qulab | 58fdef0ce9400990141d80e87e636dc61c8d0d320a6b5996274f774a0cb19ee3

General

Target

58fdef0ce9400990141d80e87e636dc61c8d0d320a6b5996274f774a0cb19ee3.exe
Size

1.8MB
MD5

073b241eb2c930735b7018c70d19d989
SHA1

4010568d660b07da6b3405d137181423ee23d956
SHA256

58fdef0ce9400990141d80e87e636dc61c8d0d320a6b5996274f774a0cb19ee3
SHA512

ed118dfd74356dbcec198d9f6acc64803c0923a9895929225cbcaf5b966a3c6ae40dc6d97f4ae8e6b2a55237470bfe8577dfd6a275898ed37d5b9fadb7985efc

Score

10^/10

qulab discovery ransomware spyware stealer upx

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-d..iagnostic.resources\1\Information.txt

Family

qulab

Ransom Note

# /===============================\ # |=== QULAB CLIPPER + STEALER ===| # |===============================| # |==== BUY CLIPPER + STEALER ====| # |=== http://teleg.run/QulabZ ===| # \===============================/ Date: 25.07.2022, 15:33:37 Main Information: - OS: Windows 10 X64 / Build: 19041 - UserName: Admin - ComputerName: LNYFGEHI - Processor: Intel Core Processor (Broadwell) - VideoCard: Microsoft Basic Display Adapter - Memory: 4.00 Gb - KeyBoard Layout ID: 00000409 - Resolution: 1280x720x32, 64 GHz Other Information: <error> Soft / Windows Components / Windows Updates: - Google Chrome - Microsoft Edge - Microsoft Edge Update - Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 - Java Auto Updater - Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.30.30704 - Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.30.30704 - Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.40660 - Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.40660 - Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 - Adobe Acrobat Reader DC - Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 - Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 - Microsoft Visual C++ 2022 X86 Additional Runtime - 14.30.30704 - Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 - Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.40660 - Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.40660 - Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 - Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.30.30704 Process List: - [System Process] / PID: 0 - System / PID: 4 - Registry / PID: 92 - smss.exe / PID: 356 - csrss.exe / PID: 440 - wininit.exe / PID: 524 - csrss.exe / PID: 532 - winlogon.exe / PID: 604 - services.exe / PID: 664 - lsass.exe / PID: 676 - fontdrvhost.exe / PID: 784 - fontdrvhost.exe / PID: 792 - svchost.exe / PID: 800 - svchost.exe / PID: 912 - svchost.exe / PID: 964 - dwm.exe / PID: 388 - svchost.exe / PID: 744 - svchost.exe / PID: 312 - svchost.exe / PID: 636 - svchost.exe / PID: 1032 - svchost.exe / PID: 1080 - svchost.exe / PID: 1160 - svchost.exe / PID: 1204 - svchost.exe / PID: 1212 - svchost.exe / PID: 1284 - svchost.exe / PID: 1304 - svchost.exe / PID: 1348 - svchost.exe / PID: 1416 - svchost.exe / PID: 1464 - svchost.exe / PID: 1500 - svchost.exe / PID: 1608 - svchost.exe / PID: 1672 - svchost.exe / PID: 1688 - svchost.exe / PID: 1696 - svchost.exe / PID: 1808 - svchost.exe / PID: 1848 - svchost.exe / PID: 1924 - svchost.exe / PID: 1932 - svchost.exe / PID: 2024 - svchost.exe / PID: 928 - spoolsv.exe / PID: 2068 - svchost.exe / PID: 2156 - svchost.exe / PID: 2164 - svchost.exe / PID: 2200 - svchost.exe / PID: 2428 - svchost.exe / PID: 2436 - sihost.exe / PID: 2532 - svchost.exe / PID: 2544 - OfficeClickToRun.exe / PID: 2628 - svchost.exe / PID: 2644 - svchost.exe / PID: 2680 - svchost.exe / PID: 2700 - svchost.exe / PID: 2716 - taskhostw.exe / PID: 2728 - svchost.exe / PID: 2736 - svchost.exe / PID: 3068 - explorer.exe / PID: 692 - svchost.exe / PID: 3112 - dllhost.exe / PID: 3312 - StartMenuExperienceHost.exe / PID: 3408 - dllhost.exe / PID: 3416 - RuntimeBroker.exe / PID: 3540 - SearchApp.exe / PID: 3624 - RuntimeBroker.exe / PID: 3816 - RuntimeBroker.exe / PID: 3672 - svchost.exe / PID: 4536 - svchost.exe / PID: 4592 - svchost.exe / PID: 4676 - sppsvc.exe / PID: 4220 - svchost.exe / PID: 1196 - svchost.exe / PID: 4500 - svchost.exe / PID: 2664 - WmiPrvSE.exe / PID: 4660 - SppExtComObj.Exe / PID: 4612 - svchost.exe / PID: 3608 - RuntimeBroker.exe / PID: 4608 - svchost.exe / PID: 4816 - upfc.exe / PID: 2748 - backgroundTaskHost.exe / PID: 4576 - backgroundTaskHost.exe / PID: 4656 - mfc40.exe / PID: 2972

