Malware Analysis Report

2024-09-23 04:45

Sample ID 220625-ggfh7sgcdr
Target 6faf5ff76303fdc31acbcc8ec9145761a0535b4a4ef75b31fa01311957b56a4c
SHA256 6faf5ff76303fdc31acbcc8ec9145761a0535b4a4ef75b31fa01311957b56a4c
Tags
upx qulab discovery evasion ransomware spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

6faf5ff76303fdc31acbcc8ec9145761a0535b4a4ef75b31fa01311957b56a4c

Threat Level: Known bad

The file 6faf5ff76303fdc31acbcc8ec9145761a0535b4a4ef75b31fa01311957b56a4c was found to be: Known bad.

Malicious Activity Summary

upx qulab discovery evasion ransomware spyware stealer

Qulab Stealer & Clipper

ACProtect 1.3x - 1.4x DLL software

UPX packed file

Sets file to hidden

Executes dropped EXE

Reads user/profile data of web browsers

Loads dropped DLL

Looks up external IP address via web service

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Suspicious use of SetThreadContext

AutoIT Executable

Drops file in System32 directory

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

NTFS ADS

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Views/modifies file attributes

Suspicious use of SendNotifyMessage

MITRE ATT&CK Matrix V6

Analysis: static1

Detonation Overview

Reported

2022-06-25 05:46

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-06-25 05:46

Reported

2022-06-25 06:50

Platform

win7-20220414-en

Max time kernel

139s

Max time network

158s

Command Line

"C:\Users\Admin\AppData\Local\Temp\6faf5ff76303fdc31acbcc8ec9145761a0535b4a4ef75b31fa01311957b56a4c.exe"

Signatures

Qulab Stealer & Clipper

stealer qulab

ACProtect 1.3x - 1.4x DLL software

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.module.exe N/A

Sets file to hidden

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Checks installed software on the system

discovery

Looks up external IP address via web service

Description Indicator Process Target
N/A ipapi.co N/A N/A
N/A ipapi.co N/A N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\winmgmts:\localhost\ C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe N/A
File opened for modification C:\Windows\SysWOW64\winmgmts:\localhost\ C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe N/A

Enumerates physical storage devices

NTFS ADS

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Local\Temp\winmgmts:\localhost\ C:\Users\Admin\AppData\Local\Temp\6faf5ff76303fdc31acbcc8ec9145761a0535b4a4ef75b31fa01311957b56a4c.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\winmgmts:\localhost\ C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe N/A

Suspicious behavior: RenamesItself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\6faf5ff76303fdc31acbcc8ec9145761a0535b4a4ef75b31fa01311957b56a4c.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\6faf5ff76303fdc31acbcc8ec9145761a0535b4a4ef75b31fa01311957b56a4c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6faf5ff76303fdc31acbcc8ec9145761a0535b4a4ef75b31fa01311957b56a4c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6faf5ff76303fdc31acbcc8ec9145761a0535b4a4ef75b31fa01311957b56a4c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6faf5ff76303fdc31acbcc8ec9145761a0535b4a4ef75b31fa01311957b56a4c.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\6faf5ff76303fdc31acbcc8ec9145761a0535b4a4ef75b31fa01311957b56a4c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6faf5ff76303fdc31acbcc8ec9145761a0535b4a4ef75b31fa01311957b56a4c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6faf5ff76303fdc31acbcc8ec9145761a0535b4a4ef75b31fa01311957b56a4c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6faf5ff76303fdc31acbcc8ec9145761a0535b4a4ef75b31fa01311957b56a4c.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2044 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\6faf5ff76303fdc31acbcc8ec9145761a0535b4a4ef75b31fa01311957b56a4c.exe C:\Users\Admin\AppData\Local\Temp\6faf5ff76303fdc31acbcc8ec9145761a0535b4a4ef75b31fa01311957b56a4c.exe
PID 2044 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\6faf5ff76303fdc31acbcc8ec9145761a0535b4a4ef75b31fa01311957b56a4c.exe C:\Users\Admin\AppData\Local\Temp\6faf5ff76303fdc31acbcc8ec9145761a0535b4a4ef75b31fa01311957b56a4c.exe
PID 2044 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\6faf5ff76303fdc31acbcc8ec9145761a0535b4a4ef75b31fa01311957b56a4c.exe C:\Users\Admin\AppData\Local\Temp\6faf5ff76303fdc31acbcc8ec9145761a0535b4a4ef75b31fa01311957b56a4c.exe
PID 2044 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\6faf5ff76303fdc31acbcc8ec9145761a0535b4a4ef75b31fa01311957b56a4c.exe C:\Users\Admin\AppData\Local\Temp\6faf5ff76303fdc31acbcc8ec9145761a0535b4a4ef75b31fa01311957b56a4c.exe
PID 2044 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\6faf5ff76303fdc31acbcc8ec9145761a0535b4a4ef75b31fa01311957b56a4c.exe C:\Users\Admin\AppData\Local\Temp\6faf5ff76303fdc31acbcc8ec9145761a0535b4a4ef75b31fa01311957b56a4c.exe
PID 2044 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\6faf5ff76303fdc31acbcc8ec9145761a0535b4a4ef75b31fa01311957b56a4c.exe C:\Users\Admin\AppData\Local\Temp\6faf5ff76303fdc31acbcc8ec9145761a0535b4a4ef75b31fa01311957b56a4c.exe
PID 2008 wrote to memory of 1464 N/A C:\Users\Admin\AppData\Local\Temp\6faf5ff76303fdc31acbcc8ec9145761a0535b4a4ef75b31fa01311957b56a4c.exe C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe
PID 2008 wrote to memory of 1464 N/A C:\Users\Admin\AppData\Local\Temp\6faf5ff76303fdc31acbcc8ec9145761a0535b4a4ef75b31fa01311957b56a4c.exe C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe
PID 2008 wrote to memory of 1464 N/A C:\Users\Admin\AppData\Local\Temp\6faf5ff76303fdc31acbcc8ec9145761a0535b4a4ef75b31fa01311957b56a4c.exe C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe
PID 2008 wrote to memory of 1464 N/A C:\Users\Admin\AppData\Local\Temp\6faf5ff76303fdc31acbcc8ec9145761a0535b4a4ef75b31fa01311957b56a4c.exe C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe
PID 1464 wrote to memory of 1784 N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe
PID 1464 wrote to memory of 1784 N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe
PID 1464 wrote to memory of 1784 N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe
PID 1464 wrote to memory of 1784 N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe
PID 1464 wrote to memory of 1784 N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe
PID 1464 wrote to memory of 1784 N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe
PID 1784 wrote to memory of 400 N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.module.exe
PID 1784 wrote to memory of 400 N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.module.exe
PID 1784 wrote to memory of 400 N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.module.exe
PID 1784 wrote to memory of 400 N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.module.exe
PID 1784 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe C:\Windows\SysWOW64\attrib.exe
PID 1784 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe C:\Windows\SysWOW64\attrib.exe
PID 1784 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe C:\Windows\SysWOW64\attrib.exe
PID 1784 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe C:\Windows\SysWOW64\attrib.exe
PID 544 wrote to memory of 1576 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe
PID 544 wrote to memory of 1576 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe
PID 544 wrote to memory of 1576 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe
PID 544 wrote to memory of 1576 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe
PID 1576 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe
PID 1576 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe
PID 1576 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe
PID 1576 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe
PID 1576 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe
PID 1576 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe
PID 544 wrote to memory of 788 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe
PID 544 wrote to memory of 788 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe
PID 544 wrote to memory of 788 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe
PID 544 wrote to memory of 788 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe
PID 788 wrote to memory of 752 N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe
PID 788 wrote to memory of 752 N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe
PID 788 wrote to memory of 752 N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe
PID 788 wrote to memory of 752 N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe
PID 788 wrote to memory of 752 N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe
PID 788 wrote to memory of 752 N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\6faf5ff76303fdc31acbcc8ec9145761a0535b4a4ef75b31fa01311957b56a4c.exe

"C:\Users\Admin\AppData\Local\Temp\6faf5ff76303fdc31acbcc8ec9145761a0535b4a4ef75b31fa01311957b56a4c.exe"

C:\Users\Admin\AppData\Local\Temp\6faf5ff76303fdc31acbcc8ec9145761a0535b4a4ef75b31fa01311957b56a4c.exe

"C:\Users\Admin\AppData\Local\Temp\6faf5ff76303fdc31acbcc8ec9145761a0535b4a4ef75b31fa01311957b56a4c.exe"

C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe

C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe

C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe

"C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe"

C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.module.exe

C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.module.exe a -y -mx9 -ssw "C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\ENU_687FE978D73A864E9D41.7z" "C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\1\*"

C:\Windows\SysWOW64\attrib.exe

attrib +s +h "C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources"

C:\Windows\system32\taskeng.exe

taskeng.exe {64793D76-71E5-4A61-A70B-C1B7B437145A} S-1-5-21-790309383-526510583-3802439154-1000:TVHJCWMH\Admin:Interactive:[1]

C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe

C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe

C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe

"C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe"

C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe

C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe

C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe

"C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
NL 149.154.167.220:443 api.telegram.org tcp
NL 149.154.167.220:443 api.telegram.org tcp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 ipapi.co udp
US 104.26.8.44:443 ipapi.co tcp
NL 149.154.167.220:443 api.telegram.org tcp
NL 149.154.167.220:443 api.telegram.org tcp
NL 149.154.167.220:443 api.telegram.org tcp
NL 149.154.167.220:443 api.telegram.org tcp

Files

memory/2044-54-0x0000000075F21000-0x0000000075F23000-memory.dmp

memory/2044-55-0x0000000000170000-0x000000000057F000-memory.dmp

memory/2008-56-0x0000000000B60000-0x0000000000D35000-memory.dmp

memory/2008-58-0x0000000000B60000-0x0000000000D35000-memory.dmp

memory/2044-63-0x00000000213C0000-0x00000000217CF000-memory.dmp

memory/2008-66-0x0000000000B8800A-mapping.dmp

memory/2008-68-0x0000000000B60000-0x0000000000D35000-memory.dmp

memory/2044-69-0x0000000000170000-0x000000000057F000-memory.dmp

memory/2008-70-0x0000000000170000-0x000000000057F000-memory.dmp

memory/1464-71-0x0000000000000000-mapping.dmp

memory/1784-75-0x0000000000BB0000-0x0000000000D85000-memory.dmp

memory/1784-82-0x0000000000BD800A-mapping.dmp

memory/1464-85-0x0000000000170000-0x000000000057F000-memory.dmp

memory/1784-84-0x0000000000BB0000-0x0000000000D85000-memory.dmp

\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.sqlite3.module.dll

MD5 8c127ce55bfbb55eb9a843c693c9f240
SHA1 75c462c935a7ff2c90030c684440d61d48bb1858
SHA256 4f93f3543139febb91e0c95dc9351008e9147a484732ee5962c7df64f6868028
SHA512 d3578bd7ef01f9e25983c24eb9bb33f25c37d650cc79b823c3ec19f196d4a00deb506c1e1f774f15e5664d5263b02570fec11b322022b90a0ff1b10943188a02

\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.sqlite3.module.dll

MD5 8c127ce55bfbb55eb9a843c693c9f240
SHA1 75c462c935a7ff2c90030c684440d61d48bb1858
SHA256 4f93f3543139febb91e0c95dc9351008e9147a484732ee5962c7df64f6868028
SHA512 d3578bd7ef01f9e25983c24eb9bb33f25c37d650cc79b823c3ec19f196d4a00deb506c1e1f774f15e5664d5263b02570fec11b322022b90a0ff1b10943188a02

memory/1784-88-0x0000000061E00000-0x0000000061ED2000-memory.dmp

memory/1784-89-0x0000000061E00000-0x0000000061ED2000-memory.dmp

memory/1784-90-0x0000000061E00000-0x0000000061ED2000-memory.dmp

memory/1784-91-0x0000000061E00000-0x0000000061ED2000-memory.dmp

\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.module.exe

MD5 946285055913d457fda78a4484266e96
SHA1 668661955bf3c20b9dc8cdaa7ec6e8dbbbd63285
SHA256 23ca34a7d22fdb7d36014928c089c982cdfb903e9143aea60d38f228c9594beb
SHA512 30a490b774d5736215b340d3a192825dc1dfbb7c8d9974c8ab2a09eff2429ed7cf99969ec6d651c8056549798da092ffa600681288dbd7c6f60515acd3630d95

\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.module.exe

MD5 946285055913d457fda78a4484266e96
SHA1 668661955bf3c20b9dc8cdaa7ec6e8dbbbd63285
SHA256 23ca34a7d22fdb7d36014928c089c982cdfb903e9143aea60d38f228c9594beb
SHA512 30a490b774d5736215b340d3a192825dc1dfbb7c8d9974c8ab2a09eff2429ed7cf99969ec6d651c8056549798da092ffa600681288dbd7c6f60515acd3630d95

memory/400-94-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.module.exe

MD5 946285055913d457fda78a4484266e96
SHA1 668661955bf3c20b9dc8cdaa7ec6e8dbbbd63285
SHA256 23ca34a7d22fdb7d36014928c089c982cdfb903e9143aea60d38f228c9594beb
SHA512 30a490b774d5736215b340d3a192825dc1dfbb7c8d9974c8ab2a09eff2429ed7cf99969ec6d651c8056549798da092ffa600681288dbd7c6f60515acd3630d95

C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\1\Information.txt

MD5 88e852712beb1a0ba3db01b43413b3c1
SHA1 8f230b93eb8c077c3564f5315021f16ae21cf66b
SHA256 5d6a00a8b2775f8d2b54acee95579c95acaf45c275a4b3b291904f908036ab6b
SHA512 286a72faab72bdad04dc20f3109d11883d0b2da684fce7cad055b1baea00b18796ccbb24c4cc717bdd8dd54eeaf91e961e2a8141de157a29740b62bc8e73eb27

C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\1\Screen.jpg

MD5 8ac7455e21ee8150bf1b8206888beaf4
SHA1 7af5801e28b9e7d81d6e0ec2435c15709470c248
SHA256 4ce56d6dbd4b6ed6306af1ac4616ab4c4f5602a2a5c05a0670a58e58d86f7066
SHA512 77d14b8fc007d88046f3078f315e4a4ad3d55fdc6759bb1b5309fd1502a88d17af6186126fe37dc38703e3733301225e7ae0f3c3798279cf81fa7203830b9ea5

memory/400-98-0x0000000000400000-0x000000000047D000-memory.dmp

memory/1784-99-0x0000000002FF0000-0x000000000306D000-memory.dmp

memory/1584-100-0x0000000000000000-mapping.dmp

memory/1784-101-0x0000000002FF0000-0x000000000306D000-memory.dmp

memory/1784-102-0x0000000002FF0000-0x000000000306D000-memory.dmp

memory/1576-103-0x0000000000000000-mapping.dmp

memory/1736-107-0x0000000000AF0000-0x0000000000CC5000-memory.dmp

memory/1736-114-0x0000000000B1800A-mapping.dmp

memory/1576-116-0x0000000000170000-0x000000000057F000-memory.dmp

memory/1736-117-0x0000000000AF0000-0x0000000000CC5000-memory.dmp

memory/788-118-0x0000000000000000-mapping.dmp

memory/752-122-0x0000000000650000-0x0000000000825000-memory.dmp

memory/788-125-0x0000000000170000-0x000000000057F000-memory.dmp

memory/752-130-0x000000000067800A-mapping.dmp

memory/788-132-0x0000000000170000-0x000000000057F000-memory.dmp

memory/752-133-0x0000000000650000-0x0000000000825000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-06-25 05:46

Reported

2022-06-25 06:50

Platform

win10v2004-20220414-en

Max time kernel

157s

Max time network

164s

Command Line

"C:\Users\Admin\AppData\Local\Temp\6faf5ff76303fdc31acbcc8ec9145761a0535b4a4ef75b31fa01311957b56a4c.exe"

Signatures

Qulab Stealer & Clipper

stealer qulab

ACProtect 1.3x - 1.4x DLL software

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.module.exe N/A

Sets file to hidden

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Checks installed software on the system

discovery

Looks up external IP address via web service

Description Indicator Process Target
N/A ipapi.co N/A N/A
N/A ipapi.co N/A N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\winmgmts:\localhost\ C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe N/A
File opened for modification C:\Windows\SysWOW64\winmgmts:\localhost\ C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe N/A

Enumerates physical storage devices

NTFS ADS

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Local\Temp\winmgmts:\localhost\ C:\Users\Admin\AppData\Local\Temp\6faf5ff76303fdc31acbcc8ec9145761a0535b4a4ef75b31fa01311957b56a4c.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\winmgmts:\localhost\ C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe N/A

Suspicious behavior: RenamesItself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\6faf5ff76303fdc31acbcc8ec9145761a0535b4a4ef75b31fa01311957b56a4c.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1932 wrote to memory of 4576 N/A C:\Users\Admin\AppData\Local\Temp\6faf5ff76303fdc31acbcc8ec9145761a0535b4a4ef75b31fa01311957b56a4c.exe C:\Users\Admin\AppData\Local\Temp\6faf5ff76303fdc31acbcc8ec9145761a0535b4a4ef75b31fa01311957b56a4c.exe
PID 1932 wrote to memory of 4576 N/A C:\Users\Admin\AppData\Local\Temp\6faf5ff76303fdc31acbcc8ec9145761a0535b4a4ef75b31fa01311957b56a4c.exe C:\Users\Admin\AppData\Local\Temp\6faf5ff76303fdc31acbcc8ec9145761a0535b4a4ef75b31fa01311957b56a4c.exe
PID 1932 wrote to memory of 4576 N/A C:\Users\Admin\AppData\Local\Temp\6faf5ff76303fdc31acbcc8ec9145761a0535b4a4ef75b31fa01311957b56a4c.exe C:\Users\Admin\AppData\Local\Temp\6faf5ff76303fdc31acbcc8ec9145761a0535b4a4ef75b31fa01311957b56a4c.exe
PID 1932 wrote to memory of 4576 N/A C:\Users\Admin\AppData\Local\Temp\6faf5ff76303fdc31acbcc8ec9145761a0535b4a4ef75b31fa01311957b56a4c.exe C:\Users\Admin\AppData\Local\Temp\6faf5ff76303fdc31acbcc8ec9145761a0535b4a4ef75b31fa01311957b56a4c.exe
PID 1932 wrote to memory of 4576 N/A C:\Users\Admin\AppData\Local\Temp\6faf5ff76303fdc31acbcc8ec9145761a0535b4a4ef75b31fa01311957b56a4c.exe C:\Users\Admin\AppData\Local\Temp\6faf5ff76303fdc31acbcc8ec9145761a0535b4a4ef75b31fa01311957b56a4c.exe
PID 4576 wrote to memory of 2336 N/A C:\Users\Admin\AppData\Local\Temp\6faf5ff76303fdc31acbcc8ec9145761a0535b4a4ef75b31fa01311957b56a4c.exe C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe
PID 4576 wrote to memory of 2336 N/A C:\Users\Admin\AppData\Local\Temp\6faf5ff76303fdc31acbcc8ec9145761a0535b4a4ef75b31fa01311957b56a4c.exe C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe
PID 4576 wrote to memory of 2336 N/A C:\Users\Admin\AppData\Local\Temp\6faf5ff76303fdc31acbcc8ec9145761a0535b4a4ef75b31fa01311957b56a4c.exe C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe
PID 2336 wrote to memory of 3076 N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe
PID 2336 wrote to memory of 3076 N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe
PID 2336 wrote to memory of 3076 N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe
PID 2336 wrote to memory of 3076 N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe
PID 2336 wrote to memory of 3076 N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe
PID 3076 wrote to memory of 600 N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.module.exe
PID 3076 wrote to memory of 600 N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.module.exe
PID 3076 wrote to memory of 600 N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.module.exe
PID 3076 wrote to memory of 4500 N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe C:\Windows\SysWOW64\attrib.exe
PID 3076 wrote to memory of 4500 N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe C:\Windows\SysWOW64\attrib.exe
PID 3076 wrote to memory of 4500 N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe C:\Windows\SysWOW64\attrib.exe
PID 4260 wrote to memory of 3316 N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe
PID 4260 wrote to memory of 3316 N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe
PID 4260 wrote to memory of 3316 N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe
PID 4260 wrote to memory of 3316 N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe
PID 4260 wrote to memory of 3316 N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe
PID 3392 wrote to memory of 4992 N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe
PID 3392 wrote to memory of 4992 N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe
PID 3392 wrote to memory of 4992 N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe
PID 3392 wrote to memory of 4992 N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe
PID 3392 wrote to memory of 4992 N/A C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\6faf5ff76303fdc31acbcc8ec9145761a0535b4a4ef75b31fa01311957b56a4c.exe

"C:\Users\Admin\AppData\Local\Temp\6faf5ff76303fdc31acbcc8ec9145761a0535b4a4ef75b31fa01311957b56a4c.exe"

C:\Users\Admin\AppData\Local\Temp\6faf5ff76303fdc31acbcc8ec9145761a0535b4a4ef75b31fa01311957b56a4c.exe

"C:\Users\Admin\AppData\Local\Temp\6faf5ff76303fdc31acbcc8ec9145761a0535b4a4ef75b31fa01311957b56a4c.exe"

C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe

C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe

C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe

"C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe"

C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.module.exe

C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.module.exe a -y -mx9 -ssw "C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\ENU_801FE970A758A6AE9D41.7z" "C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\1\*"

C:\Windows\SysWOW64\attrib.exe

attrib +s +h "C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources"

C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe

C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe

C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe

"C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe"

C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe

C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe

C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe

"C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.exe"

Network

Country Destination Domain Proto
NL 104.110.191.140:80 tcp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
NL 20.190.160.67:443 tcp
IE 20.50.80.209:443 tcp
US 8.8.8.8:53 ipapi.co udp
US 172.67.69.226:443 ipapi.co tcp
NL 149.154.167.220:443 api.telegram.org tcp
NL 104.110.191.140:80 tcp
NL 104.110.191.140:80 tcp
NL 178.79.208.1:80 tcp
NL 20.190.160.8:443 tcp
US 93.184.220.29:80 tcp
NL 20.190.160.2:443 tcp
NL 20.190.160.136:443 tcp
NL 20.190.160.73:443 tcp
NL 20.190.160.71:443 tcp

Files

memory/1932-130-0x0000000000530000-0x000000000093F000-memory.dmp

memory/4576-131-0x0000000000000000-mapping.dmp

memory/4576-132-0x0000000000D40000-0x0000000000F15000-memory.dmp

memory/4576-139-0x0000000000D40000-0x0000000000F15000-memory.dmp

memory/1932-140-0x0000000000530000-0x000000000093F000-memory.dmp

memory/4576-141-0x0000000000530000-0x000000000093F000-memory.dmp

memory/2336-142-0x0000000000000000-mapping.dmp

memory/2336-143-0x0000000000530000-0x000000000093F000-memory.dmp

memory/3076-144-0x0000000000000000-mapping.dmp

memory/3076-145-0x00000000002D0000-0x00000000004A5000-memory.dmp

memory/3076-152-0x00000000002D0000-0x00000000004A5000-memory.dmp

memory/2336-153-0x0000000000530000-0x000000000093F000-memory.dmp

C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.sqlite3.module.dll

MD5 8c127ce55bfbb55eb9a843c693c9f240
SHA1 75c462c935a7ff2c90030c684440d61d48bb1858
SHA256 4f93f3543139febb91e0c95dc9351008e9147a484732ee5962c7df64f6868028
SHA512 d3578bd7ef01f9e25983c24eb9bb33f25c37d650cc79b823c3ec19f196d4a00deb506c1e1f774f15e5664d5263b02570fec11b322022b90a0ff1b10943188a02

C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.sqlite3.module.dll

MD5 8c127ce55bfbb55eb9a843c693c9f240
SHA1 75c462c935a7ff2c90030c684440d61d48bb1858
SHA256 4f93f3543139febb91e0c95dc9351008e9147a484732ee5962c7df64f6868028
SHA512 d3578bd7ef01f9e25983c24eb9bb33f25c37d650cc79b823c3ec19f196d4a00deb506c1e1f774f15e5664d5263b02570fec11b322022b90a0ff1b10943188a02

memory/3076-157-0x0000000061E00000-0x0000000061ED2000-memory.dmp

memory/3076-156-0x0000000061E00000-0x0000000061ED2000-memory.dmp

memory/600-158-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.module.exe

MD5 946285055913d457fda78a4484266e96
SHA1 668661955bf3c20b9dc8cdaa7ec6e8dbbbd63285
SHA256 23ca34a7d22fdb7d36014928c089c982cdfb903e9143aea60d38f228c9594beb
SHA512 30a490b774d5736215b340d3a192825dc1dfbb7c8d9974c8ab2a09eff2429ed7cf99969ec6d651c8056549798da092ffa600681288dbd7c6f60515acd3630d95

C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\NlsLexicons0049.module.exe

MD5 946285055913d457fda78a4484266e96
SHA1 668661955bf3c20b9dc8cdaa7ec6e8dbbbd63285
SHA256 23ca34a7d22fdb7d36014928c089c982cdfb903e9143aea60d38f228c9594beb
SHA512 30a490b774d5736215b340d3a192825dc1dfbb7c8d9974c8ab2a09eff2429ed7cf99969ec6d651c8056549798da092ffa600681288dbd7c6f60515acd3630d95

C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\1\Information.txt

MD5 8055f8d99c74b496b1439ee6406535a3
SHA1 85d934edc9bf1c8f741a1c62d41f7b67dba81c56
SHA256 da205b0f8361422cb672b4cbb8f1d6dd90d3195318bebc263436e2935e55d927
SHA512 cad9851766507494e88ea05b47b11f83bb29ebc5d3cb4b4f2388fcad53e3a30689c771445b4dc93f3acc51959bcf2294409971ec22e6ccc86205ea5ce6b857a6

C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-n..meworkapi.resources\1\Screen.jpg

MD5 d36dd8ad243d2e4bd1c8aedbc251f98b
SHA1 89daa4f9ddbb9ff05a18e6a828c88398e917bbf9
SHA256 21cc6f62ee7442b8b1fcfb229f1e6b106cc790d8df404dc92e7076311218c81d
SHA512 8809863d3259a90b4de9b7ee4fe45433637956130f8d9d114483e3252118a227921b812b8900f8d1a0ab0f3ff4067b6d2fe5100ed37eae16571d854c848feb02

memory/600-163-0x0000000000400000-0x000000000047D000-memory.dmp

memory/4500-164-0x0000000000000000-mapping.dmp

memory/3076-165-0x0000000061E00000-0x0000000061ED2000-memory.dmp

memory/3076-166-0x0000000061E00000-0x0000000061ED2000-memory.dmp

memory/3316-167-0x0000000000000000-mapping.dmp

memory/3316-168-0x0000000001000000-0x00000000011D5000-memory.dmp

memory/3316-175-0x0000000001000000-0x00000000011D5000-memory.dmp

memory/4260-176-0x0000000000530000-0x000000000093F000-memory.dmp

memory/4992-177-0x0000000000000000-mapping.dmp

memory/3392-186-0x0000000000530000-0x000000000093F000-memory.dmp

memory/4992-185-0x0000000000D40000-0x0000000000F15000-memory.dmp