Malware Analysis Report

2024-09-23 04:45

Sample ID 220625-b23atahbhl
Target d688134cbb3f772d9da6dd8900b5ba32ae6fd356671deceee8f211a70d5595a2
SHA256 d688134cbb3f772d9da6dd8900b5ba32ae6fd356671deceee8f211a70d5595a2
Tags
qulab discovery evasion ransomware spyware stealer upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

d688134cbb3f772d9da6dd8900b5ba32ae6fd356671deceee8f211a70d5595a2

Threat Level: Known bad

The file d688134cbb3f772d9da6dd8900b5ba32ae6fd356671deceee8f211a70d5595a2 was found to be: Known bad.

Malicious Activity Summary

qulab discovery evasion ransomware spyware stealer upx

Qulab Stealer & Clipper

Identifies VirtualBox via ACPI registry values (likely anti-VM)

ACProtect 1.3x - 1.4x DLL software

Executes dropped EXE

Sets file to hidden

UPX packed file

Checks BIOS information in registry

Identifies Wine through registry keys

Reads user/profile data of web browsers

Loads dropped DLL

Looks up external IP address via web service

Checks installed software on the system

Accesses cryptocurrency files/wallets, possible credential harvesting

Suspicious use of NtSetInformationThreadHideFromDebugger

Drops file in System32 directory

AutoIT Executable

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Views/modifies file attributes

Suspicious behavior: RenamesItself

Suspicious behavior: EnumeratesProcesses

NTFS ADS

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix V6

Analysis: static1

Detonation Overview

Reported

2022-06-25 01:39

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-06-25 01:39

Reported

2022-06-25 01:42

Platform

win7-20220414-en

Max time kernel

127s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d688134cbb3f772d9da6dd8900b5ba32ae6fd356671deceee8f211a70d5595a2.exe"

Signatures

Qulab Stealer & Clipper

stealer qulab

ACProtect 1.3x - 1.4x DLL software

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\d688134cbb3f772d9da6dd8900b5ba32ae6fd356671deceee8f211a70d5595a2.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.module.exe N/A

Sets file to hidden

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\d688134cbb3f772d9da6dd8900b5ba32ae6fd356671deceee8f211a70d5595a2.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\d688134cbb3f772d9da6dd8900b5ba32ae6fd356671deceee8f211a70d5595a2.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\d688134cbb3f772d9da6dd8900b5ba32ae6fd356671deceee8f211a70d5595a2.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Wine C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Wine C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Wine C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Checks installed software on the system

discovery

Looks up external IP address via web service

Description Indicator Process Target
N/A ipapi.co N/A N/A
N/A ipapi.co N/A N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\winmgmts:\localhost\ C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe N/A
File opened for modification C:\Windows\SysWOW64\winmgmts:\localhost\ C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe N/A

Enumerates physical storage devices

NTFS ADS

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Local\Temp\winmgmts:\localhost\ C:\Users\Admin\AppData\Local\Temp\d688134cbb3f772d9da6dd8900b5ba32ae6fd356671deceee8f211a70d5595a2.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\winmgmts:\localhost\ C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe N/A

Suspicious behavior: RenamesItself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\d688134cbb3f772d9da6dd8900b5ba32ae6fd356671deceee8f211a70d5595a2.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1880 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\d688134cbb3f772d9da6dd8900b5ba32ae6fd356671deceee8f211a70d5595a2.exe C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe
PID 1880 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\d688134cbb3f772d9da6dd8900b5ba32ae6fd356671deceee8f211a70d5595a2.exe C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe
PID 1880 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\d688134cbb3f772d9da6dd8900b5ba32ae6fd356671deceee8f211a70d5595a2.exe C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe
PID 1880 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\d688134cbb3f772d9da6dd8900b5ba32ae6fd356671deceee8f211a70d5595a2.exe C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe
PID 300 wrote to memory of 1832 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe
PID 300 wrote to memory of 1832 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe
PID 300 wrote to memory of 1832 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe
PID 300 wrote to memory of 1832 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe
PID 1956 wrote to memory of 1836 N/A C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.module.exe
PID 1956 wrote to memory of 1836 N/A C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.module.exe
PID 1956 wrote to memory of 1836 N/A C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.module.exe
PID 1956 wrote to memory of 1836 N/A C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.module.exe
PID 1956 wrote to memory of 1168 N/A C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe C:\Windows\SysWOW64\attrib.exe
PID 1956 wrote to memory of 1168 N/A C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe C:\Windows\SysWOW64\attrib.exe
PID 1956 wrote to memory of 1168 N/A C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe C:\Windows\SysWOW64\attrib.exe
PID 1956 wrote to memory of 1168 N/A C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe C:\Windows\SysWOW64\attrib.exe
PID 300 wrote to memory of 1028 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe
PID 300 wrote to memory of 1028 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe
PID 300 wrote to memory of 1028 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe
PID 300 wrote to memory of 1028 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\d688134cbb3f772d9da6dd8900b5ba32ae6fd356671deceee8f211a70d5595a2.exe

"C:\Users\Admin\AppData\Local\Temp\d688134cbb3f772d9da6dd8900b5ba32ae6fd356671deceee8f211a70d5595a2.exe"

C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe

C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe

C:\Windows\system32\taskeng.exe

taskeng.exe {79F852DD-E945-4CDE-90F3-539369CA4B06} S-1-5-21-1083475884-596052423-1669053738-1000:WYZSGDWS\Admin:Interactive:[1]

C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe

C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe

C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.module.exe

C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.module.exe a -y -mx9 -ssw "C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ENU_687FE9737473A97E9D41.7z" "C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\1\*"

C:\Windows\SysWOW64\attrib.exe

attrib +s +h "C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007"

C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe

C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.telegram.org udp
US 8.8.8.8:53 ipapi.co udp
NL 149.154.167.220:443 api.telegram.org tcp
US 104.26.9.44:443 ipapi.co tcp
NL 149.154.167.220:443 api.telegram.org tcp
NL 149.154.167.220:443 api.telegram.org tcp
NL 149.154.167.220:443 api.telegram.org tcp
RU 194.67.197.197:65233 tcp
RU 194.67.197.197:65233 tcp

Files

memory/1880-54-0x00000000003E0000-0x0000000000A15000-memory.dmp

memory/1880-55-0x0000000077070000-0x00000000771F0000-memory.dmp

memory/1880-56-0x00000000755A1000-0x00000000755A3000-memory.dmp

memory/1880-57-0x00000000003E0000-0x0000000000A15000-memory.dmp

memory/1880-58-0x00000000003E0000-0x0000000000A15000-memory.dmp

memory/1880-59-0x00000000003E0000-0x0000000000A15000-memory.dmp

memory/1956-60-0x0000000000000000-mapping.dmp

memory/1880-61-0x00000000003E0000-0x0000000000A15000-memory.dmp

memory/1880-62-0x0000000077070000-0x00000000771F0000-memory.dmp

memory/1956-64-0x00000000003E0000-0x0000000000A15000-memory.dmp

\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.sqlite3.module.dll

MD5 8c127ce55bfbb55eb9a843c693c9f240
SHA1 75c462c935a7ff2c90030c684440d61d48bb1858
SHA256 4f93f3543139febb91e0c95dc9351008e9147a484732ee5962c7df64f6868028
SHA512 d3578bd7ef01f9e25983c24eb9bb33f25c37d650cc79b823c3ec19f196d4a00deb506c1e1f774f15e5664d5263b02570fec11b322022b90a0ff1b10943188a02

\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.sqlite3.module.dll

MD5 8c127ce55bfbb55eb9a843c693c9f240
SHA1 75c462c935a7ff2c90030c684440d61d48bb1858
SHA256 4f93f3543139febb91e0c95dc9351008e9147a484732ee5962c7df64f6868028
SHA512 d3578bd7ef01f9e25983c24eb9bb33f25c37d650cc79b823c3ec19f196d4a00deb506c1e1f774f15e5664d5263b02570fec11b322022b90a0ff1b10943188a02

memory/1956-67-0x0000000061E00000-0x0000000061ED2000-memory.dmp

memory/1956-68-0x0000000061E00000-0x0000000061ED2000-memory.dmp

memory/1956-69-0x00000000003E0000-0x0000000000A15000-memory.dmp

memory/1956-70-0x0000000061E00000-0x0000000061ED2000-memory.dmp

memory/1956-71-0x0000000061E00000-0x0000000061ED2000-memory.dmp

memory/1832-72-0x0000000000000000-mapping.dmp

memory/1832-74-0x00000000003E0000-0x0000000000A15000-memory.dmp

memory/1832-75-0x0000000077070000-0x00000000771F0000-memory.dmp

memory/1832-78-0x0000000077070000-0x00000000771F0000-memory.dmp

memory/1832-77-0x00000000003E0000-0x0000000000A15000-memory.dmp

memory/1832-76-0x00000000003E0000-0x0000000000A15000-memory.dmp

\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.module.exe

MD5 946285055913d457fda78a4484266e96
SHA1 668661955bf3c20b9dc8cdaa7ec6e8dbbbd63285
SHA256 23ca34a7d22fdb7d36014928c089c982cdfb903e9143aea60d38f228c9594beb
SHA512 30a490b774d5736215b340d3a192825dc1dfbb7c8d9974c8ab2a09eff2429ed7cf99969ec6d651c8056549798da092ffa600681288dbd7c6f60515acd3630d95

memory/1836-81-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.module.exe

MD5 946285055913d457fda78a4484266e96
SHA1 668661955bf3c20b9dc8cdaa7ec6e8dbbbd63285
SHA256 23ca34a7d22fdb7d36014928c089c982cdfb903e9143aea60d38f228c9594beb
SHA512 30a490b774d5736215b340d3a192825dc1dfbb7c8d9974c8ab2a09eff2429ed7cf99969ec6d651c8056549798da092ffa600681288dbd7c6f60515acd3630d95

\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.module.exe

MD5 946285055913d457fda78a4484266e96
SHA1 668661955bf3c20b9dc8cdaa7ec6e8dbbbd63285
SHA256 23ca34a7d22fdb7d36014928c089c982cdfb903e9143aea60d38f228c9594beb
SHA512 30a490b774d5736215b340d3a192825dc1dfbb7c8d9974c8ab2a09eff2429ed7cf99969ec6d651c8056549798da092ffa600681288dbd7c6f60515acd3630d95

C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\1\Screen.jpg

MD5 1709995dae67bf526bf334e3f2f8ba0b
SHA1 c0635114b31726363375b816dd4be82b89369057
SHA256 7874614cb76d1f25c7a673b1804a0723d09dd6a008e33d44a17e6c51eb4cedb8
SHA512 a56dfe290ff8bbc89ddb5cb0c68222b8c844d092d94489ead3036f5d19f4dfcfdf4f16366ad32986654eb63bcf3ff3512aaaf843b6f5d2533f2c98e839f8001d

C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\1\Information.txt

MD5 575171222ec1017609924d8fcf7890a1
SHA1 45ae2f09de6f605de5f3a6a5ac5f13f8c28fe61d
SHA256 3996e518a712a72063cf984edef3912e397af3020d392f6d9de5a1b695680248
SHA512 8676266c4d1dd8bf972c6b9fc6076874237f50988c4dee395d469ead98de4a249aecb186128244ef886b5259cef0d6ed62f66a6c8af7309bbe102dff8dd1ee7e

memory/1836-85-0x0000000000400000-0x000000000047D000-memory.dmp

memory/1956-86-0x0000000007D90000-0x0000000007E0D000-memory.dmp

memory/1956-87-0x0000000007D90000-0x0000000007E0D000-memory.dmp

memory/1168-88-0x0000000000000000-mapping.dmp

memory/1956-89-0x0000000007D90000-0x0000000007E0D000-memory.dmp

memory/1028-90-0x0000000000000000-mapping.dmp

memory/1028-91-0x00000000003E0000-0x0000000000A15000-memory.dmp

memory/1028-93-0x00000000003E0000-0x0000000000A15000-memory.dmp

memory/1028-94-0x0000000077070000-0x00000000771F0000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-06-25 01:39

Reported

2022-06-25 01:42

Platform

win10v2004-20220414-en

Max time kernel

181s

Max time network

199s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d688134cbb3f772d9da6dd8900b5ba32ae6fd356671deceee8f211a70d5595a2.exe"

Signatures

Qulab Stealer & Clipper

stealer qulab

ACProtect 1.3x - 1.4x DLL software

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\d688134cbb3f772d9da6dd8900b5ba32ae6fd356671deceee8f211a70d5595a2.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.module.exe N/A

Sets file to hidden

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\d688134cbb3f772d9da6dd8900b5ba32ae6fd356671deceee8f211a70d5595a2.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\d688134cbb3f772d9da6dd8900b5ba32ae6fd356671deceee8f211a70d5595a2.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\d688134cbb3f772d9da6dd8900b5ba32ae6fd356671deceee8f211a70d5595a2.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Wine C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Wine C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Wine C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Checks installed software on the system

discovery

Looks up external IP address via web service

Description Indicator Process Target
N/A ipapi.co N/A N/A
N/A ipapi.co N/A N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\winmgmts:\localhost\ C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe N/A
File opened for modification C:\Windows\SysWOW64\winmgmts:\localhost\ C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe N/A

Enumerates physical storage devices

NTFS ADS

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Local\Temp\winmgmts:\localhost\ C:\Users\Admin\AppData\Local\Temp\d688134cbb3f772d9da6dd8900b5ba32ae6fd356671deceee8f211a70d5595a2.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\winmgmts:\localhost\ C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe N/A

Suspicious behavior: RenamesItself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\d688134cbb3f772d9da6dd8900b5ba32ae6fd356671deceee8f211a70d5595a2.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1988 wrote to memory of 1968 N/A C:\Users\Admin\AppData\Local\Temp\d688134cbb3f772d9da6dd8900b5ba32ae6fd356671deceee8f211a70d5595a2.exe C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe
PID 1988 wrote to memory of 1968 N/A C:\Users\Admin\AppData\Local\Temp\d688134cbb3f772d9da6dd8900b5ba32ae6fd356671deceee8f211a70d5595a2.exe C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe
PID 1988 wrote to memory of 1968 N/A C:\Users\Admin\AppData\Local\Temp\d688134cbb3f772d9da6dd8900b5ba32ae6fd356671deceee8f211a70d5595a2.exe C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe
PID 1968 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.module.exe
PID 1968 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.module.exe
PID 1968 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.module.exe
PID 1968 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe C:\Windows\SysWOW64\attrib.exe
PID 1968 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe C:\Windows\SysWOW64\attrib.exe
PID 1968 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe C:\Windows\SysWOW64\attrib.exe
PID 1968 wrote to memory of 3120 N/A C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe C:\Windows\SysWOW64\attrib.exe
PID 1968 wrote to memory of 3120 N/A C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe C:\Windows\SysWOW64\attrib.exe
PID 1968 wrote to memory of 3120 N/A C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe C:\Windows\SysWOW64\attrib.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\d688134cbb3f772d9da6dd8900b5ba32ae6fd356671deceee8f211a70d5595a2.exe

"C:\Users\Admin\AppData\Local\Temp\d688134cbb3f772d9da6dd8900b5ba32ae6fd356671deceee8f211a70d5595a2.exe"

C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe

C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe

C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.module.exe

C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.module.exe a -y -mx9 -ssw "C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ENU_801FE97294A87C4E9D41.7z" "C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\1\*"

C:\Windows\SysWOW64\attrib.exe

attrib +s +h "C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007"

C:\Windows\SysWOW64\attrib.exe

attrib +s +h "C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007"

C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe

C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe

C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe

C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe

Network

Country Destination Domain Proto
FR 2.22.22.129:80 tcp
US 93.184.220.29:80 tcp
US 209.197.3.8:80 tcp
NL 104.110.191.140:80 tcp
NL 104.110.191.140:80 tcp
US 93.184.220.29:80 tcp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 ipapi.co udp
US 172.67.69.226:443 ipapi.co tcp
RU 194.67.197.197:65233 tcp

Files

memory/1988-130-0x00000000007A0000-0x0000000000DD5000-memory.dmp

memory/1988-131-0x0000000077CB0000-0x0000000077E53000-memory.dmp

memory/1988-132-0x00000000007A0000-0x0000000000DD5000-memory.dmp

memory/1968-133-0x0000000000000000-mapping.dmp

memory/1988-135-0x0000000077CB0000-0x0000000077E53000-memory.dmp

memory/1988-134-0x00000000007A0000-0x0000000000DD5000-memory.dmp

memory/1968-136-0x0000000077CB0000-0x0000000077E53000-memory.dmp

memory/1968-137-0x00000000007A0000-0x0000000000DD5000-memory.dmp

memory/1968-138-0x0000000077CB0000-0x0000000077E53000-memory.dmp

memory/1968-139-0x00000000007A0000-0x0000000000DD5000-memory.dmp

C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.sqlite3.module.dll

MD5 8c127ce55bfbb55eb9a843c693c9f240
SHA1 75c462c935a7ff2c90030c684440d61d48bb1858
SHA256 4f93f3543139febb91e0c95dc9351008e9147a484732ee5962c7df64f6868028
SHA512 d3578bd7ef01f9e25983c24eb9bb33f25c37d650cc79b823c3ec19f196d4a00deb506c1e1f774f15e5664d5263b02570fec11b322022b90a0ff1b10943188a02

C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.sqlite3.module.dll

MD5 8c127ce55bfbb55eb9a843c693c9f240
SHA1 75c462c935a7ff2c90030c684440d61d48bb1858
SHA256 4f93f3543139febb91e0c95dc9351008e9147a484732ee5962c7df64f6868028
SHA512 d3578bd7ef01f9e25983c24eb9bb33f25c37d650cc79b823c3ec19f196d4a00deb506c1e1f774f15e5664d5263b02570fec11b322022b90a0ff1b10943188a02

memory/1968-142-0x0000000061E00000-0x0000000061ED2000-memory.dmp

memory/1284-143-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.module.exe

MD5 946285055913d457fda78a4484266e96
SHA1 668661955bf3c20b9dc8cdaa7ec6e8dbbbd63285
SHA256 23ca34a7d22fdb7d36014928c089c982cdfb903e9143aea60d38f228c9594beb
SHA512 30a490b774d5736215b340d3a192825dc1dfbb7c8d9974c8ab2a09eff2429ed7cf99969ec6d651c8056549798da092ffa600681288dbd7c6f60515acd3630d95

C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.module.exe

MD5 946285055913d457fda78a4484266e96
SHA1 668661955bf3c20b9dc8cdaa7ec6e8dbbbd63285
SHA256 23ca34a7d22fdb7d36014928c089c982cdfb903e9143aea60d38f228c9594beb
SHA512 30a490b774d5736215b340d3a192825dc1dfbb7c8d9974c8ab2a09eff2429ed7cf99969ec6d651c8056549798da092ffa600681288dbd7c6f60515acd3630d95

C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\1\Information.txt

MD5 15ef9b407ee4a203ec88d631c4ca98ad
SHA1 3ff7c650ea7f3b19eeacde1e9299dc2d95472232
SHA256 5f48a81917cd3b53dbf1165b9810b22216948d734187f4ce4c6f05f4ead56363
SHA512 463206da6dceb4423c8ae9e6434fba58f65004cc5a0508fda4708f97834240c0115a569b598f20bcb09ef49264ca8f6e3065ab1c48039e89addb1f39542041a0

C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\1\Screen.jpg

MD5 937ed329bce919cb84a8ca426eb5e10d
SHA1 340966477d30f5eb8c819d061d7527b42c439102
SHA256 0fb6620438ce57a46b451e84b5389728af8820e6a4bc7ea82ce60d1dc9397d44
SHA512 2340d8275953b435d388ed43358a61c122531a075c38de38ab744095bc4beeffb5f8dc63ca7c4b831dbc4c16f0052cbd7d24484e442a1c8e68538561453ba025

memory/1284-148-0x0000000000400000-0x000000000047D000-memory.dmp

memory/2960-149-0x0000000000000000-mapping.dmp

memory/3120-150-0x0000000000000000-mapping.dmp

memory/3716-151-0x00000000007A0000-0x0000000000DD5000-memory.dmp

memory/3716-152-0x0000000077CB0000-0x0000000077E53000-memory.dmp

memory/3716-153-0x00000000007A0000-0x0000000000DD5000-memory.dmp

memory/3716-154-0x00000000007A0000-0x0000000000DD5000-memory.dmp

memory/3716-155-0x0000000077CB0000-0x0000000077E53000-memory.dmp

memory/3560-156-0x00000000007A0000-0x0000000000DD5000-memory.dmp

memory/3560-157-0x0000000077CB0000-0x0000000077E53000-memory.dmp

memory/3560-158-0x00000000007A0000-0x0000000000DD5000-memory.dmp

memory/3560-159-0x00000000007A0000-0x0000000000DD5000-memory.dmp

memory/3560-160-0x0000000077CB0000-0x0000000077E53000-memory.dmp