Analysis

  • max time kernel
    123s
  • max time network
    181s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    30-06-2022 18:40

General

  • Target

    15a65dbe519ad4f4d024fd1695cd9fb20cadde7a5fb914b63c104edede4c037d.exe

  • Size

    1.8MB

  • MD5

    da0c668fffa87217cfe27c8d89d299ba

  • SHA1

    23c32d49602a5a6a469fb06a395a29e85a0c2c57

  • SHA256

    15a65dbe519ad4f4d024fd1695cd9fb20cadde7a5fb914b63c104edede4c037d

  • SHA512

    fa9af20cfad0eeff8e3f0ab8a3e015c2d61384c078df062119744684b52ad1138f60d61fa37578faf0a79c9be0997939aa69af169a18a9bf03eea85a8c5b38f4

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-directui.resources\1\Information.txt

Family

qulab

Ransom Note
# /===============================\ # |=== QULAB CLIPPER + STEALER ===| # |===============================| # |==== BUY CLIPPER + STEALER ====| # |=== http://teleg.run/QulabZ ===| # \===============================/ Date: 30.06.2022, 21:03:51 Main Information: - OS: Windows 7 X64 / Build: 7601 - UserName: Admin - ComputerName: AUVQQRRF - Processor: Intel Core Processor (Broadwell) - VideoCard: Standard VGA Graphics Adapter - Memory: 2.00 Gb - KeyBoard Layout ID: 00000409 - Resolution: 1280x720x32, 1 GHz Other Information: <error> Soft / Windows Components / Windows Updates: - Adobe AIR - Google Chrome - Microsoft Office Professional Plus 2010 - Adobe AIR - Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 - Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.30.30704 - Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.30.30704 - Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.40660 - Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.40660 - Microsoft Office Professional Plus 2010 - Microsoft Office Access MUI (English) 2010 - Microsoft Office Excel MUI (English) 2010 - Microsoft Office PowerPoint MUI (English) 2010 - Microsoft Office Publisher MUI (English) 2010 - Microsoft Office Outlook MUI (English) 2010 - Microsoft Office Word MUI (English) 2010 - Microsoft Office Proof (English) 2010 - Microsoft Office Proof (French) 2010 - Microsoft Office Proof (Spanish) 2010 - Microsoft Office Proofing (English) 2010 - Microsoft Office InfoPath MUI (English) 2010 - Microsoft Office Shared MUI (English) 2010 - Microsoft Office OneNote MUI (English) 2010 - Microsoft Office Groove MUI (English) 2010 - Microsoft Office Shared Setup Metadata MUI (English) 2010 - Microsoft Office Access Setup Metadata MUI (English) 2010 - Update for Microsoft .NET Framework 4.7.2 (KB4087364) - Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 - Adobe Reader 9 - Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 - Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 - Microsoft Visual C++ 2022 X86 Additional Runtime - 14.30.30704 - Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 - Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.40660 - Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.40660 - Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 - Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.30.30704 Process List: - [System Process] / PID: 0 - System / PID: 4 - smss.exe / PID: 260 - csrss.exe / PID: 336 - wininit.exe / PID: 372 - csrss.exe / PID: 384 - winlogon.exe / PID: 420 - services.exe / PID: 464 - lsass.exe / PID: 480 - lsm.exe / PID: 488 - svchost.exe / PID: 580 - svchost.exe / PID: 660 - svchost.exe / PID: 748 - svchost.exe / PID: 800 - svchost.exe / PID: 836 - svchost.exe / PID: 872 - svchost.exe / PID: 272 - spoolsv.exe / PID: 596 - svchost.exe / PID: 1060 - taskhost.exe / PID: 1116 - dwm.exe / PID: 1180 - explorer.exe / PID: 1244 - svchost.exe / PID: 1844 - sppsvc.exe / PID: 1668 - WMIADAP.exe / PID: 2012 - WmiPrvSE.exe / PID: 832 - avicap.exe / PID: 1484
URLs

http://teleg.run/QulabZ

Signatures

  • Qulab Stealer & Clipper

    Infostealer and clipper created with AutoIt.

