Malware Analysis Report

2024-09-23 04:54

Sample ID 220616-hgrf5saah5
Target 26f74094da97889dce937502510a764403abc38f383ed94ee9acced4bb1d4927
SHA256 26f74094da97889dce937502510a764403abc38f383ed94ee9acced4bb1d4927
Tags
qulab discovery evasion ransomware spyware stealer upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

26f74094da97889dce937502510a764403abc38f383ed94ee9acced4bb1d4927

Threat Level: Known bad

The file 26f74094da97889dce937502510a764403abc38f383ed94ee9acced4bb1d4927 was found to be: Known bad.

Malicious Activity Summary

qulab discovery evasion ransomware spyware stealer upx

Qulab Stealer & Clipper

ACProtect 1.3x - 1.4x DLL software

Sets file to hidden

UPX packed file

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Checks installed software on the system

Looks up external IP address via web service

Accesses cryptocurrency files/wallets, possible credential harvesting

AutoIT Executable

Drops file in System32 directory

Enumerates physical storage devices

Views/modifies file attributes

Suspicious use of WriteProcessMemory

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

NTFS ADS

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK Matrix V6

Analysis: static1

Detonation Overview

Reported

2022-06-16 06:42

Signatures

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-06-16 06:42

Reported

2022-06-16 08:00

Platform

win7-20220414-en

Max time kernel

123s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\26f74094da97889dce937502510a764403abc38f383ed94ee9acced4bb1d4927.exe"

Signatures

Qulab Stealer & Clipper

stealer qulab

ACProtect 1.3x - 1.4x DLL software

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.module.exe N/A

Sets file to hidden

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Checks installed software on the system

discovery

Looks up external IP address via web service

Description Indicator Process Target
N/A ipapi.co N/A N/A
N/A ipapi.co N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\winmgmts:\localhost\ C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe N/A
File opened for modification C:\Windows\SysWOW64\winmgmts:\localhost\ C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe N/A

Enumerates physical storage devices

NTFS ADS

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Local\Temp\winmgmts:\localhost\ C:\Users\Admin\AppData\Local\Temp\26f74094da97889dce937502510a764403abc38f383ed94ee9acced4bb1d4927.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\winmgmts:\localhost\ C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe N/A

Suspicious behavior: RenamesItself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\26f74094da97889dce937502510a764403abc38f383ed94ee9acced4bb1d4927.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1708 wrote to memory of 1788 N/A C:\Users\Admin\AppData\Local\Temp\26f74094da97889dce937502510a764403abc38f383ed94ee9acced4bb1d4927.exe C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe
PID 1708 wrote to memory of 1788 N/A C:\Users\Admin\AppData\Local\Temp\26f74094da97889dce937502510a764403abc38f383ed94ee9acced4bb1d4927.exe C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe
PID 1708 wrote to memory of 1788 N/A C:\Users\Admin\AppData\Local\Temp\26f74094da97889dce937502510a764403abc38f383ed94ee9acced4bb1d4927.exe C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe
PID 1708 wrote to memory of 1788 N/A C:\Users\Admin\AppData\Local\Temp\26f74094da97889dce937502510a764403abc38f383ed94ee9acced4bb1d4927.exe C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe
PID 1788 wrote to memory of 884 N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.module.exe
PID 1788 wrote to memory of 884 N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.module.exe
PID 1788 wrote to memory of 884 N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.module.exe
PID 1788 wrote to memory of 884 N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.module.exe
PID 1788 wrote to memory of 1292 N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe C:\Windows\SysWOW64\attrib.exe
PID 1788 wrote to memory of 1292 N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe C:\Windows\SysWOW64\attrib.exe
PID 1788 wrote to memory of 1292 N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe C:\Windows\SysWOW64\attrib.exe
PID 1788 wrote to memory of 1292 N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe C:\Windows\SysWOW64\attrib.exe
PID 272 wrote to memory of 1740 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe
PID 272 wrote to memory of 1740 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe
PID 272 wrote to memory of 1740 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe
PID 272 wrote to memory of 1740 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe
PID 272 wrote to memory of 1944 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe
PID 272 wrote to memory of 1944 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe
PID 272 wrote to memory of 1944 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe
PID 272 wrote to memory of 1944 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\26f74094da97889dce937502510a764403abc38f383ed94ee9acced4bb1d4927.exe

"C:\Users\Admin\AppData\Local\Temp\26f74094da97889dce937502510a764403abc38f383ed94ee9acced4bb1d4927.exe"

C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe

C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe

C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.module.exe

C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.module.exe a -y -mx9 -ssw "C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\ENU_687FE9737473A97E9D41.7z" "C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\1\*"

C:\Windows\SysWOW64\attrib.exe

attrib +s +h "C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources"

C:\Windows\system32\taskeng.exe

taskeng.exe {BD544D11-289B-4D65-82CD-162C38027CA9} S-1-5-21-1083475884-596052423-1669053738-1000:WYZSGDWS\Admin:Interactive:[1]

C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe

C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe

C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe

C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.telegram.org udp
US 8.8.8.8:53 ipapi.co udp
NL 149.154.167.220:443 api.telegram.org tcp
US 104.26.9.44:443 ipapi.co tcp
NL 149.154.167.220:443 api.telegram.org tcp
NL 149.154.167.220:443 api.telegram.org tcp
NL 149.154.167.220:443 api.telegram.org tcp
NL 149.154.167.220:443 api.telegram.org tcp
NL 149.154.167.220:443 api.telegram.org tcp
NL 149.154.167.220:443 api.telegram.org tcp
NL 149.154.167.220:443 api.telegram.org tcp

Files

memory/1708-54-0x0000000075A61000-0x0000000075A63000-memory.dmp

memory/1788-55-0x0000000000000000-mapping.dmp

\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.sqlite3.module.dll

MD5 8c127ce55bfbb55eb9a843c693c9f240
SHA1 75c462c935a7ff2c90030c684440d61d48bb1858
SHA256 4f93f3543139febb91e0c95dc9351008e9147a484732ee5962c7df64f6868028
SHA512 d3578bd7ef01f9e25983c24eb9bb33f25c37d650cc79b823c3ec19f196d4a00deb506c1e1f774f15e5664d5263b02570fec11b322022b90a0ff1b10943188a02

\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.sqlite3.module.dll

MD5 8c127ce55bfbb55eb9a843c693c9f240
SHA1 75c462c935a7ff2c90030c684440d61d48bb1858
SHA256 4f93f3543139febb91e0c95dc9351008e9147a484732ee5962c7df64f6868028
SHA512 d3578bd7ef01f9e25983c24eb9bb33f25c37d650cc79b823c3ec19f196d4a00deb506c1e1f774f15e5664d5263b02570fec11b322022b90a0ff1b10943188a02

memory/1788-59-0x0000000061E00000-0x0000000061ED2000-memory.dmp

memory/1788-60-0x0000000061E00000-0x0000000061ED2000-memory.dmp

\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.module.exe

MD5 946285055913d457fda78a4484266e96
SHA1 668661955bf3c20b9dc8cdaa7ec6e8dbbbd63285
SHA256 23ca34a7d22fdb7d36014928c089c982cdfb903e9143aea60d38f228c9594beb
SHA512 30a490b774d5736215b340d3a192825dc1dfbb7c8d9974c8ab2a09eff2429ed7cf99969ec6d651c8056549798da092ffa600681288dbd7c6f60515acd3630d95

memory/884-63-0x0000000000000000-mapping.dmp

\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.module.exe

MD5 946285055913d457fda78a4484266e96
SHA1 668661955bf3c20b9dc8cdaa7ec6e8dbbbd63285
SHA256 23ca34a7d22fdb7d36014928c089c982cdfb903e9143aea60d38f228c9594beb
SHA512 30a490b774d5736215b340d3a192825dc1dfbb7c8d9974c8ab2a09eff2429ed7cf99969ec6d651c8056549798da092ffa600681288dbd7c6f60515acd3630d95

C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.module.exe

MD5 946285055913d457fda78a4484266e96
SHA1 668661955bf3c20b9dc8cdaa7ec6e8dbbbd63285
SHA256 23ca34a7d22fdb7d36014928c089c982cdfb903e9143aea60d38f228c9594beb
SHA512 30a490b774d5736215b340d3a192825dc1dfbb7c8d9974c8ab2a09eff2429ed7cf99969ec6d651c8056549798da092ffa600681288dbd7c6f60515acd3630d95

C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\1\Information.txt

MD5 2a3a6440671c2e9034a60d56e9383c86
SHA1 7d4b34e69d40a6f58f8c07087d6c8ca647046cf3
SHA256 d880a9b279d24f38812b54ceee76d35d5a03faf537544f958272913204b8b89d
SHA512 b7abf5c080c074498c5ebf8801fd8b4a90c299eba7ca02cb1208575a588ef0780f36e4ddd5367673cd0c30425ae3b95f8f6fbbfb0ef417094996383fdfa68d88

C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\1\Screen.jpg

MD5 c742d3fa1ed5fe31b9af6f10f4ad9c5c
SHA1 e4415ccfeedbcc793d504e68727f6b91c609f71b
SHA256 737f3cf57af2dab385b936f202b5f1b78c5157e03ccf618e7ea1745eb1f9f08e
SHA512 8e49bba10cf194ae8f39d1db1534f3484d39dedca4efec8cdadc0d87acad4aecc7f195649aca55ed3f08d2a3cb727037192e847f03e76932a9068f1a48d41191

memory/884-67-0x0000000000400000-0x000000000047D000-memory.dmp

memory/1788-68-0x0000000061E00000-0x0000000061ED2000-memory.dmp

memory/1788-69-0x0000000003C60000-0x0000000003CDD000-memory.dmp

memory/1788-70-0x0000000003C60000-0x0000000003CDD000-memory.dmp

memory/1292-71-0x0000000000000000-mapping.dmp

memory/1788-72-0x0000000003C60000-0x0000000003CDD000-memory.dmp

memory/1788-73-0x0000000003C60000-0x0000000003CDD000-memory.dmp

memory/1740-74-0x0000000000000000-mapping.dmp

memory/1944-76-0x0000000000000000-mapping.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-06-16 06:42

Reported

2022-06-16 08:03

Platform

win10v2004-20220414-en

Max time kernel

169s

Max time network

195s

Command Line

"C:\Users\Admin\AppData\Local\Temp\26f74094da97889dce937502510a764403abc38f383ed94ee9acced4bb1d4927.exe"

Signatures

Qulab Stealer & Clipper

stealer qulab

ACProtect 1.3x - 1.4x DLL software

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.module.exe N/A

Sets file to hidden

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Checks installed software on the system

discovery

Looks up external IP address via web service

Description Indicator Process Target
N/A ipapi.co N/A N/A
N/A ipapi.co N/A N/A
N/A ipapi.co N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\winmgmts:\localhost\ C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe N/A
File opened for modification C:\Windows\SysWOW64\winmgmts:\localhost\ C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe N/A

Enumerates physical storage devices

NTFS ADS

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Local\Temp\winmgmts:\localhost\ C:\Users\Admin\AppData\Local\Temp\26f74094da97889dce937502510a764403abc38f383ed94ee9acced4bb1d4927.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\winmgmts:\localhost\ C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe N/A

Suspicious behavior: RenamesItself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\26f74094da97889dce937502510a764403abc38f383ed94ee9acced4bb1d4927.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2612 wrote to memory of 4260 N/A C:\Users\Admin\AppData\Local\Temp\26f74094da97889dce937502510a764403abc38f383ed94ee9acced4bb1d4927.exe C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe
PID 2612 wrote to memory of 4260 N/A C:\Users\Admin\AppData\Local\Temp\26f74094da97889dce937502510a764403abc38f383ed94ee9acced4bb1d4927.exe C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe
PID 2612 wrote to memory of 4260 N/A C:\Users\Admin\AppData\Local\Temp\26f74094da97889dce937502510a764403abc38f383ed94ee9acced4bb1d4927.exe C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe
PID 4260 wrote to memory of 4736 N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.module.exe
PID 4260 wrote to memory of 4736 N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.module.exe
PID 4260 wrote to memory of 4736 N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.module.exe
PID 4260 wrote to memory of 3944 N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe C:\Windows\SysWOW64\attrib.exe
PID 4260 wrote to memory of 3944 N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe C:\Windows\SysWOW64\attrib.exe
PID 4260 wrote to memory of 3944 N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe C:\Windows\SysWOW64\attrib.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\26f74094da97889dce937502510a764403abc38f383ed94ee9acced4bb1d4927.exe

"C:\Users\Admin\AppData\Local\Temp\26f74094da97889dce937502510a764403abc38f383ed94ee9acced4bb1d4927.exe"

C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe

C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe

C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe

C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe

C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.module.exe

C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.module.exe a -y -mx9 -ssw "C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\ENU_801FE97C5F89A74E9D41.7z" "C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\1\*"

C:\Windows\SysWOW64\attrib.exe

attrib +s +h "C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources"

C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe

C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe

Network

Country Destination Domain Proto
US 93.184.221.240:80 tcp
US 93.184.220.29:80 tcp
US 20.189.173.14:443 tcp
NL 104.110.191.140:80 tcp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 ipapi.co udp
US 104.26.9.44:443 ipapi.co tcp
US 8.8.8.8:53 crl.godaddy.com udp
US 192.124.249.41:80 crl.godaddy.com tcp
US 192.124.249.41:80 crl.godaddy.com tcp
US 192.124.249.36:80 crl.godaddy.com tcp
US 104.26.9.44:443 ipapi.co tcp
NL 149.154.167.220:443 api.telegram.org tcp

Files

memory/4260-130-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.sqlite3.module.dll

MD5 8c127ce55bfbb55eb9a843c693c9f240
SHA1 75c462c935a7ff2c90030c684440d61d48bb1858
SHA256 4f93f3543139febb91e0c95dc9351008e9147a484732ee5962c7df64f6868028
SHA512 d3578bd7ef01f9e25983c24eb9bb33f25c37d650cc79b823c3ec19f196d4a00deb506c1e1f774f15e5664d5263b02570fec11b322022b90a0ff1b10943188a02

C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.sqlite3.module.dll

MD5 8c127ce55bfbb55eb9a843c693c9f240
SHA1 75c462c935a7ff2c90030c684440d61d48bb1858
SHA256 4f93f3543139febb91e0c95dc9351008e9147a484732ee5962c7df64f6868028
SHA512 d3578bd7ef01f9e25983c24eb9bb33f25c37d650cc79b823c3ec19f196d4a00deb506c1e1f774f15e5664d5263b02570fec11b322022b90a0ff1b10943188a02

memory/4260-133-0x0000000061E00000-0x0000000061ED2000-memory.dmp

memory/4260-134-0x0000000061E00000-0x0000000061ED2000-memory.dmp

memory/4260-135-0x0000000061E00000-0x0000000061ED2000-memory.dmp

memory/4260-136-0x0000000061E00000-0x0000000061ED2000-memory.dmp

C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.module.exe

MD5 946285055913d457fda78a4484266e96
SHA1 668661955bf3c20b9dc8cdaa7ec6e8dbbbd63285
SHA256 23ca34a7d22fdb7d36014928c089c982cdfb903e9143aea60d38f228c9594beb
SHA512 30a490b774d5736215b340d3a192825dc1dfbb7c8d9974c8ab2a09eff2429ed7cf99969ec6d651c8056549798da092ffa600681288dbd7c6f60515acd3630d95

memory/4736-137-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.module.exe

MD5 946285055913d457fda78a4484266e96
SHA1 668661955bf3c20b9dc8cdaa7ec6e8dbbbd63285
SHA256 23ca34a7d22fdb7d36014928c089c982cdfb903e9143aea60d38f228c9594beb
SHA512 30a490b774d5736215b340d3a192825dc1dfbb7c8d9974c8ab2a09eff2429ed7cf99969ec6d651c8056549798da092ffa600681288dbd7c6f60515acd3630d95

C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\1\Information.txt

MD5 3815eafbbec957f662f6324b9d2a9563
SHA1 fa08b00941c9bae7263a847a4acd6169d9a25fdc
SHA256 6fdf82fde9b23ccf87570c6e8e205198b6af438b78a31fcc33133a8f007d6746
SHA512 75e3d11318c39801ca4671a309f4afcf0b5e28b592cfbb27995d676e25cd5dd7a5300aea82a92648f1d85fd5440c289cd4a3ecbf32843a8fcc7cb5758c7093db

C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\1\Screen.jpg

MD5 c7b2bf02883188c98b374789e66d14a8
SHA1 510ff097258c11755088ecfbf85750c6ecf7d9ef
SHA256 48ad3b8e433ea972de56223890b102a728ecb3092bca295f92f3e9c5075460b6
SHA512 1801aeaa2733eb6ae1b84eaef87aac9e8caf68c630f234f3a62324acd8934c2098bf457dec145a431265810f638ad3f6275544c7ccd9e9547300191be6d6a41c

memory/4736-142-0x0000000000400000-0x000000000047D000-memory.dmp

memory/4736-143-0x0000000000400000-0x000000000047D000-memory.dmp

memory/3944-144-0x0000000000000000-mapping.dmp