URLs

http://teleg.run/QulabZ

Signatures

Qulab Stealer & Clipper
Infostealer and clipper created with AutoIt.
stealer qulab

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0006000000022f1e-131.dat	acprotect
behavioral2/files/0x0006000000022f1e-132.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
3404	mfc40.module.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0006000000022f1e-131.dat	upx
behavioral2/files/0x0006000000022f1e-132.dat	upx
behavioral2/files/0x0007000000022f27-136.dat	upx
behavioral2/memory/3404-137-0x0000000000400000-0x000000000048E000-memory.dmp	upx
behavioral2/files/0x0007000000022f27-138.dat	upx
behavioral2/memory/3404-141-0x0000000000400000-0x000000000048E000-memory.dmp	upx

Loads dropped DLL 2 IoCs

pid	Process
2972	mfc40.exe
2972	mfc40.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
12	ipapi.co
13	ipapi.co

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\winmgmts:\localhost\	mfc40.exe
File opened for modification	C:\Windows\SysWOW64\winmgmts:\localhost\	mfc40.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\winmgmts:\localhost\	58fdef0ce9400990141d80e87e636dc61c8d0d320a6b5996274f774a0cb19ee3.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-d..iagnostic.resources\winmgmts:\localhost\	mfc40.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	17	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2972	mfc40.exe
2972	mfc40.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4128	58fdef0ce9400990141d80e87e636dc61c8d0d320a6b5996274f774a0cb19ee3.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	3404	mfc40.module.exe
Token: 35	3404	mfc40.module.exe
Token: SeSecurityPrivilege	3404	mfc40.module.exe
Token: SeSecurityPrivilege	3404	mfc40.module.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4128 wrote to memory of 2972	4128	58fdef0ce9400990141d80e87e636dc61c8d0d320a6b5996274f774a0cb19ee3.exe	81
PID 4128 wrote to memory of 2972	4128	58fdef0ce9400990141d80e87e636dc61c8d0d320a6b5996274f774a0cb19ee3.exe	81
PID 4128 wrote to memory of 2972	4128	58fdef0ce9400990141d80e87e636dc61c8d0d320a6b5996274f774a0cb19ee3.exe	81
PID 2972 wrote to memory of 3404	2972	mfc40.exe	82
PID 2972 wrote to memory of 3404	2972	mfc40.exe	82
PID 2972 wrote to memory of 3404	2972	mfc40.exe	82

C:\Users\Admin\AppData\Local\Temp\58fdef0ce9400990141d80e87e636dc61c8d0d320a6b5996274f774a0cb19ee3.exe
"C:\Users\Admin\AppData\Local\Temp\58fdef0ce9400990141d80e87e636dc61c8d0d320a6b5996274f774a0cb19ee3.exe"
1⤵
- NTFS ADS
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4128
- C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-d..iagnostic.resources\mfc40.exe
  C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-d..iagnostic.resources\mfc40.exe
  2⤵
  - Loads dropped DLL
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2972
- - C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-d..iagnostic.resources\mfc40.module.exe
    C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-d..iagnostic.resources\mfc40.module.exe a -y -mx9 -ssw "C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-d..iagnostic.resources\ENU_801FE97985769ECE9D41.7z" "C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-d..iagnostic.resources\1\*"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:3404

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-d..iagnostic.resources\mfc40.exe
C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-d..iagnostic.resources\mfc40.exe
1⤵
- Drops file in System32 directory
PID:1300

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-d..iagnostic.resources\mfc40.exe
C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-d..iagnostic.resources\mfc40.exe
1⤵
- Drops file in System32 directory
PID:644

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-d..iagnostic.resources\1\Information.txt

Filesize
3KB

MD5
a5a2fd479390bf6c208d59f1c50a121d

SHA1
ba47051b1c44c331d474ad3f69308ef7e1c4d7ce

SHA256
5f4b16ba18c63c8481f22bc72f83ead5639af08b630ba3fd4ef65c6dcad8418e

SHA512
f7a2dea05a31f81174cdc065f2720693346c31c70afdac7cc08112814cd2ab68ecc6278ccb84e269486e6b8a53754a305727cc9e675b7dd5f391d410289867f5

Download Submit
C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-d..iagnostic.resources\1\Screen.jpg

Filesize
52KB

MD5
044e384671dd074137cc21f4b32e873a

SHA1
25bec3d31e68bac891d653cdec073c47a1a402cc

SHA256
000c8b295df49ab637a6baac62f2cc51634874ecbd451fee14f29e60c3295253

SHA512
7ee5eac3e6f086d2e295613ead296507a5a5f5ad00a34794ffbf47711febff29550a4891d041c4c658023975863f674f8743810cb45d428d84c9e6114fdbcde0

Download Submit
C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-d..iagnostic.resources\ENU_801FE97985769ECE9D41.7z

Filesize
46KB

MD5
bc246af96e1a4bbc51aa7d26466cfc34

SHA1
5c1fd3518dfd33ef0c7312c084d64b6fab2cd00d

SHA256
d09f72ba3db3f6dee3ead4c7d6a13aa0f34db6b74b78a24b820fa91c2ec3aba8

SHA512
e3fd98972179f95985e5a7c9ff06373142ba452f8fd5a3c6b801e57ac37df0f46f2c0d21d40551565e3622526140b0c89dcba333f606e0a94a65cba2396e381e

Download Submit
C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-d..iagnostic.resources\mfc40.module.exe

Filesize
218KB

MD5
9c5b4e4fcae7eb410f09c9e46ffb4a6d

SHA1
9d233bbe69676b1064f1deafba8e70a9acc00773

SHA256
0376139308f3e83a73b76d3938d9c100779a83b98eeb3b3ebacfcbd1cc027fe9

SHA512
59c35d730dc17e790aa4c89f82fd2f64b4d67405c2bdf21d4a9757fa8bfb64461f1247c9da482b310b117f1a24144bf6c612c9f7587577b7a286e2e3de724ee5

Download Submit
C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-d..iagnostic.resources\mfc40.module.exe

Filesize
218KB

MD5
9c5b4e4fcae7eb410f09c9e46ffb4a6d

SHA1
9d233bbe69676b1064f1deafba8e70a9acc00773

SHA256
0376139308f3e83a73b76d3938d9c100779a83b98eeb3b3ebacfcbd1cc027fe9

SHA512
59c35d730dc17e790aa4c89f82fd2f64b4d67405c2bdf21d4a9757fa8bfb64461f1247c9da482b310b117f1a24144bf6c612c9f7587577b7a286e2e3de724ee5

Download Submit
C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-d..iagnostic.resources\mfc40.sqlite3.module.dll

Filesize
359KB

MD5
a6e1b13b0b624094e6fb3a7bedb70930

SHA1
84b58920afd8e88181c4286fa2438af81f097781

SHA256
3b266088e1eb148534a8f95610e07749f7254f29d19f6f6686a1f0c85c9241bd

SHA512
26c2dffb44b7b0c2eb6e8fde7d5c6dce118af14971552bedeb131436f53edd28da98af8cf219bb7814cf4563624638cf73c7017fc3936b5112ff9f8c43f11591

Download Submit
C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-d..iagnostic.resources\mfc40.sqlite3.module.dll

Filesize
359KB

MD5
a6e1b13b0b624094e6fb3a7bedb70930

SHA1
84b58920afd8e88181c4286fa2438af81f097781

SHA256
3b266088e1eb148534a8f95610e07749f7254f29d19f6f6686a1f0c85c9241bd

SHA512
26c2dffb44b7b0c2eb6e8fde7d5c6dce118af14971552bedeb131436f53edd28da98af8cf219bb7814cf4563624638cf73c7017fc3936b5112ff9f8c43f11591

Download Submit
memory/2972-134-0x0000000061E00000-0x0000000061ED1000-memory.dmp

Filesize
836KB

Download
memory/2972-133-0x0000000061E00000-0x0000000061ED1000-memory.dmp

Filesize
836KB

Download
memory/2972-144-0x0000000061E00000-0x0000000061ED1000-memory.dmp

Filesize
836KB

Download
memory/2972-145-0x0000000061E00000-0x0000000061ED1000-memory.dmp

Filesize
836KB

Download
memory/3404-137-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/3404-141-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download

Analysis

Sharing