  • ACProtect 1.3x - 1.4x DLL software 2 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 1 IoCs
  • Sets file to hidden 1 TTPs 9 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies system certificate store 2 TTPs 2 IoCs
  • NTFS ADS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 52 IoCs
  • Views/modifies file attributes 1 TTPs 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\15a65dbe519ad4f4d024fd1695cd9fb20cadde7a5fb914b63c104edede4c037d.exe
    "C:\Users\Admin\AppData\Local\Temp\15a65dbe519ad4f4d024fd1695cd9fb20cadde7a5fb914b63c104edede4c037d.exe"
    1⤵
    • NTFS ADS
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:1828
    • C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-directui.resources\avicap.exe
      C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-directui.resources\avicap.exe
      2⤵
      • Loads dropped DLL
      • Modifies system certificate store
      • NTFS ADS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1484
      • C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-directui.resources\avicap.module.exe
        C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-directui.resources\avicap.module.exe a -y -mx9 -ssw "C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-directui.resources\ENU_687FE9762211651E9D41.7z" "C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-directui.resources\1\*"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:860
      • C:\Windows\SysWOW64\attrib.exe
        attrib +s +h "C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-directui.resources"
        3⤵
        • Sets file to hidden
        • Views/modifies file attributes
        PID:1756
      • C:\Windows\SysWOW64\attrib.exe
        attrib +s +h "C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-directui.resources"
        3⤵
        • Sets file to hidden
        • Views/modifies file attributes
        PID:1740
      • C:\Windows\SysWOW64\attrib.exe
        attrib +s +h "C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-directui.resources"
        3⤵
        • Sets file to hidden
        • Views/modifies file attributes
        PID:928
      • C:\Windows\SysWOW64\attrib.exe
        attrib +s +h "C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-directui.resources"
        3⤵
        • Sets file to hidden
        • Views/modifies file attributes
        PID:1616
      • C:\Windows\SysWOW64\attrib.exe
        attrib +s +h "C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-directui.resources"
        3⤵
        • Sets file to hidden
        • Views/modifies file attributes
        PID:1516
      • C:\Windows\SysWOW64\attrib.exe
        attrib +s +h "C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-directui.resources"
        3⤵
        • Sets file to hidden
        • Views/modifies file attributes
        PID:1720
      • C:\Windows\SysWOW64\attrib.exe
        attrib +s +h "C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-directui.resources"
        3⤵
        • Sets file to hidden
        • Views/modifies file attributes
        PID:1136
      • C:\Windows\SysWOW64\attrib.exe
        attrib +s +h "C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-directui.resources"
        3⤵
        • Sets file to hidden
        • Views/modifies file attributes
        PID:992
      • C:\Windows\SysWOW64\attrib.exe
        attrib +s +h "C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-directui.resources"
        3⤵
        • Sets file to hidden
        • Views/modifies file attributes
        PID:828
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {D5BC37FA-5177-4553-BBDD-B12646F6524B} S-1-5-21-2277218442-1199762539-2004043321-1000:AUVQQRRF\Admin:Interactive:[1]
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1988
    • C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-directui.resources\avicap.exe
      C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-directui.resources\avicap.exe
      2⤵
      • Drops file in System32 directory
      PID:2020
    • C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-directui.resources\avicap.exe
      C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-directui.resources\avicap.exe
      2⤵
      • Drops file in System32 directory
      PID:1520

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-directui.resources\1\Information.txt

    Filesize

    3KB

    MD5

    0a6c61a18194f495326e7c32d497ebc2

    SHA1

    90bec6a62f9469779beec3b90b2d1363914d7e5d

    SHA256

    06d6e26a2a87b52bc967cd0ad96e3ac26de63a671aff256f306a9881069bdfa1

    SHA512

    8a5d731aa23a3dd43b5807cf6005abbea930c53872b7f49077cb4724a801d71d3b43431f4971ca4d34c65709e5590977893a9ded18cb204725a5186a89849f31

  • C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-directui.resources\1\Screen.jpg

    Filesize

    44KB

    MD5

    16a8a1696e2afda80aeb376015167de6

    SHA1

    474478d796bc10908fced5c67c75f89486be0716

    SHA256

    607ebe922e4f37daf9cb05bdcbf9656d27568f7accd46cf840539a9e8baa8db7

    SHA512

    2ecaa5629c9ecc54243ae7ef571105faa503e1ce5ed9105e6cdd571fdf5561f0753456216ecf01beaff5028c3db5bba289d83971d73485494fbcb250179f2d6d

  • C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-directui.resources\avicap.module.exe

    Filesize

    197KB

    MD5

    946285055913d457fda78a4484266e96

    SHA1

    668661955bf3c20b9dc8cdaa7ec6e8dbbbd63285

    SHA256

    23ca34a7d22fdb7d36014928c089c982cdfb903e9143aea60d38f228c9594beb

    SHA512

    30a490b774d5736215b340d3a192825dc1dfbb7c8d9974c8ab2a09eff2429ed7cf99969ec6d651c8056549798da092ffa600681288dbd7c6f60515acd3630d95

  • \Users\Admin\AppData\Roaming\wow64_microsoft-windows-directui.resources\avicap.module.exe

    Filesize

    197KB

    MD5

    946285055913d457fda78a4484266e96

    SHA1

    668661955bf3c20b9dc8cdaa7ec6e8dbbbd63285

    SHA256

    23ca34a7d22fdb7d36014928c089c982cdfb903e9143aea60d38f228c9594beb

    SHA512

    30a490b774d5736215b340d3a192825dc1dfbb7c8d9974c8ab2a09eff2429ed7cf99969ec6d651c8056549798da092ffa600681288dbd7c6f60515acd3630d95

  • \Users\Admin\AppData\Roaming\wow64_microsoft-windows-directui.resources\avicap.module.exe

    Filesize

    197KB

    MD5

    946285055913d457fda78a4484266e96

    SHA1

    668661955bf3c20b9dc8cdaa7ec6e8dbbbd63285

    SHA256

    23ca34a7d22fdb7d36014928c089c982cdfb903e9143aea60d38f228c9594beb

    SHA512

    30a490b774d5736215b340d3a192825dc1dfbb7c8d9974c8ab2a09eff2429ed7cf99969ec6d651c8056549798da092ffa600681288dbd7c6f60515acd3630d95

  • \Users\Admin\AppData\Roaming\wow64_microsoft-windows-directui.resources\avicap.sqlite3.module.dll

    Filesize

    360KB

    MD5

    8c127ce55bfbb55eb9a843c693c9f240

    SHA1

    75c462c935a7ff2c90030c684440d61d48bb1858

    SHA256

    4f93f3543139febb91e0c95dc9351008e9147a484732ee5962c7df64f6868028

    SHA512

    d3578bd7ef01f9e25983c24eb9bb33f25c37d650cc79b823c3ec19f196d4a00deb506c1e1f774f15e5664d5263b02570fec11b322022b90a0ff1b10943188a02

  • \Users\Admin\AppData\Roaming\wow64_microsoft-windows-directui.resources\avicap.sqlite3.module.dll

    Filesize

    360KB

    MD5

    8c127ce55bfbb55eb9a843c693c9f240

    SHA1

    75c462c935a7ff2c90030c684440d61d48bb1858

    SHA256

    4f93f3543139febb91e0c95dc9351008e9147a484732ee5962c7df64f6868028

    SHA512

    d3578bd7ef01f9e25983c24eb9bb33f25c37d650cc79b823c3ec19f196d4a00deb506c1e1f774f15e5664d5263b02570fec11b322022b90a0ff1b10943188a02

  • memory/860-67-0x0000000000400000-0x000000000047D000-memory.dmp

    Filesize

    500KB

  • memory/1484-60-0x0000000061E00000-0x0000000061ED2000-memory.dmp

    Filesize

    840KB

  • memory/1484-59-0x0000000061E00000-0x0000000061ED2000-memory.dmp

    Filesize

    840KB

  • memory/1484-68-0x0000000003D80000-0x0000000003DFD000-memory.dmp

    Filesize

    500KB

  • memory/1484-69-0x0000000003D80000-0x0000000003DFD000-memory.dmp

    Filesize

    500KB

  • memory/1828-54-0x0000000076191000-0x0000000076193000-memory.dmp

    Filesize

    8KB