Malware Analysis Report

2024-09-23 04:45

Sample ID 220725-dpdssscebn
Target 8194c457a69ef4756b0b36675901799430d58a70c397d7209b48a0eb0ea32a52
SHA256 8194c457a69ef4756b0b36675901799430d58a70c397d7209b48a0eb0ea32a52
Tags
qulab discovery evasion ransomware spyware stealer upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

8194c457a69ef4756b0b36675901799430d58a70c397d7209b48a0eb0ea32a52

Threat Level: Known bad

The file 8194c457a69ef4756b0b36675901799430d58a70c397d7209b48a0eb0ea32a52 was found to be: Known bad.

Malicious Activity Summary

qulab discovery evasion ransomware spyware stealer upx

Qulab Stealer & Clipper

ACProtect 1.3x - 1.4x DLL software

UPX packed file

Sets file to hidden

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Accesses cryptocurrency files/wallets, possible credential harvesting

Looks up external IP address via web service

Checks installed software on the system

Suspicious use of SetThreadContext

AutoIT Executable

Drops file in System32 directory

Enumerates physical storage devices

Views/modifies file attributes

Suspicious use of SendNotifyMessage

Suspicious use of FindShellTrayWindow

NTFS ADS

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: RenamesItself

MITRE ATT&CK Matrix V6

Analysis: static1

Detonation Overview

Reported

2022-07-25 03:10

Signatures

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-07-25 03:10

Reported

2022-07-25 03:13

Platform

win7-20220715-en

Max time kernel

136s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8194c457a69ef4756b0b36675901799430d58a70c397d7209b48a0eb0ea32a52.exe"

Signatures

Qulab Stealer & Clipper

stealer qulab

ACProtect 1.3x - 1.4x DLL software

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.module.exe N/A

Sets file to hidden

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Checks installed software on the system

discovery

Looks up external IP address via web service

Description Indicator Process Target
N/A ipapi.co N/A N/A
N/A ipapi.co N/A N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\winmgmts:\localhost\ C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe N/A
File opened for modification C:\Windows\SysWOW64\winmgmts:\localhost\ C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe N/A

Enumerates physical storage devices

NTFS ADS

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Local\Temp\winmgmts:\localhost\ C:\Users\Admin\AppData\Local\Temp\8194c457a69ef4756b0b36675901799430d58a70c397d7209b48a0eb0ea32a52.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\winmgmts:\localhost\ C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe N/A

