-naturallanguage6-0022\cryptdlg.sqlite3.module.dll	upx
\Users\Admin\AppData\Roaming\x86_microsoft-windows-naturallanguage6-0022\cryptdlg.sqlite3.module.dll	upx
\Users\Admin\AppData\Roaming\x86_microsoft-windows-naturallanguage6-0022\cryptdlg.module.exe	upx
\Users\Admin\AppData\Roaming\x86_microsoft-windows-naturallanguage6-0022\cryptdlg.module.exe	upx
C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-naturallanguage6-0022\cryptdlg.module.exe	upx
behavioral1/memory/1200-91-0x0000000000400000-0x000000000047D000-memory.dmp	upx

Loads dropped DLL 4 IoCs

Processes:

cryptdlg.exe

pid process

1980 cryptdlg.exe
1980 cryptdlg.exe
1980 cryptdlg.exe
1980 cryptdlg.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 ipapi.co
6 ipapi.co

pid	process
1980	cryptdlg.exe
1980	cryptdlg.exe
1980	cryptdlg.exe
1980	cryptdlg.exe

flow	ioc
4	ipapi.co
6	ipapi.co

AutoIT Executable 14 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral1/memory/1184-57-0x0000000000670000-0x0000000000845000-memory.dmp	autoit_exe
behavioral1/memory/1184-64-0x000000000069800A-mapping.dmp	autoit_exe
behavioral1/memory/1184-66-0x0000000000670000-0x0000000000845000-memory.dmp	autoit_exe
behavioral1/memory/1980-73-0x00000000005B0000-0x0000000000785000-memory.dmp	autoit_exe
behavioral1/memory/1980-78-0x00000000005D800A-mapping.dmp	autoit_exe
behavioral1/memory/1980-80-0x00000000005B0000-0x0000000000785000-memory.dmp	autoit_exe
behavioral1/memory/1980-83-0x0000000061E00000-0x0000000061ED2000-memory.dmp	autoit_exe
behavioral1/memory/1980-84-0x0000000061E00000-0x0000000061ED2000-memory.dmp	autoit_exe
behavioral1/memory/1424-102-0x00000000006D0000-0x00000000008A5000-memory.dmp	autoit_exe
behavioral1/memory/1424-109-0x00000000006F800A-mapping.dmp	autoit_exe
behavioral1/memory/1424-111-0x00000000006D0000-0x00000000008A5000-memory.dmp	autoit_exe
behavioral1/memory/1708-116-0x0000000000710000-0x00000000008E5000-memory.dmp	autoit_exe
behavioral1/memory/1708-123-0x000000000073800A-mapping.dmp	autoit_exe
behavioral1/memory/1708-125-0x0000000000710000-0x00000000008E5000-memory.dmp	autoit_exe

Drops file in System32 directory 2 IoCs

Processes:

cryptdlg.execryptdlg.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\winmgmts:\localhost\	cryptdlg.exe
File opened for modification	C:\Windows\SysWOW64\winmgmts:\localhost\	cryptdlg.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

19bb7a034d6d884ee350df147940446783b5b71e4a52ea54cd98f33ec411d9ee.execryptdlg.execryptdlg.execryptdlg.exe

description	pid	process	target process
PID 960 set thread context of 1184	960	19bb7a034d6d884ee350df147940446783b5b71e4a52ea54cd98f33ec411d9ee.exe	19bb7a034d6d884ee350df147940446783b5b71e4a52ea54cd98f33ec411d9ee.exe
PID 1900 set thread context of 1980	1900	cryptdlg.exe	cryptdlg.exe
PID 964 set thread context of 1424	964	cryptdlg.exe	cryptdlg.exe
PID 1984 set thread context of 1708	1984	cryptdlg.exe	cryptdlg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NTFS ADS 2 IoCs

Processes:

cryptdlg.exe19bb7a034d6d884ee350df147940446783b5b71e4a52ea54cd98f33ec411d9ee.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-naturallanguage6-0022\winmgmts:\localhost\	cryptdlg.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\winmgmts:\localhost\	19bb7a034d6d884ee350df147940446783b5b71e4a52ea54cd98f33ec411d9ee.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

cryptdlg.exe

pid process

1980 cryptdlg.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

19bb7a034d6d884ee350df147940446783b5b71e4a52ea54cd98f33ec411d9ee.exe

pid process

1184 19bb7a034d6d884ee350df147940446783b5b71e4a52ea54cd98f33ec411d9ee.exe

pid	process
1980	cryptdlg.exe

pid	process
1184	19bb7a034d6d884ee350df147940446783b5b71e4a52ea54cd98f33ec411d9ee.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

cryptdlg.module.exe

description	pid	process
Token: SeRestorePrivilege	1200	cryptdlg.module.exe
Token: 35	1200	cryptdlg.module.exe
Token: SeSecurityPrivilege	1200	cryptdlg.module.exe
Token: SeSecurityPrivilege	1200	cryptdlg.module.exe

Suspicious use of FindShellTrayWindow 12 IoCs

Processes:

19bb7a034d6d884ee350df147940446783b5b71e4a52ea54cd98f33ec411d9ee.execryptdlg.execryptdlg.execryptdlg.exe

pid	process
960	19bb7a034d6d884ee350df147940446783b5b71e4a52ea54cd98f33ec411d9ee.exe
960	19bb7a034d6d884ee350df147940446783b5b71e4a52ea54cd98f33ec411d9ee.exe
960	19bb7a034d6d884ee350df147940446783b5b71e4a52ea54cd98f33ec411d9ee.exe
1900	cryptdlg.exe
1900	cryptdlg.exe
1900	cryptdlg.exe
964	cryptdlg.exe
964	cryptdlg.exe
964	cryptdlg.exe
1984	cryptdlg.exe
1984	cryptdlg.exe
1984	cryptdlg.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

19bb7a034d6d884ee350df147940446783b5b71e4a52ea54cd98f33ec411d9ee.execryptdlg.execryptdlg.execryptdlg.exe

pid	process
960	19bb7a034d6d884ee350df147940446783b5b71e4a52ea54cd98f33ec411d9ee.exe
960	19bb7a034d6d884ee350df147940446783b5b71e4a52ea54cd98f33ec411d9ee.exe
960	19bb7a034d6d884ee350df147940446783b5b71e4a52ea54cd98f33ec411d9ee.exe
1900	cryptdlg.exe
1900	cryptdlg.exe
1900	cryptdlg.exe
964	cryptdlg.exe
964	cryptdlg.exe
964	cryptdlg.exe
1984	cryptdlg.exe
1984	cryptdlg.exe
1984	cryptdlg.exe

Suspicious use of WriteProcessMemory 44 IoCs

Processes:

19bb7a034d6d884ee350df147940446783b5b71e4a52ea54cd98f33ec411d9ee.exe19bb7a034d6d884ee350df147940446783b5b71e4a52ea54cd98f33ec411d9ee.execryptdlg.execryptdlg.exetaskeng.execryptdlg.execryptdlg.exe

description	pid	process	target process
PID 960 wrote to memory of 1184	960	19bb7a034d6d884ee350df147940446783b5b71e4a52ea54cd98f33ec411d9ee.exe	19bb7a034d6d884ee350df147940446783b5b71e4a52ea54cd98f33ec411d9ee.exe
PID 960 wrote to memory of 1184	960	19bb7a034d6d884ee350df147940446783b5b71e4a52ea54cd98f33ec411d9ee.exe	19bb7a034d6d884ee350df147940446783b5b71e4a52ea54cd98f33ec411d9ee.exe
PID 960 wrote to memory of 1184	960	19bb7a034d6d884ee350df147940446783b5b71e4a52ea54cd98f33ec411d9ee.exe	19bb7a034d6d884ee350df147940446783b5b71e4a52ea54cd98f33ec411d9ee.exe
PID 960 wrote to memory of 1184	960	19bb7a034d6d884ee350df147940446783b5b71e4a52ea54cd98f33ec411d9ee.exe	19bb7a034d6d884ee350df147940446783b5b71e4a52ea54cd98f33ec411d9ee.exe
PID 960 wrote to memory of 1184	960	19bb7a034d6d884ee350df147940446783b5b71e4a52ea54cd98f33ec411d9ee.exe	19bb7a034d6d884ee350df147940446783b5b71e4a52ea54cd98f33ec411d9ee.exe
PID 960 wrote to memory of 1184	960	19bb7a034d6d884ee350df147940446783b5b71e4a52ea54cd98f33ec411d9ee.exe	19bb7a034d6d884ee350df147940446783b5b71e4a52ea54cd98f33ec411d9ee.exe
PID 1184 wrote to memory of 1900	1184	19bb7a034d6d884ee350df147940446783b5b71e4a52ea54cd98f33ec411d9ee.exe	cryptdlg.exe
PID 1184 wrote to memory of 1900	1184	19bb7a034d6d884ee350df147940446783b5b71e4a52ea54cd98f33ec411d9ee.exe	cryptdlg.exe
PID 1184 wrote to memory of 1900	1184	19bb7a034d6d884ee350df147940446783b5b71e4a52ea54cd98f33ec411d9ee.exe	cryptdlg.exe
PID 1184 wrote to memory of 1900	1184	19bb7a034d6d884ee350df147940446783b5b71e4a52ea54cd98f33ec411d9ee.exe	cryptdlg.exe
PID 1900 wrote to memory of 1980	1900	cryptdlg.exe	cryptdlg.exe
PID 1900 wrote to memory of 1980	1900	cryptdlg.exe	cryptdlg.exe
PID 1900 wrote to memory of 1980	1900	cryptdlg.exe	cryptdlg.exe
PID 1900 wrote to memory of 1980	1900	cryptdlg.exe	cryptdlg.exe
PID 1900 wrote to memory of 1980	1900	cryptdlg.exe	cryptdlg.exe
PID 1900 wrote to memory of 1980	1900	cryptdlg.exe	cryptdlg.exe
PID 1980 wrote to memory of 1200	1980	cryptdlg.exe	cryptdlg.module.exe
PID 1980 wrote to memory of 1200	1980	cryptdlg.exe	cryptdlg.module.exe
PID 1980 wrote to memory of 1200	1980	cryptdlg.exe	cryptdlg.module.exe
PID 1980 wrote to memory of 1200	1980	cryptdlg.exe	cryptdlg.module.exe
PID 1980 wrote to memory of 852	1980	cryptdlg.exe	attrib.exe
PID 1980 wrote to memory of 852	1980	cryptdlg.exe	attrib.exe
PID 1980 wrote to memory of 852	1980	cryptdlg.exe	attrib.exe
PID 1980 wrote to memory of 852	1980	cryptdlg.exe	attrib.exe
PID 1148 wrote to memory of 964	1148	taskeng.exe	cryptdlg.exe
PID 1148 wrote to memory of 964	1148	taskeng.exe	cryptdlg.exe
PID 1148 wrote to memory of 964	1148	taskeng.exe	cryptdlg.exe
PID 1148 wrote to memory of 964	1148	taskeng.exe	cryptdlg.exe
PID 964 wrote to memory of 1424	964	cryptdlg.exe	cryptdlg.exe
PID 964 wrote to memory of 1424	964	cryptdlg.exe	cryptdlg.exe
PID 964 wrote to memory of 1424	964	cryptdlg.exe	cryptdlg.exe
PID 964 wrote to memory of 1424	964	cryptdlg.exe	cryptdlg.exe
PID 964 wrote to memory of 1424	964	cryptdlg.exe	cryptdlg.exe
PID 964 wrote to memory of 1424	964	cryptdlg.exe	cryptdlg.exe
PID 1148 wrote to memory of 1984	1148	taskeng.exe	cryptdlg.exe
PID 1148 wrote to memory of 1984	1148	taskeng.exe	cryptdlg.exe
PID 1148 wrote to memory of 1984	1148	taskeng.exe	cryptdlg.exe
PID 1148 wrote to memory of 1984	1148	taskeng.exe	cryptdlg.exe
PID 1984 wrote to memory of 1708	1984	cryptdlg.exe	cryptdlg.exe
PID 1984 wrote to memory of 1708	1984	cryptdlg.exe	cryptdlg.exe
PID 1984 wrote to memory of 1708	1984	cryptdlg.exe	cryptdlg.exe
PID 1984 wrote to memory of 1708	1984	cryptdlg.exe	cryptdlg.exe
PID 1984 wrote to memory of 1708	1984	cryptdlg.exe	cryptdlg.exe
PID 1984 wrote to memory of 1708	1984	cryptdlg.exe	cryptdlg.exe

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exe

pid process

852 attrib.exe

pid	process
852	attrib.exe

C:\Users\Admin\AppData\Local\Temp\19bb7a034d6d884ee350df147940446783b5b71e4a52ea54cd98f33ec411d9ee.exe
"C:\Users\Admin\AppData\Local\Temp\19bb7a034d6d884ee350df147940446783b5b71e4a52ea54cd98f33ec411d9ee.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:960
- C:\Users\Admin\AppData\Local\Temp\19bb7a034d6d884ee350df147940446783b5b71e4a52ea54cd98f33ec411d9ee.exe
  "C:\Users\Admin\AppData\Local\Temp\19bb7a034d6d884ee350df147940446783b5b71e4a52ea54cd98f33ec411d9ee.exe"
  2⤵
  - NTFS ADS
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:1184
- - C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-naturallanguage6-0022\cryptdlg.exe
    C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-naturallanguage6-0022\cryptdlg.exe
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1900
  - - C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-naturallanguage6-0022\cryptdlg.exe
      "C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-naturallanguage6-0022\cryptdlg.exe"
      4⤵
      Loads dropped DLL
      NTFS ADS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1980
    - - C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-naturallanguage6-0022\cryptdlg.module.exe
        
        C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-naturallanguage6-0022\cryptdlg.module.exe a -y -mx9 -ssw "C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-naturallanguage6-0022\ENU_687FE978D73A864E9D41.7z" "C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-naturallanguage6-0022\1\*"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1200
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-naturallanguage6-0022"
        5⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:852

C:\Windows\system32\taskeng.exe
taskeng.exe {305952F0-46A7-44DA-B9E3-7388D83B1678} S-1-5-21-790309383-526510583-3802439154-1000:TVHJCWMH\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1148
- C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-naturallanguage6-0022\cryptdlg.exe
  C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-naturallanguage6-0022\cryptdlg.exe
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:964
- - C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-naturallanguage6-0022\cryptdlg.exe
    "C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-naturallanguage6-0022\cryptdlg.exe"
    3⤵
    - Drops file in System32 directory
    PID:1424
- C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-naturallanguage6-0022\cryptdlg.exe
  C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-naturallanguage6-0022\cryptdlg.exe
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1984
- - C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-naturallanguage6-0022\cryptdlg.exe
    "C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-naturallanguage6-0022\cryptdlg.exe"
    3⤵
    - Drops file in System32 directory
    PID:1708

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

2

T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

2

T1158

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-naturallanguage6-0022\1\Information.txt

Filesize
3KB

MD5
5becf908ce9ea4d2c7c647853735e008

SHA1
b5e57e8f15dd8009540a222fc1cebc2e83e21f8f

SHA256
640ee70760eae7388729735270c76bff183e43af65b82b5724b19d0487624b95

SHA512
f1797df06b96f37e3629f5117cdcb127b4688a96520f5c644b00d8dd0b05c046ef7bef1b1068264094596a6c9f0a842cda24f2b03fc9e41acab6b05bda61d375

Download Submit
C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-naturallanguage6-0022\1\Screen.jpg

Filesize
50KB

MD5
0e636605595362b0107c202245dae1c1

SHA1
197c23b52191e42659b64f5f357e1a34184b2c41

SHA256
726dc1b7759e9bc40e549fb50321fe4ac4e514c47ceef05bbc6d04f264c5c3e5

SHA512
1b2c073404728769a63f54e435362e0bb77d97dc3225ee750796d0ac6064c95d5e7a3777963df0353667a1504f974d667684e6ee73b47bbc38eac7fcfab10589

Download Submit
C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-naturallanguage6-0022\cryptdlg.module.exe

Filesize
197KB

MD5
946285055913d457fda78a4484266e96

SHA1
668661955bf3c20b9dc8cdaa7ec6e8dbbbd63285

SHA256
23ca34a7d22fdb7d36014928c089c982cdfb903e9143aea60d38f228c9594beb

SHA512
30a490b774d5736215b340d3a192825dc1dfbb7c8d9974c8ab2a09eff2429ed7cf99969ec6d651c8056549798da092ffa600681288dbd7c6f60515acd3630d95

Download Submit
\Users\Admin\AppData\Roaming\x86_microsoft-windows-naturallanguage6-0022\cryptdlg.module.exe

Filesize
197KB

MD5
946285055913d457fda78a4484266e96

SHA1
668661955bf3c20b9dc8cdaa7ec6e8dbbbd63285

SHA256
23ca34a7d22fdb7d36014928c089c982cdfb903e9143aea60d38f228c9594beb

SHA512
30a490b774d5736215b340d3a192825dc1dfbb7c8d9974c8ab2a09eff2429ed7cf99969ec6d651c8056549798da092ffa600681288dbd7c6f60515acd3630d95

Download Submit
\Users\Admin\AppData\Roaming\x86_microsoft-windows-naturallanguage6-0022\cryptdlg.module.exe

