qulab | 2286c65c1d15837f5568a91ca8000d2be89001123a842533258d5df16ca366e6

General

Target

2286c65c1d15837f5568a91ca8000d2be89001123a842533258d5df16ca366e6.exe
Size

1.5MB
MD5

bb93c65b8447626f0f49c13b3b876016
SHA1

b0a87001381a50d62396a0f39e055b072141e631
SHA256

2286c65c1d15837f5568a91ca8000d2be89001123a842533258d5df16ca366e6
SHA512

d482c6800fb77753c168db6528b61b727c4589e811347f13f3f2ae2c641168946da4f330f9d75606a575a886844513f7dcc30921bcfe6ac1575fbf9b3a122ac5

Score

10^/10

qulab discovery ransomware spyware stealer upx

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-i..er-engine.resources\1\Information.txt

Family

qulab

Ransom Note

# /===============================\ # |=== QULAB CLIPPER + STEALER ===| # |===============================| # |==== BUY CLIPPER + STEALER ====| # |=== http://teleg.run/QulabZ ===| # \===============================/ Date: 12.06.2022, 10:16:34 Main Information: - OS: Windows 10 x64 / Build: 19041 - UserName: Admin - ComputerName: TLWHJTYB - VideoCard: Microsoft Basic Display Adapter - Processor: Intel Core Processor (Broadwell) - Memory: 4.00 Gb - KeyBoard Layout ID: 00000409 - Resolution: 1280x720x32, 64 GHz Other Information: <error> Soft / Windows Components / Windows Updates: - Google Chrome - Microsoft Edge - Microsoft Edge Update - Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 - Java Auto Updater - Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.30.30704 - Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.30.30704 - Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.40660 - Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.40660 - Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 - Adobe Acrobat Reader DC - Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 - Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 - Microsoft Visual C++ 2022 X86 Additional Runtime - 14.30.30704 - Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 - Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.40660 - Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.40660 - Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 - Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.30.30704 Process List: - [System Process] / PID: 0 - System / PID: 4 - Registry / PID: 92 - smss.exe / PID: 356 - csrss.exe / PID: 440 - wininit.exe / PID: 532 - csrss.exe / PID: 548 - winlogon.exe / PID: 628 - services.exe / PID: 672 - lsass.exe / PID: 680 - fontdrvhost.exe / PID: 796 - fontdrvhost.exe / PID: 804 - svchost.exe / PID: 812 - svchost.exe / PID: 912 - svchost.exe / PID: 968 - dwm.exe / PID: 332 - svchost.exe / PID: 528 - svchost.exe / PID: 884 - svchost.exe / PID: 932 - svchost.exe / PID: 1052 - svchost.exe / PID: 1060 - svchost.exe / PID: 1156 - svchost.exe / PID: 1192 - svchost.exe / PID: 1228 - svchost.exe / PID: 1240 - svchost.exe / PID: 1336 - svchost.exe / PID: 1356 - svchost.exe / PID: 1380 - svchost.exe / PID: 1408 - svchost.exe / PID: 1520 - svchost.exe / PID: 1544 - svchost.exe / PID: 1632 - svchost.exe / PID: 1640 - svchost.exe / PID: 1712 - svchost.exe / PID: 1780 - svchost.exe / PID: 1804 - svchost.exe / PID: 1912 - svchost.exe / PID: 1940 - svchost.exe / PID: 1980 - svchost.exe / PID: 2020 - spoolsv.exe / PID: 1696 - svchost.exe / PID: 2072 - svchost.exe / PID: 2080 - svchost.exe / PID: 2168 - svchost.exe / PID: 2316 - svchost.exe / PID: 2324 - sihost.exe / PID: 2468 - OfficeClickToRun.exe / PID: 2476 - svchost.exe / PID: 2496 - svchost.exe / PID: 2536 - svchost.exe / PID: 2548 - svchost.exe / PID: 2592 - svchost.exe / PID: 2608 - svchost.exe / PID: 2616 - svchost.exe / PID: 2688 - taskhostw.exe / PID: 2720 - explorer.exe / PID: 2560 - svchost.exe / PID: 3032 - dllhost.exe / PID: 3264 - StartMenuExperienceHost.exe / PID: 3364 - RuntimeBroker.exe / PID: 3432 - SearchApp.exe / PID: 3520 - RuntimeBroker.exe / PID: 3660 - dllhost.exe / PID: 1896 - svchost.exe / PID: 4232 - sppsvc.exe / PID: 5096 - svchost.exe / PID: 4304 - svchost.exe / PID: 4436 - svchost.exe / PID: 2336 - WmiPrvSE.exe / PID: 4880 - SppExtComObj.Exe / PID: 2640 - svchost.exe / PID: 460 - svchost.exe / PID: 3868 - svchost.exe / PID: 4240 - upfc.exe / PID: 3400 - svchost.exe / PID: 3076 - SndVolSSO.exe / PID: 2068

URLs

http://teleg.run/QulabZ

Signatures

Qulab Stealer & Clipper
Infostealer and clipper created with AutoIt.
stealer qulab

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-i..er-engine.resources\SndVolSSO.sqlite3.module.dll	acprotect
C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-i..er-engine.resources\SndVolSSO.sqlite3.module.dll	acprotect

Executes dropped EXE 1 IoCs

Processes:

SndVolSSO.module.exe

pid process

2228 SndVolSSO.module.exe

pid	process
2228	SndVolSSO.module.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-i..er-engine.resources\SndVolSSO.sqlite3.module.dll	upx
C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-i..er-engine.resources\SndVolSSO.sqlite3.module.dll	upx
C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-i..er-engine.resources\SndVolSSO.module.exe	upx
behavioral2/memory/2228-139-0x0000000000400000-0x000000000048E000-memory.dmp	upx
behavioral2/memory/2228-142-0x0000000000400000-0x000000000048E000-memory.dmp	upx

Loads dropped DLL 2 IoCs

Processes:

SndVolSSO.exe

pid process

2068 SndVolSSO.exe
2068 SndVolSSO.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

14 ipapi.co
19 ipapi.co

pid	process
2068	SndVolSSO.exe
2068	SndVolSSO.exe

flow	ioc
14	ipapi.co
19	ipapi.co

Drops file in System32 directory 2 IoCs

Processes:

SndVolSSO.exeSndVolSSO.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\winmgmts:\localhost\	SndVolSSO.exe
File opened for modification	C:\Windows\SysWOW64\winmgmts:\localhost\	SndVolSSO.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NTFS ADS 2 IoCs

Processes:

2286c65c1d15837f5568a91ca8000d2be89001123a842533258d5df16ca366e6.exeSndVolSSO.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\winmgmts:\localhost\	2286c65c1d15837f5568a91ca8000d2be89001123a842533258d5df16ca366e6.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-i..er-engine.resources\winmgmts:\localhost\	SndVolSSO.exe

Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.

Processes:

description flow ioc

HTTP User-Agent header 55 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

SndVolSSO.exe

pid process

2068 SndVolSSO.exe
2068 SndVolSSO.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

2286c65c1d15837f5568a91ca8000d2be89001123a842533258d5df16ca366e6.exe

pid process

3064 2286c65c1d15837f5568a91ca8000d2be89001123a842533258d5df16ca366e6.exe

description	flow	ioc
HTTP User-Agent header	55	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

pid	process
2068	SndVolSSO.exe
2068	SndVolSSO.exe

pid	process
3064	2286c65c1d15837f5568a91ca8000d2be89001123a842533258d5df16ca366e6.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

SndVolSSO.module.exe

description	pid	process
Token: SeRestorePrivilege	2228	SndVolSSO.module.exe
Token: 35	2228	SndVolSSO.module.exe
Token: SeSecurityPrivilege	2228	SndVolSSO.module.exe
Token: SeSecurityPrivilege	2228	SndVolSSO.module.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

2286c65c1d15837f5568a91ca8000d2be89001123a842533258d5df16ca366e6.exeSndVolSSO.exe

description	pid	process	target process
PID 3064 wrote to memory of 2068	3064	2286c65c1d15837f5568a91ca8000d2be89001123a842533258d5df16ca366e6.exe	SndVolSSO.exe
PID 3064 wrote to memory of 2068	3064	2286c65c1d15837f5568a91ca8000d2be89001123a842533258d5df16ca366e6.exe	SndVolSSO.exe
PID 3064 wrote to memory of 2068	3064	2286c65c1d15837f5568a91ca8000d2be89001123a842533258d5df16ca366e6.exe	SndVolSSO.exe
PID 2068 wrote to memory of 2228	2068	SndVolSSO.exe	SndVolSSO.module.exe
PID 2068 wrote to memory of 2228	2068	SndVolSSO.exe	SndVolSSO.module.exe
PID 2068 wrote to memory of 2228	2068	SndVolSSO.exe	SndVolSSO.module.exe

C:\Users\Admin\AppData\Local\Temp\2286c65c1d15837f5568a91ca8000d2be89001123a842533258d5df16ca366e6.exe
"C:\Users\Admin\AppData\Local\Temp\2286c65c1d15837f5568a91ca8000d2be89001123a842533258d5df16ca366e6.exe"
1⤵
- NTFS ADS
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-i..er-engine.resources\SndVolSSO.exe
  C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-i..er-engine.resources\SndVolSSO.exe
  2⤵
  - Loads dropped DLL
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2068
- - C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-i..er-engine.resources\SndVolSSO.module.exe
    C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-i..er-engine.resources\SndVolSSO.module.exe a -y -mx9 -ssw "C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-i..er-engine.resources\ENU_801FE97294A87C4E9D41.7z" "C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-i..er-engine.resources\1\*"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2228

C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-i..er-engine.resources\SndVolSSO.exe
C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-i..er-engine.resources\SndVolSSO.exe
1⤵
- Drops file in System32 directory
PID:4972

C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-i..er-engine.resources\SndVolSSO.exe
C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-i..er-engine.resources\SndVolSSO.exe
1⤵
- Drops file in System32 directory
PID:4172

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-i..er-engine.resources\1\Information.txt

Filesize
3KB

MD5
cd7a85bd393ed477e0fca3c15af0e2b4

SHA1
16b6c38797c6dffb58d33a7bf55e212cc7e5603c

SHA256
b9203240393263b03f01de46e2976e0d1df1350cf8907b6bc93e0e582a75f1eb

SHA512
c9159db2975333a8cd6c0d4431c9bb40b03c54c0539d37c1daf8025e395ea65e9488b7c0a077d8e7d9ae71bddf349da7a80a0a241140e2ca687f5febeea5fa1c

Download Submit
C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-i..er-engine.resources\1\Screen.jpg

Filesize
46KB

MD5
bccbf126462288a152b86e062cbefe1d

SHA1
9d5225596957c534bb3fa6825b1f04bc50d84820

SHA256
b7af541066ecc833b36ef75cb7d6a3796a075f674df3f8db0e0dab5fc945e2af

SHA512
76c22283e239af81db86cac5d9cc4e0b0f861104918ec53377522e38a56042c187fdb6cbc970a083109f4b93d1fe35b68a55ddcd96419dad2e13a61be18dc341

Download Submit
C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-i..er-engine.resources\SndVolSSO.module.exe

Filesize
218KB

MD5
9c5b4e4fcae7eb410f09c9e46ffb4a6d

SHA1
9d233bbe69676b1064f1deafba8e70a9acc00773

SHA256
0376139308f3e83a73b76d3938d9c100779a83b98eeb3b3ebacfcbd1cc027fe9

SHA512
59c35d730dc17e790aa4c89f82fd2f64b4d67405c2bdf21d4a9757fa8bfb64461f1247c9da482b310b117f1a24144bf6c612c9f7587577b7a286e2e3de724ee5

Download Submit
C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-i..er-engine.resources\SndVolSSO.sqlite3.module.dll

Filesize
359KB

MD5
a6e1b13b0b624094e6fb3a7bedb70930

SHA1
84b58920afd8e88181c4286fa2438af81f097781

SHA256
3b266088e1eb148534a8f95610e07749f7254f29d19f6f6686a1f0c85c9241bd

SHA512
26c2dffb44b7b0c2eb6e8fde7d5c6dce118af14971552bedeb131436f53edd28da98af8cf219bb7814cf4563624638cf73c7017fc3936b5112ff9f8c43f11591

Download Submit
C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-i..er-engine.resources\SndVolSSO.sqlite3.module.dll

Filesize
359KB

MD5
a6e1b13b0b624094e6fb3a7bedb70930

SHA1
84b58920afd8e88181c4286fa2438af81f097781

SHA256
3b266088e1eb148534a8f95610e07749f7254f29d19f6f6686a1f0c85c9241bd

SHA512
26c2dffb44b7b0c2eb6e8fde7d5c6dce118af14971552bedeb131436f53edd28da98af8cf219bb7814cf4563624638cf73c7017fc3936b5112ff9f8c43f11591

Download Submit
memory/2068-136-0x0000000061E00000-0x0000000061ED1000-memory.dmp

Filesize
836KB

Download
memory/2068-130-0x0000000000000000-mapping.dmp

Download
memory/2068-135-0x0000000061E00000-0x0000000061ED1000-memory.dmp

Filesize
836KB

Download
memory/2068-134-0x0000000061E00000-0x0000000061ED1000-memory.dmp

Filesize
836KB

Download
memory/2068-133-0x0000000061E00000-0x0000000061ED1000-memory.dmp

Filesize
836KB

Download
memory/2228-137-0x0000000000000000-mapping.dmp

Download
memory/2228-139-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/2228-142-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads