qulab | ad6424fee90ec1b16258ed0118825fceb07d36c6287202f99a8703280e269a4b

General

Target

ad6424fee90ec1b16258ed0118825fceb07d36c6287202f99a8703280e269a4b.exe
Size

1.8MB
MD5

90dd28091c72a3458f3b52460768f254
SHA1

a046933a654a5e92edb94b08f5e83ff8f89b38eb
SHA256

ad6424fee90ec1b16258ed0118825fceb07d36c6287202f99a8703280e269a4b
SHA512

62bb197d4c0db490402fc6337d36da529f0d96e454c95c01df38e52798abc6afb14ce0a734de66b071b06d9cd7e700ffea04e445c70a896f007a2b761a3f113e

Score

10^/10

qulab discovery evasion ransomware spyware stealer upx

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\1\Information.txt

Family

qulab

Ransom Note

# /===============================\ # |=== QULAB CLIPPER + STEALER ===| # |===============================| # |==== BUY CLIPPER + STEALER ====| # |=== http://teleg.run/QulabZ ===| # \===============================/ Date: 01.07.2022, 09:07:35 Main Information: - OS: Windows 7 X64 / Build: 7601 - UserName: Admin - ComputerName: TVHJCWMH - Processor: Intel Core Processor (Broadwell) - VideoCard: Standard VGA Graphics Adapter - Memory: 2.00 Gb - KeyBoard Layout ID: 00000409 - Resolution: 1280x720x32, 1 GHz Other Information: <error> Soft / Windows Components / Windows Updates: - Adobe AIR - Google Chrome - Microsoft Office Professional Plus 2010 - Adobe AIR - Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 - Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.30.30704 - Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.30.30704 - Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.40660 - Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.40660 - Microsoft Office Professional Plus 2010 - Microsoft Office Access MUI (English) 2010 - Microsoft Office Excel MUI (English) 2010 - Microsoft Office PowerPoint MUI (English) 2010 - Microsoft Office Publisher MUI (English) 2010 - Microsoft Office Outlook MUI (English) 2010 - Microsoft Office Word MUI (English) 2010 - Microsoft Office Proof (English) 2010 - Microsoft Office Proof (French) 2010 - Microsoft Office Proof (Spanish) 2010 - Microsoft Office Proofing (English) 2010 - Microsoft Office InfoPath MUI (English) 2010 - Microsoft Office Shared MUI (English) 2010 - Microsoft Office OneNote MUI (English) 2010 - Microsoft Office Groove MUI (English) 2010 - Microsoft Office Shared Setup Metadata MUI (English) 2010 - Microsoft Office Access Setup Metadata MUI (English) 2010 - Update for Microsoft .NET Framework 4.7.2 (KB4087364) - Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 - Adobe Reader 9 - Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 - Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 - Microsoft Visual C++ 2022 X86 Additional Runtime - 14.30.30704 - Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 - Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.40660 - Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.40660 - Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 - Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.30.30704 Process List: - [System Process] / PID: 0 - System / PID: 4 - smss.exe / PID: 260 - csrss.exe / PID: 332 - wininit.exe / PID: 360 - csrss.exe / PID: 380 - winlogon.exe / PID: 420 - services.exe / PID: 464 - lsass.exe / PID: 480 - lsm.exe / PID: 488 - svchost.exe / PID: 592 - svchost.exe / PID: 672 - svchost.exe / PID: 748 - svchost.exe / PID: 808 - svchost.exe / PID: 844 - svchost.exe / PID: 876 - svchost.exe / PID: 328 - spoolsv.exe / PID: 1036 - taskhost.exe / PID: 1064 - svchost.exe / PID: 1136 - dwm.exe / PID: 1152 - explorer.exe / PID: 1192 - svchost.exe / PID: 1800 - sppsvc.exe / PID: 1736 - WMIADAP.exe / PID: 2004 - wscisvif.exe / PID: 1436

URLs

http://teleg.run/QulabZ

Signatures

Qulab Stealer & Clipper
Infostealer and clipper created with AutoIt.
stealer qulab

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.sqlite3.module.dll	acprotect
\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.sqlite3.module.dll	acprotect

Executes dropped EXE 1 IoCs

Processes:

wscisvif.module.exe

pid process

764 wscisvif.module.exe
Sets file to hidden 1 TTPs 1 IoCs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exe

pid process

1600 attrib.exe

pid	process
764	wscisvif.module.exe

pid	process
1600	attrib.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.sqlite3.module.dll	upx
\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.sqlite3.module.dll	upx
\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.module.exe	upx
\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.module.exe	upx
C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.module.exe	upx
behavioral1/memory/764-67-0x0000000000400000-0x000000000047D000-memory.dmp	upx

Loads dropped DLL 4 IoCs

Processes:

wscisvif.exe

pid process

1436 wscisvif.exe
1436 wscisvif.exe
1436 wscisvif.exe
1436 wscisvif.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 ipapi.co
6 ipapi.co

pid	process
1436	wscisvif.exe
1436	wscisvif.exe
1436	wscisvif.exe
1436	wscisvif.exe

flow	ioc
4	ipapi.co
6	ipapi.co

Drops file in System32 directory 2 IoCs

Processes:

wscisvif.exewscisvif.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\winmgmts:\localhost\	wscisvif.exe
File opened for modification	C:\Windows\SysWOW64\winmgmts:\localhost\	wscisvif.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NTFS ADS 2 IoCs

Processes:

ad6424fee90ec1b16258ed0118825fceb07d36c6287202f99a8703280e269a4b.exewscisvif.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\winmgmts:\localhost\	ad6424fee90ec1b16258ed0118825fceb07d36c6287202f99a8703280e269a4b.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\winmgmts:\localhost\	wscisvif.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

wscisvif.exe

pid process

1436 wscisvif.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

ad6424fee90ec1b16258ed0118825fceb07d36c6287202f99a8703280e269a4b.exe

pid process

2016 ad6424fee90ec1b16258ed0118825fceb07d36c6287202f99a8703280e269a4b.exe

pid	process
1436	wscisvif.exe

pid	process
2016	ad6424fee90ec1b16258ed0118825fceb07d36c6287202f99a8703280e269a4b.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

wscisvif.module.exe

description	pid	process
Token: SeRestorePrivilege	764	wscisvif.module.exe
Token: 35	764	wscisvif.module.exe
Token: SeSecurityPrivilege	764	wscisvif.module.exe
Token: SeSecurityPrivilege	764	wscisvif.module.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

ad6424fee90ec1b16258ed0118825fceb07d36c6287202f99a8703280e269a4b.exewscisvif.exetaskeng.exe

description	pid	process	target process
PID 2016 wrote to memory of 1436	2016	ad6424fee90ec1b16258ed0118825fceb07d36c6287202f99a8703280e269a4b.exe	wscisvif.exe
PID 2016 wrote to memory of 1436	2016	ad6424fee90ec1b16258ed0118825fceb07d36c6287202f99a8703280e269a4b.exe	wscisvif.exe
PID 2016 wrote to memory of 1436	2016	ad6424fee90ec1b16258ed0118825fceb07d36c6287202f99a8703280e269a4b.exe	wscisvif.exe
PID 2016 wrote to memory of 1436	2016	ad6424fee90ec1b16258ed0118825fceb07d36c6287202f99a8703280e269a4b.exe	wscisvif.exe
PID 1436 wrote to memory of 764	1436	wscisvif.exe	wscisvif.module.exe
PID 1436 wrote to memory of 764	1436	wscisvif.exe	wscisvif.module.exe
PID 1436 wrote to memory of 764	1436	wscisvif.exe	wscisvif.module.exe
PID 1436 wrote to memory of 764	1436	wscisvif.exe	wscisvif.module.exe
PID 1436 wrote to memory of 1600	1436	wscisvif.exe	attrib.exe
PID 1436 wrote to memory of 1600	1436	wscisvif.exe	attrib.exe
PID 1436 wrote to memory of 1600	1436	wscisvif.exe	attrib.exe
PID 1436 wrote to memory of 1600	1436	wscisvif.exe	attrib.exe
PID 1480 wrote to memory of 924	1480	taskeng.exe	wscisvif.exe
PID 1480 wrote to memory of 924	1480	taskeng.exe	wscisvif.exe
PID 1480 wrote to memory of 924	1480	taskeng.exe	wscisvif.exe
PID 1480 wrote to memory of 924	1480	taskeng.exe	wscisvif.exe
PID 1480 wrote to memory of 1976	1480	taskeng.exe	wscisvif.exe
PID 1480 wrote to memory of 1976	1480	taskeng.exe	wscisvif.exe
PID 1480 wrote to memory of 1976	1480	taskeng.exe	wscisvif.exe
PID 1480 wrote to memory of 1976	1480	taskeng.exe	wscisvif.exe

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exe

pid process

1600 attrib.exe

pid	process
1600	attrib.exe

C:\Users\Admin\AppData\Local\Temp\ad6424fee90ec1b16258ed0118825fceb07d36c6287202f99a8703280e269a4b.exe
"C:\Users\Admin\AppData\Local\Temp\ad6424fee90ec1b16258ed0118825fceb07d36c6287202f99a8703280e269a4b.exe"
1⤵
- NTFS ADS
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2016

C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.exe
C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.exe
2⤵
- Loads dropped DLL
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1436

C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.module.exe
C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.module.exe a -y -mx9 -ssw "C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\ENU_687FE978D73A864E9D41.7z" "C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\1\*"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:764

C:\Windows\SysWOW64\attrib.exe
attrib +s +h "C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources"
3⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1600

C:\Windows\system32\taskeng.exe
taskeng.exe {308DFB93-041A-4C8A-8533-3782E6B0218E} S-1-5-21-790309383-526510583-3802439154-1000:TVHJCWMH\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1480

C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.exe
C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.exe
2⤵
- Drops file in System32 directory
PID:924

C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.exe
C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.exe
2⤵
- Drops file in System32 directory
PID:1976

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

2

T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

2

T1158

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\1\Information.txt
Filesize
3KB

MD5
12e2a0d9873ed54be3a5480c5166fad6

SHA1
6a4350a4d33a840c3ff327c3f41278641ea13587

SHA256
9d70485e5364451ec1e2ce552c0ee1c82d97b9c044363095b59cb9a8ef7f33ac

SHA512
0e13222d5b304f06005302d6d1fbf1e20084bae0cb6531148fd7305558f7e4ab68169157670eb4cb40bb824ee3fd7321cfca25342124b19a0336f4c742e2ddf3

Download Submit
C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\1\Screen.jpg
Filesize
47KB

MD5
521b2a2a524f12589f81158e124792b5

SHA1
fccf445738b448bc66d2d466d29f4d5d4de46102

SHA256
29653e24c169beb3c6979b93d3e52b9f9c2f7c18906f710dba1b7b7bd52e7b64

SHA512
2be19e4979114a679999dfe86139c4eddb4e54bb3533e251fb35b50f5671f255727efcfce00132c9632e494f87d234f4d1ec78d7b8e2d8395e9deaeba25ed7c1

Download Submit
C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.module.exe
Filesize
197KB

MD5
946285055913d457fda78a4484266e96

SHA1
668661955bf3c20b9dc8cdaa7ec6e8dbbbd63285

SHA256
23ca34a7d22fdb7d36014928c089c982cdfb903e9143aea60d38f228c9594beb

SHA512
30a490b774d5736215b340d3a192825dc1dfbb7c8d9974c8ab2a09eff2429ed7cf99969ec6d651c8056549798da092ffa600681288dbd7c6f60515acd3630d95

Download Submit
\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.module.exe
Filesize
197KB

MD5
946285055913d457fda78a4484266e96

SHA1
668661955bf3c20b9dc8cdaa7ec6e8dbbbd63285

SHA256
23ca34a7d22fdb7d36014928c089c982cdfb903e9143aea60d38f228c9594beb

SHA512
30a490b774d5736215b340d3a192825dc1dfbb7c8d9974c8ab2a09eff2429ed7cf99969ec6d651c8056549798da092ffa600681288dbd7c6f60515acd3630d95

Download Submit
\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.module.exe
Filesize
197KB

MD5
946285055913d457fda78a4484266e96

SHA1
668661955bf3c20b9dc8cdaa7ec6e8dbbbd63285

SHA256
23ca34a7d22fdb7d36014928c089c982cdfb903e9143aea60d38f228c9594beb

SHA512
30a490b774d5736215b340d3a192825dc1dfbb7c8d9974c8ab2a09eff2429ed7cf99969ec6d651c8056549798da092ffa600681288dbd7c6f60515acd3630d95

Download Submit
\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.sqlite3.module.dll
Filesize
360KB

MD5
8c127ce55bfbb55eb9a843c693c9f240

SHA1
75c462c935a7ff2c90030c684440d61d48bb1858

SHA256
4f93f3543139febb91e0c95dc9351008e9147a484732ee5962c7df64f6868028

SHA512
d3578bd7ef01f9e25983c24eb9bb33f25c37d650cc79b823c3ec19f196d4a00deb506c1e1f774f15e5664d5263b02570fec11b322022b90a0ff1b10943188a02

Download Submit
\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.sqlite3.module.dll
Filesize
360KB

MD5
8c127ce55bfbb55eb9a843c693c9f240

SHA1
75c462c935a7ff2c90030c684440d61d48bb1858

SHA256
4f93f3543139febb91e0c95dc9351008e9147a484732ee5962c7df64f6868028

SHA512
d3578bd7ef01f9e25983c24eb9bb33f25c37d650cc79b823c3ec19f196d4a00deb506c1e1f774f15e5664d5263b02570fec11b322022b90a0ff1b10943188a02

Download Submit
memory/764-67-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download
memory/764-63-0x0000000000000000-mapping.dmp

Download
memory/924-71-0x0000000000000000-mapping.dmp

Download
memory/1436-60-0x0000000061E00000-0x0000000061ED2000-memory.dmp

Filesize
840KB

Download
memory/1436-59-0x0000000061E00000-0x0000000061ED2000-memory.dmp

Filesize
840KB

Download
memory/1436-55-0x0000000000000000-mapping.dmp

Download
memory/1436-68-0x0000000003BB0000-0x0000000003C2D000-memory.dmp

Filesize
500KB

Download
memory/1436-69-0x0000000003BB0000-0x0000000003C2D000-memory.dmp

Filesize
500KB

Download
memory/1600-70-0x0000000000000000-mapping.dmp

Download
memory/1976-73-0x0000000000000000-mapping.dmp

Download
memory/2016-54-0x0000000075191000-0x0000000075193000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads