Overview

overview

10

Static

static

5

358928e393...20.exe

windows7_x64

10

358928e393...20.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    137s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    26-06-2022 23:52

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    358928e393e91937f17a754c2fca43d8eedc2d797e960610d9a35c4190197020.exe

  • Size

    1.6MB

  • MD5

    cfe244a13a7c4c4b6d4490efa712f32f

  • SHA1

    ab66780f1ed25f841142ba142f973ae4924af479

  • SHA256

    358928e393e91937f17a754c2fca43d8eedc2d797e960610d9a35c4190197020

  • SHA512

    57d4561ff936bce62afeb480bc40cfe04ddbc1b40ad0495a5d29786b6c1695384dbf11057347f31ad797736965d2cc5d33059966410ec31e218839e55ce7e371

Score
10/10
qulabdiscoveryransomwarespywarestealerupx

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-web-app-host.resources\1\Information.txt

Family

qulab

Ransom Note
# /===============================\ # |=== QULAB CLIPPER + STEALER ===| # |===============================| # |==== BUY CLIPPER + STEALER ====| # |=== http://teleg.run/QulabZ ===| # \===============================/ Date: 27.06.2022 Time: 02:06:05 OS: Windows 10 X64 / Build: 19041 UserName: Admin ComputerName: FSHLRPTB Processor: Intel Core Processor (Broadwell) VideoCard: Microsoft Basic Display Adapter Memory: 4.00 Gb KeyBoard Layout ID: 00000409 Resolution: 1280x720x32, 64 GHz Other Information: <error> Soft / Windows Components / Windows Updates: - Google Chrome - Microsoft Edge - Microsoft Edge Update - Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 - Java Auto Updater - Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.30.30704 - Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.30.30704 - Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.40660 - Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.40660 - Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 - Adobe Acrobat Reader DC - Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 - Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 - Microsoft Visual C++ 2022 X86 Additional Runtime - 14.30.30704 - Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 - Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.40660 - Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.40660 - Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 - Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.30.30704 Process List: - [System Process] / PID: 0 - System / PID: 4 - Registry / PID: 92 - smss.exe / PID: 364 - csrss.exe / PID: 452 - wininit.exe / PID: 544 - csrss.exe / PID: 552 - winlogon.exe / PID: 636 - services.exe / PID: 680 - lsass.exe / PID: 696 - svchost.exe / PID: 808 - fontdrvhost.exe / PID: 828 - fontdrvhost.exe / PID: 836 - svchost.exe / PID: 932 - svchost.exe / PID: 980 - dwm.exe / PID: 408 - svchost.exe / PID: 420 - svchost.exe / PID: 868 - svchost.exe / PID: 388 - svchost.exe / PID: 1044 - svchost.exe / PID: 1076 - svchost.exe / PID: 1140 - svchost.exe / PID: 1184 - svchost.exe / PID: 1212 - svchost.exe / PID: 1252 - svchost.exe / PID: 1316 - svchost.exe / PID: 1380 - svchost.exe / PID: 1428 - svchost.exe / PID: 1440 - svchost.exe / PID: 1500 - svchost.exe / PID: 1592 - svchost.exe / PID: 1656 - svchost.exe / PID: 1668 - svchost.exe / PID: 1696 - svchost.exe / PID: 1800 - svchost.exe / PID: 1828 - svchost.exe / PID: 1940 - svchost.exe / PID: 1948 - svchost.exe / PID: 1956 - svchost.exe / PID: 2024 - spoolsv.exe / PID: 1540 - svchost.exe / PID: 2068 - svchost.exe / PID: 2108 - svchost.exe / PID: 2120 - sihost.exe / PID: 2352 - svchost.exe / PID: 2360 - svchost.exe / PID: 2476 - taskhostw.exe / PID: 2484 - svchost.exe / PID: 2492 - OfficeClickToRun.exe / PID: 2672 - svchost.exe / PID: 2684 - svchost.exe / PID: 2748 - svchost.exe / PID: 2756 - svchost.exe / PID: 2768 - svchost.exe / PID: 2776 - svchost.exe / PID: 3008 - explorer.exe / PID: 3060 - svchost.exe / PID: 800 - dllhost.exe / PID: 3248 - StartMenuExperienceHost.exe / PID: 3344 - dllhost.exe / PID: 3392 - RuntimeBroker.exe / PID: 3460 - SearchApp.exe / PID: 3548 - RuntimeBroker.exe / PID: 3752 - RuntimeBroker.exe / PID: 64 - svchost.exe / PID: 4480 - svchost.exe / PID: 4540 - svchost.exe / PID: 4620 - sppsvc.exe / PID: 4652 - svchost.exe / PID: 3184 - svchost.exe / PID: 4136 - svchost.exe / PID: 2692 - SppExtComObj.Exe / PID: 3696 - svchost.exe / PID: 4444 - svchost.exe / PID: 4928 - upfc.exe / PID: 3572 - svchost.exe / PID: 3760 - CortanaMapiHelper.ProxyStub.exe / PID: 2532 - WaaSMedicAgent.exe / PID: 4328 - conhost.exe / PID: 2396 - svchost.exe / PID: 2784
URLs

http://teleg.run/QulabZ

Signatures

  • Qulab Stealer & Clipper

    Infostealer and clipper created with AutoIt.

    stealerqulab
  • ACProtect 1.3x - 1.4x DLL software 2 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • NTFS ADS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\358928e393e91937f17a754c2fca43d8eedc2d797e960610d9a35c4190197020.exe
    "C:\Users\Admin\AppData\Local\Temp\358928e393e91937f17a754c2fca43d8eedc2d797e960610d9a35c4190197020.exe"
    1⤵
    • NTFS ADS
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:4888
    • C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-web-app-host.resources\CortanaMapiHelper.ProxyStub.exe
      C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-web-app-host.resources\CortanaMapiHelper.ProxyStub.exe
      2⤵
      • Loads dropped DLL
      • NTFS ADS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2532
      • C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-web-app-host.resources\CortanaMapiHelper.ProxyStub.module.exe
        C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-web-app-host.resources\CortanaMapiHelper.ProxyStub.module.exe a -y "C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-web-app-host.resources\41646D696E4653484C5250544257494E5F313058.7z" "C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-web-app-host.resources\1\*"
        3⤵
        • Executes dropped EXE
        PID:276
  • C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-web-app-host.resources\CortanaMapiHelper.ProxyStub.exe
    C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-web-app-host.resources\CortanaMapiHelper.ProxyStub.exe
    1⤵
    • Drops file in System32 directory
    PID:4304
  • C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-web-app-host.resources\CortanaMapiHelper.ProxyStub.exe
    C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-web-app-host.resources\CortanaMapiHelper.ProxyStub.exe
    1⤵
    • Drops file in System32 directory
    PID:3196

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-web-app-host.resources\1\Information.txt
    Filesize

    3KB

    MD5

    37f4aa89a0725a215a2fb993bd6dfbdc

    SHA1

    2706bbdbccf6a7eebb7e83ef94d9d6ac476f9451

    SHA256

    773dc0ab88e38b6ab1a8f5f82985c34e16a817a7f88c9565d41f7a40d21823e9

    SHA512

    723960d444b74f2bba7492f73bcb4c0f7795e32bb10ecb237b86485fa8b832c57193fdb6c7060e5b48df011cefd3cabc2b395b63ff242cb33757144bf3f91811

    Download Submit

  • C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-web-app-host.resources\1\Screen.jpg
    Filesize

    47KB

    MD5

    e1d90981393ea298b1fef240bdeabbbc

    SHA1

    6d09ffb4ffa85168b8c561ad8ae018d467b3a5ea

    SHA256

    699f190151df9a0a261322a430465f07fc7e73556c0008a1634d4324a707bdc8

    SHA512

    f82a6d8379a478241ede75ca682bc957a7228bcb68282d0f4b6f145d09622950af90f7fb8031c22a1903608e9c517d0a29ee371aa7e8178cb8a64f6d392d2603

    Download Submit

  • C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-web-app-host.resources\CortanaMapiHelper.ProxyStub.module.exe
    Filesize

    325KB

    MD5

    0668ef8068965996eb556fe0022c3459

    SHA1

    2bf527ce2db7e7a68e53467be9b0d71c06de4d6f

    SHA256

    ee7b61ff0adf48cc99ff45ae651f3793996fd85428984545ede59ba778f2d620

    SHA512

    b544b4d77741224bf919c67a7aea16475accd5e3858fb0b113619c8e18586ca7ee2a54ae5650d36c3a6342d9a19fe18a3842b1ea72ec436ec0898870cec1fb7d

    Download Submit

  • C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-web-app-host.resources\CortanaMapiHelper.ProxyStub.module.exe
    Filesize

    325KB

    MD5

    0668ef8068965996eb556fe0022c3459

    SHA1

    2bf527ce2db7e7a68e53467be9b0d71c06de4d6f

    SHA256

    ee7b61ff0adf48cc99ff45ae651f3793996fd85428984545ede59ba778f2d620

    SHA512

    b544b4d77741224bf919c67a7aea16475accd5e3858fb0b113619c8e18586ca7ee2a54ae5650d36c3a6342d9a19fe18a3842b1ea72ec436ec0898870cec1fb7d

    Download Submit

  • C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-web-app-host.resources\CortanaMapiHelper.ProxyStub.sqlite3.module.dll
    Filesize

    359KB

    MD5

    81a0ebd8d7c725a249d14c403a67a2c0

    SHA1

    843658a33936628bcb18f4bb8c08b2e0a4643696

    SHA256

    da375641c5ad4e752983e0fbcfeb4c6d20e240507331a6fac5f3b32ffe97e6c8

    SHA512

    d5e775ab3d29f5f81a4333b89d44dc0657cfabb382d4567628f11784e4aa85b52dac65e93fb77cba25f1c05cc1e17d3d9a091a72e58a48e63992de9a469fa6d3

    Download Submit

  • C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-web-app-host.resources\CortanaMapiHelper.ProxyStub.sqlite3.module.dll
    Filesize

    359KB

    MD5

    81a0ebd8d7c725a249d14c403a67a2c0

    SHA1

    843658a33936628bcb18f4bb8c08b2e0a4643696

    SHA256

    da375641c5ad4e752983e0fbcfeb4c6d20e240507331a6fac5f3b32ffe97e6c8

    SHA512

    d5e775ab3d29f5f81a4333b89d44dc0657cfabb382d4567628f11784e4aa85b52dac65e93fb77cba25f1c05cc1e17d3d9a091a72e58a48e63992de9a469fa6d3

    Download Submit

  • memory/276-135-0x0000000000000000-mapping.dmp

    Download

  • memory/2532-130-0x0000000000000000-mapping.dmp

    Download

  • memory/2532-133-0x0000000061E00000-0x0000000061ED2000-memory.dmp

    Filesize

    840KB

    Download

  • memory/2532-134-0x0000000061E00000-0x0000000061ED2000-memory.dmp

    Filesize

    840KB

    Download