Suspicious behavior: RenamesItself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\8194c457a69ef4756b0b36675901799430d58a70c397d7209b48a0eb0ea32a52.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1808 wrote to memory of 1884 N/A C:\Users\Admin\AppData\Local\Temp\8194c457a69ef4756b0b36675901799430d58a70c397d7209b48a0eb0ea32a52.exe C:\Users\Admin\AppData\Local\Temp\8194c457a69ef4756b0b36675901799430d58a70c397d7209b48a0eb0ea32a52.exe
PID 1808 wrote to memory of 1884 N/A C:\Users\Admin\AppData\Local\Temp\8194c457a69ef4756b0b36675901799430d58a70c397d7209b48a0eb0ea32a52.exe C:\Users\Admin\AppData\Local\Temp\8194c457a69ef4756b0b36675901799430d58a70c397d7209b48a0eb0ea32a52.exe
PID 1808 wrote to memory of 1884 N/A C:\Users\Admin\AppData\Local\Temp\8194c457a69ef4756b0b36675901799430d58a70c397d7209b48a0eb0ea32a52.exe C:\Users\Admin\AppData\Local\Temp\8194c457a69ef4756b0b36675901799430d58a70c397d7209b48a0eb0ea32a52.exe
PID 1808 wrote to memory of 1884 N/A C:\Users\Admin\AppData\Local\Temp\8194c457a69ef4756b0b36675901799430d58a70c397d7209b48a0eb0ea32a52.exe C:\Users\Admin\AppData\Local\Temp\8194c457a69ef4756b0b36675901799430d58a70c397d7209b48a0eb0ea32a52.exe
PID 1808 wrote to memory of 1884 N/A C:\Users\Admin\AppData\Local\Temp\8194c457a69ef4756b0b36675901799430d58a70c397d7209b48a0eb0ea32a52.exe C:\Users\Admin\AppData\Local\Temp\8194c457a69ef4756b0b36675901799430d58a70c397d7209b48a0eb0ea32a52.exe
PID 1808 wrote to memory of 1884 N/A C:\Users\Admin\AppData\Local\Temp\8194c457a69ef4756b0b36675901799430d58a70c397d7209b48a0eb0ea32a52.exe C:\Users\Admin\AppData\Local\Temp\8194c457a69ef4756b0b36675901799430d58a70c397d7209b48a0eb0ea32a52.exe
PID 1884 wrote to memory of 1276 N/A C:\Users\Admin\AppData\Local\Temp\8194c457a69ef4756b0b36675901799430d58a70c397d7209b48a0eb0ea32a52.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe
PID 1884 wrote to memory of 1276 N/A C:\Users\Admin\AppData\Local\Temp\8194c457a69ef4756b0b36675901799430d58a70c397d7209b48a0eb0ea32a52.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe
PID 1884 wrote to memory of 1276 N/A C:\Users\Admin\AppData\Local\Temp\8194c457a69ef4756b0b36675901799430d58a70c397d7209b48a0eb0ea32a52.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe
PID 1884 wrote to memory of 1276 N/A C:\Users\Admin\AppData\Local\Temp\8194c457a69ef4756b0b36675901799430d58a70c397d7209b48a0eb0ea32a52.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe
PID 1276 wrote to memory of 1996 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe
PID 1276 wrote to memory of 1996 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe
PID 1276 wrote to memory of 1996 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe
PID 1276 wrote to memory of 1996 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe
PID 1276 wrote to memory of 1996 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe
PID 1276 wrote to memory of 1996 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe
PID 1996 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.module.exe
PID 1996 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.module.exe
PID 1996 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.module.exe
PID 1996 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.module.exe
PID 1996 wrote to memory of 944 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe C:\Windows\SysWOW64\attrib.exe
PID 1996 wrote to memory of 944 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe C:\Windows\SysWOW64\attrib.exe
PID 1996 wrote to memory of 944 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe C:\Windows\SysWOW64\attrib.exe
PID 1996 wrote to memory of 944 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe C:\Windows\SysWOW64\attrib.exe
PID 1312 wrote to memory of 1840 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe
PID 1312 wrote to memory of 1840 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe
PID 1312 wrote to memory of 1840 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe
PID 1312 wrote to memory of 1840 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe
PID 1840 wrote to memory of 592 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe
PID 1840 wrote to memory of 592 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe
PID 1840 wrote to memory of 592 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe
PID 1840 wrote to memory of 592 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe
PID 1840 wrote to memory of 592 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe
PID 1840 wrote to memory of 592 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe
PID 1312 wrote to memory of 1808 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe
PID 1312 wrote to memory of 1808 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe
PID 1312 wrote to memory of 1808 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe
PID 1312 wrote to memory of 1808 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe
PID 1808 wrote to memory of 1304 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe
PID 1808 wrote to memory of 1304 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe
PID 1808 wrote to memory of 1304 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe
PID 1808 wrote to memory of 1304 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe
PID 1808 wrote to memory of 1304 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe
PID 1808 wrote to memory of 1304 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\8194c457a69ef4756b0b36675901799430d58a70c397d7209b48a0eb0ea32a52.exe

"C:\Users\Admin\AppData\Local\Temp\8194c457a69ef4756b0b36675901799430d58a70c397d7209b48a0eb0ea32a52.exe"

C:\Users\Admin\AppData\Local\Temp\8194c457a69ef4756b0b36675901799430d58a70c397d7209b48a0eb0ea32a52.exe

"C:\Users\Admin\AppData\Local\Temp\8194c457a69ef4756b0b36675901799430d58a70c397d7209b48a0eb0ea32a52.exe"

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe

"C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe"

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.module.exe

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.module.exe a -y -mx9 -ssw "C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\ENU_687FE97997C0942E9D41.7z" "C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\1\*"

C:\Windows\SysWOW64\attrib.exe

attrib +s +h "C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana"

C:\Windows\system32\taskeng.exe

taskeng.exe {FBB96371-F52D-4EE3-9B6E-EDF5341BB89A} S-1-5-21-335065374-4263250628-1829373619-1000:RTYPLWYY\Admin:Interactive:[1]

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe

"C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe"

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe

"C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 ipapi.co udp
US 8.8.8.8:53 api.telegram.org udp
US 104.26.9.44:443 ipapi.co tcp
NL 149.154.167.220:443 api.telegram.org tcp
NL 149.154.167.220:443 api.telegram.org tcp
NL 149.154.167.220:443 api.telegram.org tcp
NL 149.154.167.220:443 api.telegram.org tcp
NL 196.17.249.142:8000 api.telegram.org tcp
NL 196.17.249.142:8000 api.telegram.org tcp
NL 196.17.249.142:8000 api.telegram.org tcp
NL 196.17.249.142:8000 api.telegram.org tcp

Files

memory/1808-54-0x0000000076281000-0x0000000076283000-memory.dmp

memory/1884-55-0x00000000007B0000-0x0000000000982000-memory.dmp

memory/1884-57-0x00000000007B0000-0x0000000000982000-memory.dmp

memory/1884-64-0x00000000007D800A-mapping.dmp

memory/1884-66-0x00000000007B0000-0x0000000000982000-memory.dmp

memory/1276-67-0x0000000000000000-mapping.dmp

memory/1996-71-0x0000000000710000-0x00000000008E2000-memory.dmp

memory/1996-78-0x000000000073800A-mapping.dmp

memory/1996-80-0x0000000000710000-0x00000000008E2000-memory.dmp

\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.sqlite3.module.dll

MD5 8c127ce55bfbb55eb9a843c693c9f240
SHA1 75c462c935a7ff2c90030c684440d61d48bb1858
SHA256 4f93f3543139febb91e0c95dc9351008e9147a484732ee5962c7df64f6868028
SHA512 d3578bd7ef01f9e25983c24eb9bb33f25c37d650cc79b823c3ec19f196d4a00deb506c1e1f774f15e5664d5263b02570fec11b322022b90a0ff1b10943188a02

\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.sqlite3.module.dll

MD5 8c127ce55bfbb55eb9a843c693c9f240
SHA1 75c462c935a7ff2c90030c684440d61d48bb1858
SHA256 4f93f3543139febb91e0c95dc9351008e9147a484732ee5962c7df64f6868028
SHA512 d3578bd7ef01f9e25983c24eb9bb33f25c37d650cc79b823c3ec19f196d4a00deb506c1e1f774f15e5664d5263b02570fec11b322022b90a0ff1b10943188a02

memory/1996-83-0x0000000061E00000-0x0000000061ED2000-memory.dmp

memory/1996-84-0x0000000061E00000-0x0000000061ED2000-memory.dmp

\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.module.exe

MD5 946285055913d457fda78a4484266e96
SHA1 668661955bf3c20b9dc8cdaa7ec6e8dbbbd63285
SHA256 23ca34a7d22fdb7d36014928c089c982cdfb903e9143aea60d38f228c9594beb
SHA512 30a490b774d5736215b340d3a192825dc1dfbb7c8d9974c8ab2a09eff2429ed7cf99969ec6d651c8056549798da092ffa600681288dbd7c6f60515acd3630d95

\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.module.exe

MD5 946285055913d457fda78a4484266e96
SHA1 668661955bf3c20b9dc8cdaa7ec6e8dbbbd63285
SHA256 23ca34a7d22fdb7d36014928c089c982cdfb903e9143aea60d38f228c9594beb
SHA512 30a490b774d5736215b340d3a192825dc1dfbb7c8d9974c8ab2a09eff2429ed7cf99969ec6d651c8056549798da092ffa600681288dbd7c6f60515acd3630d95

memory/1696-87-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.module.exe

MD5 946285055913d457fda78a4484266e96
SHA1 668661955bf3c20b9dc8cdaa7ec6e8dbbbd63285
SHA256 23ca34a7d22fdb7d36014928c089c982cdfb903e9143aea60d38f228c9594beb
SHA512 30a490b774d5736215b340d3a192825dc1dfbb7c8d9974c8ab2a09eff2429ed7cf99969ec6d651c8056549798da092ffa600681288dbd7c6f60515acd3630d95

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\1\Information.txt

MD5 9755355711326078a0db4198bb4bd586
SHA1 fbace628adcb185e99326356e12ebf189f448855
SHA256 cfea1b8c39ab758a99b7cc58ce372f101017b05bc753e7758f94e06228b96e20
SHA512 d13d222141c3bfbc879de53a48bac2b0f931b2bbabbd71952a2d90386855b48bd322f3eb5ec03e137a162c340c39499a178a55aea6cef6f3b8ee75f2ea83cd9b

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\1\Screen.jpg

MD5 35781ec2ddc5ef85771937fb7e8a3b85
SHA1 e8c1c8eaac1e2f2513e792483ca3c9ec78752ccf
SHA256 5dd58c0038f64fd8127d637febbed179fc1d2c1edc9fc84e0b3dd2283e16860a
SHA512 54c6e342b50a70ba97013c105a3e79b435de0be29e4023bac01c951bef4627c73b8d796adbc88460b30a835f785d60223cc08a3e5f00af77ee020dfc65b625f9

memory/1696-91-0x0000000000400000-0x000000000047D000-memory.dmp

memory/1996-92-0x0000000003F20000-0x0000000003F9D000-memory.dmp

memory/1996-93-0x0000000003F20000-0x0000000003F9D000-memory.dmp

memory/944-94-0x0000000000000000-mapping.dmp

memory/1996-95-0x0000000061E00000-0x0000000061ED2000-memory.dmp

memory/1840-96-0x0000000000000000-mapping.dmp

memory/592-100-0x00000000007F0000-0x00000000009C2000-memory.dmp

memory/592-107-0x000000000081800A-mapping.dmp

memory/592-109-0x00000000007F0000-0x00000000009C2000-memory.dmp

memory/1808-110-0x0000000000000000-mapping.dmp

memory/1304-114-0x0000000000610000-0x00000000007E2000-memory.dmp

memory/1304-123-0x0000000000610000-0x00000000007E2000-memory.dmp

memory/1304-121-0x000000000063800A-mapping.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-07-25 03:10

Reported

2022-07-25 03:13

Platform

win10v2004-20220722-en

Max time kernel

137s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8194c457a69ef4756b0b36675901799430d58a70c397d7209b48a0eb0ea32a52.exe"

Signatures

Qulab Stealer & Clipper

stealer qulab

ACProtect 1.3x - 1.4x DLL software

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.module.exe N/A

Sets file to hidden

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Checks installed software on the system

discovery

Looks up external IP address via web service

Description Indicator Process Target
N/A ipapi.co N/A N/A
N/A ipapi.co N/A N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\winmgmts:\localhost\ C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe N/A
File opened for modification C:\Windows\SysWOW64\winmgmts:\localhost\ C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe N/A

Enumerates physical storage devices

NTFS ADS

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Local\Temp\winmgmts:\localhost\ C:\Users\Admin\AppData\Local\Temp\8194c457a69ef4756b0b36675901799430d58a70c397d7209b48a0eb0ea32a52.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\winmgmts:\localhost\ C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe N/A

Suspicious behavior: RenamesItself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\8194c457a69ef4756b0b36675901799430d58a70c397d7209b48a0eb0ea32a52.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2252 wrote to memory of 4772 N/A C:\Users\Admin\AppData\Local\Temp\8194c457a69ef4756b0b36675901799430d58a70c397d7209b48a0eb0ea32a52.exe C:\Users\Admin\AppData\Local\Temp\8194c457a69ef4756b0b36675901799430d58a70c397d7209b48a0eb0ea32a52.exe
PID 2252 wrote to memory of 4772 N/A C:\Users\Admin\AppData\Local\Temp\8194c457a69ef4756b0b36675901799430d58a70c397d7209b48a0eb0ea32a52.exe C:\Users\Admin\AppData\Local\Temp\8194c457a69ef4756b0b36675901799430d58a70c397d7209b48a0eb0ea32a52.exe
PID 2252 wrote to memory of 4772 N/A C:\Users\Admin\AppData\Local\Temp\8194c457a69ef4756b0b36675901799430d58a70c397d7209b48a0eb0ea32a52.exe C:\Users\Admin\AppData\Local\Temp\8194c457a69ef4756b0b36675901799430d58a70c397d7209b48a0eb0ea32a52.exe
PID 2252 wrote to memory of 4772 N/A C:\Users\Admin\AppData\Local\Temp\8194c457a69ef4756b0b36675901799430d58a70c397d7209b48a0eb0ea32a52.exe C:\Users\Admin\AppData\Local\Temp\8194c457a69ef4756b0b36675901799430d58a70c397d7209b48a0eb0ea32a52.exe
PID 2252 wrote to memory of 4772 N/A C:\Users\Admin\AppData\Local\Temp\8194c457a69ef4756b0b36675901799430d58a70c397d7209b48a0eb0ea32a52.exe C:\Users\Admin\AppData\Local\Temp\8194c457a69ef4756b0b36675901799430d58a70c397d7209b48a0eb0ea32a52.exe
PID 4772 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\8194c457a69ef4756b0b36675901799430d58a70c397d7209b48a0eb0ea32a52.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe
PID 4772 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\8194c457a69ef4756b0b36675901799430d58a70c397d7209b48a0eb0ea32a52.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe
PID 4772 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\8194c457a69ef4756b0b36675901799430d58a70c397d7209b48a0eb0ea32a52.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe
PID 3516 wrote to memory of 4384 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe
PID 3516 wrote to memory of 4384 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe
PID 3516 wrote to memory of 4384 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe
PID 3516 wrote to memory of 4384 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe
PID 3516 wrote to memory of 4384 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe
PID 4384 wrote to memory of 772 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.module.exe
PID 4384 wrote to memory of 772 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.module.exe
PID 4384 wrote to memory of 772 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.module.exe
PID 4384 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe C:\Windows\SysWOW64\attrib.exe
PID 4384 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe C:\Windows\SysWOW64\attrib.exe
PID 4384 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe C:\Windows\SysWOW64\attrib.exe
PID 4532 wrote to memory of 4896 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe
PID 4532 wrote to memory of 4896 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe
PID 4532 wrote to memory of 4896 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe
PID 4532 wrote to memory of 4896 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe
PID 4532 wrote to memory of 4896 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe
PID 4292 wrote to memory of 2292 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe
PID 4292 wrote to memory of 2292 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe
PID 4292 wrote to memory of 2292 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe
PID 4292 wrote to memory of 2292 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe
PID 4292 wrote to memory of 2292 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\8194c457a69ef4756b0b36675901799430d58a70c397d7209b48a0eb0ea32a52.exe

"C:\Users\Admin\AppData\Local\Temp\8194c457a69ef4756b0b36675901799430d58a70c397d7209b48a0eb0ea32a52.exe"

C:\Users\Admin\AppData\Local\Temp\8194c457a69ef4756b0b36675901799430d58a70c397d7209b48a0eb0ea32a52.exe

"C:\Users\Admin\AppData\Local\Temp\8194c457a69ef4756b0b36675901799430d58a70c397d7209b48a0eb0ea32a52.exe"

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe

"C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe"

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.module.exe

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.module.exe a -y -mx9 -ssw "C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\ENU_801FE9714A7A301E9D41.7z" "C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\1\*"

C:\Windows\SysWOW64\attrib.exe

attrib +s +h "C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana"

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe

"C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe"

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe

"C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.exe"

Network

Country Destination Domain Proto
US 93.184.220.29:80 tcp
US 93.184.220.29:80 tcp
US 209.197.3.8:80 tcp
US 209.197.3.8:80 tcp
US 104.208.16.88:443 tcp
US 209.197.3.8:80 tcp
US 209.197.3.8:80 tcp
US 209.197.3.8:80 tcp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 ipapi.co udp
US 104.26.8.44:443 ipapi.co tcp
NL 196.17.249.142:8000 api.telegram.org tcp
NL 196.17.249.142:8000 api.telegram.org tcp
NL 196.17.249.142:8000 api.telegram.org tcp

Files

memory/4772-132-0x0000000000000000-mapping.dmp

memory/4772-133-0x0000000000DA0000-0x0000000000F72000-memory.dmp

memory/4772-140-0x0000000000DA0000-0x0000000000F72000-memory.dmp

memory/3516-141-0x0000000000000000-mapping.dmp

memory/4384-142-0x0000000000000000-mapping.dmp

memory/4384-143-0x0000000000800000-0x00000000009D2000-memory.dmp

memory/4384-150-0x0000000000800000-0x00000000009D2000-memory.dmp

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.sqlite3.module.dll

MD5 8c127ce55bfbb55eb9a843c693c9f240
SHA1 75c462c935a7ff2c90030c684440d61d48bb1858
SHA256 4f93f3543139febb91e0c95dc9351008e9147a484732ee5962c7df64f6868028
SHA512 d3578bd7ef01f9e25983c24eb9bb33f25c37d650cc79b823c3ec19f196d4a00deb506c1e1f774f15e5664d5263b02570fec11b322022b90a0ff1b10943188a02

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.sqlite3.module.dll

MD5 8c127ce55bfbb55eb9a843c693c9f240
SHA1 75c462c935a7ff2c90030c684440d61d48bb1858
SHA256 4f93f3543139febb91e0c95dc9351008e9147a484732ee5962c7df64f6868028
SHA512 d3578bd7ef01f9e25983c24eb9bb33f25c37d650cc79b823c3ec19f196d4a00deb506c1e1f774f15e5664d5263b02570fec11b322022b90a0ff1b10943188a02

memory/4384-153-0x0000000061E00000-0x0000000061ED2000-memory.dmp

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.module.exe

MD5 946285055913d457fda78a4484266e96
SHA1 668661955bf3c20b9dc8cdaa7ec6e8dbbbd63285
SHA256 23ca34a7d22fdb7d36014928c089c982cdfb903e9143aea60d38f228c9594beb
SHA512 30a490b774d5736215b340d3a192825dc1dfbb7c8d9974c8ab2a09eff2429ed7cf99969ec6d651c8056549798da092ffa600681288dbd7c6f60515acd3630d95

memory/772-154-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\KBDLT.module.exe

MD5 946285055913d457fda78a4484266e96
SHA1 668661955bf3c20b9dc8cdaa7ec6e8dbbbd63285
SHA256 23ca34a7d22fdb7d36014928c089c982cdfb903e9143aea60d38f228c9594beb
SHA512 30a490b774d5736215b340d3a192825dc1dfbb7c8d9974c8ab2a09eff2429ed7cf99969ec6d651c8056549798da092ffa600681288dbd7c6f60515acd3630d95

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\1\Information.txt

MD5 bf95cc86bb9a3968acb7f3c556c0a98e
SHA1 af89b43578fcb32544280573f808c429605d308b
SHA256 979a4a54b293bad7dc4c1841ab4a9c1f7580764efb7e1fb89866abb2c6a9585a
SHA512 f32694c90af899c176632250a443e08259ac1c36e76be9b62a4350a131e3aa218d12025b69766d76d7205451b4afcdc4af7799afe35574448bcc0fd5659762cb

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-truetype-verdana\1\Screen.jpg

MD5 62d94d2b5e9d10e27c71fb958db3fef9
SHA1 d25fa9ae21d1a74d78bb312fa2dd7c93a90a09db
SHA256 294c699caa667f55f707327b815cb5a46db2b6f32c4595fac939567ae2b31a5f
SHA512 a3f218db3e0eb7bbd48fade1e5538c5fa384654b795b0c3a3c1f56000c6ecef15eb256ce1a926ed2b4ed78e3348808518249bb53a193b7ff14c765cf6127be93

memory/772-159-0x0000000000400000-0x000000000047D000-memory.dmp

memory/772-160-0x0000000000400000-0x000000000047D000-memory.dmp

memory/2688-161-0x0000000000000000-mapping.dmp

memory/4896-162-0x0000000000000000-mapping.dmp

memory/4896-170-0x0000000000DA0000-0x0000000000F72000-memory.dmp

memory/2292-171-0x0000000000000000-mapping.dmp

memory/2292-179-0x0000000000800000-0x00000000009D2000-memory.dmp