Filesize
197KB

MD5
946285055913d457fda78a4484266e96

SHA1
668661955bf3c20b9dc8cdaa7ec6e8dbbbd63285

SHA256
23ca34a7d22fdb7d36014928c089c982cdfb903e9143aea60d38f228c9594beb

SHA512
30a490b774d5736215b340d3a192825dc1dfbb7c8d9974c8ab2a09eff2429ed7cf99969ec6d651c8056549798da092ffa600681288dbd7c6f60515acd3630d95

Download Submit
\Users\Admin\AppData\Roaming\x86_microsoft-windows-naturallanguage6-0022\cryptdlg.sqlite3.module.dll

Filesize
360KB

MD5
8c127ce55bfbb55eb9a843c693c9f240

SHA1
75c462c935a7ff2c90030c684440d61d48bb1858

SHA256
4f93f3543139febb91e0c95dc9351008e9147a484732ee5962c7df64f6868028

SHA512
d3578bd7ef01f9e25983c24eb9bb33f25c37d650cc79b823c3ec19f196d4a00deb506c1e1f774f15e5664d5263b02570fec11b322022b90a0ff1b10943188a02

Download Submit
\Users\Admin\AppData\Roaming\x86_microsoft-windows-naturallanguage6-0022\cryptdlg.sqlite3.module.dll

Filesize
360KB

MD5
8c127ce55bfbb55eb9a843c693c9f240

SHA1
75c462c935a7ff2c90030c684440d61d48bb1858

SHA256
4f93f3543139febb91e0c95dc9351008e9147a484732ee5962c7df64f6868028

SHA512
d3578bd7ef01f9e25983c24eb9bb33f25c37d650cc79b823c3ec19f196d4a00deb506c1e1f774f15e5664d5263b02570fec11b322022b90a0ff1b10943188a02

Download Submit
memory/852-94-0x0000000000000000-mapping.dmp

Download
memory/960-54-0x0000000074DC1000-0x0000000074DC3000-memory.dmp

Filesize
8KB

Download
memory/964-98-0x0000000000000000-mapping.dmp

Download
memory/1184-57-0x0000000000670000-0x0000000000845000-memory.dmp

Filesize
1.8MB

Download
memory/1184-66-0x0000000000670000-0x0000000000845000-memory.dmp

Filesize
1.8MB

Download
memory/1184-64-0x000000000069800A-mapping.dmp

Download
memory/1184-55-0x0000000000670000-0x0000000000845000-memory.dmp

Filesize
1.8MB

Download
memory/1200-87-0x0000000000000000-mapping.dmp

Download
memory/1200-91-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download
memory/1424-111-0x00000000006D0000-0x00000000008A5000-memory.dmp

Filesize
1.8MB

Download
memory/1424-109-0x00000000006F800A-mapping.dmp

Download
memory/1424-102-0x00000000006D0000-0x00000000008A5000-memory.dmp

Filesize
1.8MB

Download
memory/1708-116-0x0000000000710000-0x00000000008E5000-memory.dmp

Filesize
1.8MB

Download
memory/1708-125-0x0000000000710000-0x00000000008E5000-memory.dmp

Filesize
1.8MB

Download
memory/1708-123-0x000000000073800A-mapping.dmp

Download
memory/1900-67-0x0000000000000000-mapping.dmp

Download
memory/1980-78-0x00000000005D800A-mapping.dmp

Download
memory/1980-95-0x0000000061E00000-0x0000000061ED2000-memory.dmp

Filesize
840KB

Download
memory/1980-96-0x0000000061E00000-0x0000000061ED2000-memory.dmp

Filesize
840KB

Download
memory/1980-97-0x0000000002C80000-0x0000000002CFD000-memory.dmp

Filesize
500KB

Download
memory/1980-93-0x0000000002C80000-0x0000000002CFD000-memory.dmp

Filesize
500KB

Download
memory/1980-92-0x0000000002C80000-0x0000000002CFD000-memory.dmp

Filesize
500KB

Download
memory/1980-84-0x0000000061E00000-0x0000000061ED2000-memory.dmp

Filesize
840KB

Download
memory/1980-83-0x0000000061E00000-0x0000000061ED2000-memory.dmp

Filesize
840KB

Download
memory/1980-80-0x00000000005B0000-0x0000000000785000-memory.dmp

Filesize
1.8MB

Download
memory/1980-73-0x00000000005B0000-0x0000000000785000-memory.dmp

Filesize
1.8MB

Download
memory/1980-72-0x00000000005B1000-0x000000000063F000-memory.dmp

Filesize
568KB

Download
memory/1984-112-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads