qulab | 358928e393e91937f17a754c2fca43d8eedc2d797e960610d9a35c4190197020

General

Target
358928e393e91937f17a754c2fca43d8eedc2d797e960610d9a35c4190197020.exe
Size 1.6MB
Sample220626-3w27eafdar
SHA256 358928e393e91937f17a754c2fca43d8eedc2d797e960610d9a35c4190197020
MD5 cfe244a13a7c4c4b6d4490efa712f32f
SHA1 ab66780f1ed25f841142ba142f973ae4924af479
SHA512 57d4561ff936bce62afeb480bc40cfe04ddbc1b40ad0495a5d29786b6c1695384dbf11057347f31ad797736965d2cc5d33059966410ec31e218839e55ce7e371
MD5 SHA1 SHA512

Score

10^/10

qulab discovery ransomware spyware stealer upx

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-web-app-host.resources\1\Information.txt

qulab

Ransom Note

# /===============================\ # |=== QULAB CLIPPER + STEALER ===| # |===============================| # |==== BUY CLIPPER + STEALER ====| # |=== http://teleg.run/QulabZ ===| # \===============================/ Date: 27.06.2022 Time: 02:06:05 OS: Windows 10 X64 / Build: 19041 UserName: Admin ComputerName: FSHLRPTB Processor: Intel Core Processor (Broadwell) VideoCard: Microsoft Basic Display Adapter Memory: 4.00 Gb KeyBoard Layout ID: 00000409 Resolution: 1280x720x32, 64 GHz Other Information: <error> Soft / Windows Components / Windows Updates: - Google Chrome - Microsoft Edge - Microsoft Edge Update - Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 - Java Auto Updater - Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.30.30704 - Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.30.30704 - Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.40660 - Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.40660 - Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 - Adobe Acrobat Reader DC - Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 - Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 - Microsoft Visual C++ 2022 X86 Additional Runtime - 14.30.30704 - Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 - Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.40660 - Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.40660 - Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 - Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.30.30704 Process List: - [System Process] / PID: 0 - System / PID: 4 - Registry / PID: 92 - smss.exe / PID: 364 - csrss.exe / PID: 452 - wininit.exe / PID: 544 - csrss.exe / PID: 552 - winlogon.exe / PID: 636 - services.exe / PID: 680 - lsass.exe / PID: 696 - svchost.exe / PID: 808 - fontdrvhost.exe / PID: 828 - fontdrvhost.exe / PID: 836 - svchost.exe / PID: 932 - svchost.exe / PID: 980 - dwm.exe / PID: 408 - svchost.exe / PID: 420 - svchost.exe / PID: 868 - svchost.exe / PID: 388 - svchost.exe / PID: 1044 - svchost.exe / PID: 1076 - svchost.exe / PID: 1140 - svchost.exe / PID: 1184 - svchost.exe / PID: 1212 - svchost.exe / PID: 1252 - svchost.exe / PID: 1316 - svchost.exe / PID: 1380 - svchost.exe / PID: 1428 - svchost.exe / PID: 1440 - svchost.exe / PID: 1500 - svchost.exe / PID: 1592 - svchost.exe / PID: 1656 - svchost.exe / PID: 1668 - svchost.exe / PID: 1696 - svchost.exe / PID: 1800 - svchost.exe / PID: 1828 - svchost.exe / PID: 1940 - svchost.exe / PID: 1948 - svchost.exe / PID: 1956 - svchost.exe / PID: 2024 - spoolsv.exe / PID: 1540 - svchost.exe / PID: 2068 - svchost.exe / PID: 2108 - svchost.exe / PID: 2120 - sihost.exe / PID: 2352 - svchost.exe / PID: 2360 - svchost.exe / PID: 2476 - taskhostw.exe / PID: 2484 - svchost.exe / PID: 2492 - OfficeClickToRun.exe / PID: 2672 - svchost.exe / PID: 2684 - svchost.exe / PID: 2748 - svchost.exe / PID: 2756 - svchost.exe / PID: 2768 - svchost.exe / PID: 2776 - svchost.exe / PID: 3008 - explorer.exe / PID: 3060 - svchost.exe / PID: 800 - dllhost.exe / PID: 3248 - StartMenuExperienceHost.exe / PID: 3344 - dllhost.exe / PID: 3392 - RuntimeBroker.exe / PID: 3460 - SearchApp.exe / PID: 3548 - RuntimeBroker.exe / PID: 3752 - RuntimeBroker.exe / PID: 64 - svchost.exe / PID: 4480 - svchost.exe / PID: 4540 - svchost.exe / PID: 4620 - sppsvc.exe / PID: 4652 - svchost.exe / PID: 3184 - svchost.exe / PID: 4136 - svchost.exe / PID: 2692 - SppExtComObj.Exe / PID: 3696 - svchost.exe / PID: 4444 - svchost.exe / PID: 4928 - upfc.exe / PID: 3572 - svchost.exe / PID: 3760 - CortanaMapiHelper.ProxyStub.exe / PID: 2532 - WaaSMedicAgent.exe / PID: 4328 - conhost.exe / PID: 2396 - svchost.exe / PID: 2784

URLs

http://teleg.run/QulabZ

Signatures

Qulab Stealer & Clipper
Infostealer and clipper created with AutoIt.
stealer qulab

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0006000000022e37-131.dat	acprotect
behavioral2/files/0x0006000000022e37-132.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
276	CortanaMapiHelper.ProxyStub.module.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0006000000022e37-131.dat	upx
behavioral2/files/0x0006000000022e37-132.dat	upx
behavioral2/memory/2532-133-0x0000000061E00000-0x0000000061ED2000-memory.dmp	upx
behavioral2/memory/2532-134-0x0000000061E00000-0x0000000061ED2000-memory.dmp	upx

Loads dropped DLL 2 IoCs

pid	Process
2532	CortanaMapiHelper.ProxyStub.exe
2532	CortanaMapiHelper.ProxyStub.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
30	ipapi.co
31	ipapi.co

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\winmgmts:\localhost\	CortanaMapiHelper.ProxyStub.exe
File opened for modification	C:\Windows\SysWOW64\winmgmts:\localhost\	CortanaMapiHelper.ProxyStub.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\winmgmts:\localhost\	358928e393e91937f17a754c2fca43d8eedc2d797e960610d9a35c4190197020.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-web-app-host.resources\winmgmts:\localhost\	CortanaMapiHelper.ProxyStub.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2532	CortanaMapiHelper.ProxyStub.exe
2532	CortanaMapiHelper.ProxyStub.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4888	358928e393e91937f17a754c2fca43d8eedc2d797e960610d9a35c4190197020.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4888 wrote to memory of 2532	4888	358928e393e91937f17a754c2fca43d8eedc2d797e960610d9a35c4190197020.exe	80
PID 4888 wrote to memory of 2532	4888	358928e393e91937f17a754c2fca43d8eedc2d797e960610d9a35c4190197020.exe	80
PID 4888 wrote to memory of 2532	4888	358928e393e91937f17a754c2fca43d8eedc2d797e960610d9a35c4190197020.exe	80
PID 2532 wrote to memory of 276	2532	CortanaMapiHelper.ProxyStub.exe	89
PID 2532 wrote to memory of 276	2532	CortanaMapiHelper.ProxyStub.exe	89
PID 2532 wrote to memory of 276	2532	CortanaMapiHelper.ProxyStub.exe	89

C:\Users\Admin\AppData\Local\Temp\358928e393e91937f17a754c2fca43d8eedc2d797e960610d9a35c4190197020.exe
"C:\Users\Admin\AppData\Local\Temp\358928e393e91937f17a754c2fca43d8eedc2d797e960610d9a35c4190197020.exe"
1⤵
- NTFS ADS
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-web-app-host.resources\CortanaMapiHelper.ProxyStub.exe
  C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-web-app-host.resources\CortanaMapiHelper.ProxyStub.exe
  2⤵
  - Loads dropped DLL
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2532
- - C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-web-app-host.resources\CortanaMapiHelper.ProxyStub.module.exe
    C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-web-app-host.resources\CortanaMapiHelper.ProxyStub.module.exe a -y "C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-web-app-host.resources\41646D696E4653484C5250544257494E5F313058.7z" "C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-web-app-host.resources\1\*"
    3⤵
    - Executes dropped EXE
    PID:276

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-web-app-host.resources\CortanaMapiHelper.ProxyStub.exe
C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-web-app-host.resources\CortanaMapiHelper.ProxyStub.exe
1⤵
- Drops file in System32 directory
PID:4304

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-web-app-host.resources\CortanaMapiHelper.ProxyStub.exe
C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-web-app-host.resources\CortanaMapiHelper.ProxyStub.exe
1⤵
- Drops file in System32 directory
PID:3196

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Information.txt

Path C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-web-app-host.resources\1\Information.txt
Size 3KB
SHA256 773dc0ab88e38b6ab1a8f5f82985c34e16a817a7f88c9565d41f7a40d21823e9
MD5 37f4aa89a0725a215a2fb993bd6dfbdc
SHA1 2706bbdbccf6a7eebb7e83ef94d9d6ac476f9451
SHA512 723960d444b74f2bba7492f73bcb4c0f7795e32bb10ecb237b86485fa8b832c57193fdb6c7060e5b48df011cefd3cabc2b395b63ff242cb33757144bf3f91811
MD5 SHA1 SHA512

Submit Download

Screen.jpg

Path C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-web-app-host.resources\1\Screen.jpg
Size 47KB
SHA256 699f190151df9a0a261322a430465f07fc7e73556c0008a1634d4324a707bdc8
MD5 e1d90981393ea298b1fef240bdeabbbc
SHA1 6d09ffb4ffa85168b8c561ad8ae018d467b3a5ea
SHA512 f82a6d8379a478241ede75ca682bc957a7228bcb68282d0f4b6f145d09622950af90f7fb8031c22a1903608e9c517d0a29ee371aa7e8178cb8a64f6d392d2603
SSDEEP 768:I35N8b+b3pCrRg/I0Y1JgHnQN8WcPbdU6y3Cw8Oj5hlnV7zvUbhq:I3Mb+lCrgYYHnQN6b+Z3Cw8OvLuc
MD5 SHA1 SHA512 SSDEEP

Submit Download

CortanaMapiHelper.ProxyStub.module.exe

Path C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-web-app-host.resources\CortanaMapiHelper.ProxyStub.module.exe
Size 325KB
SHA256 ee7b61ff0adf48cc99ff45ae651f3793996fd85428984545ede59ba778f2d620
MD5 0668ef8068965996eb556fe0022c3459
SHA1 2bf527ce2db7e7a68e53467be9b0d71c06de4d6f
SHA512 b544b4d77741224bf919c67a7aea16475accd5e3858fb0b113619c8e18586ca7ee2a54ae5650d36c3a6342d9a19fe18a3842b1ea72ec436ec0898870cec1fb7d
SSDEEP 6144:jGofMv/uDYSX77VyPgDk4qgeB+hS5VurnC+PI+rE7hnTaY5Mo16x7/By:jGoPDYSFpDNU23rn7PIkE7hnTaAMoc
MD5 SHA1 SHA512 SSDEEP

Submit Download

CortanaMapiHelper.ProxyStub.module.exe

Path C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-web-app-host.resources\CortanaMapiHelper.ProxyStub.module.exe
Size 325KB
SHA256 ee7b61ff0adf48cc99ff45ae651f3793996fd85428984545ede59ba778f2d620
MD5 0668ef8068965996eb556fe0022c3459
SHA1 2bf527ce2db7e7a68e53467be9b0d71c06de4d6f
SHA512 b544b4d77741224bf919c67a7aea16475accd5e3858fb0b113619c8e18586ca7ee2a54ae5650d36c3a6342d9a19fe18a3842b1ea72ec436ec0898870cec1fb7d
SSDEEP 6144:jGofMv/uDYSX77VyPgDk4qgeB+hS5VurnC+PI+rE7hnTaY5Mo16x7/By:jGoPDYSFpDNU23rn7PIkE7hnTaAMoc
MD5 SHA1 SHA512 SSDEEP

Submit Download

CortanaMapiHelper.ProxyStub.sqlite3.module.dll

Path C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-web-app-host.resources\CortanaMapiHelper.ProxyStub.sqlite3.module.dll
Size 359KB
SHA256 da375641c5ad4e752983e0fbcfeb4c6d20e240507331a6fac5f3b32ffe97e6c8
MD5 81a0ebd8d7c725a249d14c403a67a2c0
SHA1 843658a33936628bcb18f4bb8c08b2e0a4643696
SHA512 d5e775ab3d29f5f81a4333b89d44dc0657cfabb382d4567628f11784e4aa85b52dac65e93fb77cba25f1c05cc1e17d3d9a091a72e58a48e63992de9a469fa6d3
SSDEEP 6144:E1CseDp4FvJfBD5w0dsXxJ5Q9XpAyEsr1oLc8INUSyhQhndetEoS:E1QF4dJfBVTm8pAyd6LzINU7QpoSoS
MD5 SHA1 SHA512 SSDEEP

Submit Download

CortanaMapiHelper.ProxyStub.sqlite3.module.dll

Path C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-web-app-host.resources\CortanaMapiHelper.ProxyStub.sqlite3.module.dll
Size 359KB
SHA256 da375641c5ad4e752983e0fbcfeb4c6d20e240507331a6fac5f3b32ffe97e6c8
MD5 81a0ebd8d7c725a249d14c403a67a2c0
SHA1 843658a33936628bcb18f4bb8c08b2e0a4643696
SHA512 d5e775ab3d29f5f81a4333b89d44dc0657cfabb382d4567628f11784e4aa85b52dac65e93fb77cba25f1c05cc1e17d3d9a091a72e58a48e63992de9a469fa6d3
SSDEEP 6144:E1CseDp4FvJfBD5w0dsXxJ5Q9XpAyEsr1oLc8INUSyhQhndetEoS:E1QF4dJfBVTm8pAyd6LzINU7QpoSoS
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2532-133-0x0000000061E00000-0x0000000061ED2000-memory.dmp

Download

memory/2532-134-0x0000000061E00000-0x0000000061ED2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads