isrstealer | f842d68c4fc549af6ee798769fc0e2eaf3f50f2207d7aadd86b11c1826ef31d6

Analysis

max time kernel
50s
max time network
54s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02-10-2022 23:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f842d68c4fc549af6ee798769fc0e2eaf3f50f2207d7aadd86b11c1826ef31d6.exe
Size

740KB
MD5

3a965754e28255e17381331c733a5062
SHA1

e33bf2c153528e3ee8a5e5b868062b1b8b455987
SHA256

f842d68c4fc549af6ee798769fc0e2eaf3f50f2207d7aadd86b11c1826ef31d6
SHA512

ec8e7a3670ed21fc6892ca50268f2e343c7eaa6cc33852753c4924e40b1d1bb69a2657732da12f30ac859535b6696b5c3925636fbc6389257eb478179fd3f98f
SSDEEP

6144:K7DUbXf3vrcaqKahsEmtkjIjc2x7bxFVApzL2HcihJ+zzaSfAI0Th5mB/WXPD5Qm:K7gbXf3vriQ7lbypPA9h4XaSfhVo6fv

Score

10^/10

isrstealer collection spyware stealer trojan upx

Malware Config

Signatures

ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
trojan stealer isrstealer

ISR Stealer payload 15 IoCs

Processes:

resource	yara_rule
behavioral1/memory/952-68-0x00000000004472A0-mapping.dmp	family_isrstealer
behavioral1/memory/952-74-0x0000000000400000-0x0000000000449000-memory.dmp	family_isrstealer
behavioral1/memory/952-86-0x0000000000400000-0x0000000000449000-memory.dmp	family_isrstealer
\Users\Admin\AppData\Local\Temp\QLUQL.exe	family_isrstealer
\Users\Admin\AppData\Local\Temp\QLUQL.exe	family_isrstealer
\Users\Admin\AppData\Local\Temp\QLUQL.exe	family_isrstealer
\Users\Admin\AppData\Local\Temp\QLUQL.exe	family_isrstealer
\Users\Admin\AppData\Local\Temp\QLUQL.exe	family_isrstealer
C:\Users\Admin\AppData\Local\Temp\QLUQL.exe	family_isrstealer
\Users\Admin\AppData\Local\Temp\QLUQL.exe	family_isrstealer
C:\Users\Admin\AppData\Local\Temp\QLUQL.exe	family_isrstealer
C:\Users\Admin\AppData\Local\Temp\QLUQL.exe	family_isrstealer
\Users\Admin\AppData\Local\Temp\QLUQL.exe	family_isrstealer
C:\Users\Admin\AppData\Local\Temp\QLUQL.exe	family_isrstealer
behavioral1/memory/952-122-0x0000000000400000-0x0000000000449000-memory.dmp	family_isrstealer

NirSoft MailPassView 2 IoCs

Password recovery tool for various email clients

Processes:

resource	yara_rule
behavioral1/memory/1124-120-0x0000000000400000-0x000000000041F000-memory.dmp	MailPassView
behavioral1/memory/1124-121-0x0000000000400000-0x000000000041F000-memory.dmp	MailPassView

Nirsoft 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1124-120-0x0000000000400000-0x000000000041F000-memory.dmp	Nirsoft
behavioral1/memory/1124-121-0x0000000000400000-0x000000000041F000-memory.dmp	Nirsoft

Executes dropped EXE 3 IoCs

Processes:

QLUQL.exeQLUQL.exeQLUQL.exe

pid process

672 QLUQL.exe
640 QLUQL.exe
1124 QLUQL.exe

pid	process
672	QLUQL.exe
640	QLUQL.exe
1124	QLUQL.exe

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/952-64-0x0000000000400000-0x0000000000449000-memory.dmp	upx
behavioral1/memory/952-66-0x0000000000400000-0x0000000000449000-memory.dmp	upx
behavioral1/memory/952-67-0x0000000000400000-0x0000000000449000-memory.dmp	upx
behavioral1/memory/952-74-0x0000000000400000-0x0000000000449000-memory.dmp	upx
behavioral1/memory/952-71-0x0000000000400000-0x0000000000449000-memory.dmp	upx
behavioral1/memory/952-86-0x0000000000400000-0x0000000000449000-memory.dmp	upx
behavioral1/memory/640-102-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/640-107-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/640-108-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/640-109-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/640-110-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/1124-114-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/1124-119-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/1124-120-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/1124-121-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/952-122-0x0000000000400000-0x0000000000449000-memory.dmp	upx

Loads dropped DLL 8 IoCs

Processes:

f842d68c4fc549af6ee798769fc0e2eaf3f50f2207d7aadd86b11c1826ef31d6.exef842d68c4fc549af6ee798769fc0e2eaf3f50f2207d7aadd86b11c1826ef31d6.exeQLUQL.exe

pid	process
1368	f842d68c4fc549af6ee798769fc0e2eaf3f50f2207d7aadd86b11c1826ef31d6.exe
952	f842d68c4fc549af6ee798769fc0e2eaf3f50f2207d7aadd86b11c1826ef31d6.exe
952	f842d68c4fc549af6ee798769fc0e2eaf3f50f2207d7aadd86b11c1826ef31d6.exe
952	f842d68c4fc549af6ee798769fc0e2eaf3f50f2207d7aadd86b11c1826ef31d6.exe
952	f842d68c4fc549af6ee798769fc0e2eaf3f50f2207d7aadd86b11c1826ef31d6.exe
952	f842d68c4fc549af6ee798769fc0e2eaf3f50f2207d7aadd86b11c1826ef31d6.exe
672	QLUQL.exe
672	QLUQL.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

QLUQL.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	QLUQL.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

f842d68c4fc549af6ee798769fc0e2eaf3f50f2207d7aadd86b11c1826ef31d6.exeQLUQL.exe

description	pid	process	target process
PID 560 set thread context of 952	560	f842d68c4fc549af6ee798769fc0e2eaf3f50f2207d7aadd86b11c1826ef31d6.exe	f842d68c4fc549af6ee798769fc0e2eaf3f50f2207d7aadd86b11c1826ef31d6.exe
PID 560 set thread context of 1368	560	f842d68c4fc549af6ee798769fc0e2eaf3f50f2207d7aadd86b11c1826ef31d6.exe	f842d68c4fc549af6ee798769fc0e2eaf3f50f2207d7aadd86b11c1826ef31d6.exe
PID 672 set thread context of 640	672	QLUQL.exe	QLUQL.exe
PID 672 set thread context of 1124	672	QLUQL.exe	QLUQL.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

QLUQL.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	QLUQL.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	QLUQL.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	QLUQL.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

f842d68c4fc549af6ee798769fc0e2eaf3f50f2207d7aadd86b11c1826ef31d6.exef842d68c4fc549af6ee798769fc0e2eaf3f50f2207d7aadd86b11c1826ef31d6.exeQLUQL.exe

pid	process
560	f842d68c4fc549af6ee798769fc0e2eaf3f50f2207d7aadd86b11c1826ef31d6.exe
952	f842d68c4fc549af6ee798769fc0e2eaf3f50f2207d7aadd86b11c1826ef31d6.exe
672	QLUQL.exe

Suspicious use of WriteProcessMemory 41 IoCs

Processes:

f842d68c4fc549af6ee798769fc0e2eaf3f50f2207d7aadd86b11c1826ef31d6.exef842d68c4fc549af6ee798769fc0e2eaf3f50f2207d7aadd86b11c1826ef31d6.exeQLUQL.exe

description	pid	process	target process
PID 560 wrote to memory of 952	560	f842d68c4fc549af6ee798769fc0e2eaf3f50f2207d7aadd86b11c1826ef31d6.exe	f842d68c4fc549af6ee798769fc0e2eaf3f50f2207d7aadd86b11c1826ef31d6.exe
PID 560 wrote to memory of 952	560	f842d68c4fc549af6ee798769fc0e2eaf3f50f2207d7aadd86b11c1826ef31d6.exe	f842d68c4fc549af6ee798769fc0e2eaf3f50f2207d7aadd86b11c1826ef31d6.exe
PID 560 wrote to memory of 952	560	f842d68c4fc549af6ee798769fc0e2eaf3f50f2207d7aadd86b11c1826ef31d6.exe	f842d68c4fc549af6ee798769fc0e2eaf3f50f2207d7aadd86b11c1826ef31d6.exe
PID 560 wrote to memory of 952	560	f842d68c4fc549af6ee798769fc0e2eaf3f50f2207d7aadd86b11c1826ef31d6.exe	f842d68c4fc549af6ee798769fc0e2eaf3f50f2207d7aadd86b11c1826ef31d6.exe
PID 560 wrote to memory of 952	560	f842d68c4fc549af6ee798769fc0e2eaf3f50f2207d7aadd86b11c1826ef31d6.exe	f842d68c4fc549af6ee798769fc0e2eaf3f50f2207d7aadd86b11c1826ef31d6.exe
PID 560 wrote to memory of 952	560	f842d68c4fc549af6ee798769fc0e2eaf3f50f2207d7aadd86b11c1826ef31d6.exe	f842d68c4fc549af6ee798769fc0e2eaf3f50f2207d7aadd86b11c1826ef31d6.exe
PID 560 wrote to memory of 952	560	f842d68c4fc549af6ee798769fc0e2eaf3f50f2207d7aadd86b11c1826ef31d6.exe	f842d68c4fc549af6ee798769fc0e2eaf3f50f2207d7aadd86b11c1826ef31d6.exe
PID 560 wrote to memory of 952	560	f842d68c4fc549af6ee798769fc0e2eaf3f50f2207d7aadd86b11c1826ef31d6.exe	f842d68c4fc549af6ee798769fc0e2eaf3f50f2207d7aadd86b11c1826ef31d6.exe
PID 560 wrote to memory of 1368	560	f842d68c4fc549af6ee798769fc0e2eaf3f50f2207d7aadd86b11c1826ef31d6.exe	f842d68c4fc549af6ee798769fc0e2eaf3f50f2207d7aadd86b11c1826ef31d6.exe
PID 560 wrote to memory of 1368	560	f842d68c4fc549af6ee798769fc0e2eaf3f50f2207d7aadd86b11c1826ef31d6.exe	f842d68c4fc549af6ee798769fc0e2eaf3f50f2207d7aadd86b11c1826ef31d6.exe
PID 560 wrote to memory of 1368	560	f842d68c4fc549af6ee798769fc0e2eaf3f50f2207d7aadd86b11c1826ef31d6.exe	f842d68c4fc549af6ee798769fc0e2eaf3f50f2207d7aadd86b11c1826ef31d6.exe
PID 560 wrote to memory of 1368	560	f842d68c4fc549af6ee798769fc0e2eaf3f50f2207d7aadd86b11c1826ef31d6.exe	f842d68c4fc549af6ee798769fc0e2eaf3f50f2207d7aadd86b11c1826ef31d6.exe
PID 560 wrote to memory of 1368	560	f842d68c4fc549af6ee798769fc0e2eaf3f50f2207d7aadd86b11c1826ef31d6.exe	f842d68c4fc549af6ee798769fc0e2eaf3f50f2207d7aadd86b11c1826ef31d6.exe
PID 560 wrote to memory of 1368	560	f842d68c4fc549af6ee798769fc0e2eaf3f50f2207d7aadd86b11c1826ef31d6.exe	f842d68c4fc549af6ee798769fc0e2eaf3f50f2207d7aadd86b11c1826ef31d6.exe
PID 560 wrote to memory of 1368	560	f842d68c4fc549af6ee798769fc0e2eaf3f50f2207d7aadd86b11c1826ef31d6.exe	f842d68c4fc549af6ee798769fc0e2eaf3f50f2207d7aadd86b11c1826ef31d6.exe
PID 560 wrote to memory of 1368	560	f842d68c4fc549af6ee798769fc0e2eaf3f50f2207d7aadd86b11c1826ef31d6.exe	f842d68c4fc549af6ee798769fc0e2eaf3f50f2207d7aadd86b11c1826ef31d6.exe
PID 560 wrote to memory of 1368	560	f842d68c4fc549af6ee798769fc0e2eaf3f50f2207d7aadd86b11c1826ef31d6.exe	f842d68c4fc549af6ee798769fc0e2eaf3f50f2207d7aadd86b11c1826ef31d6.exe
PID 560 wrote to memory of 1368	560	f842d68c4fc549af6ee798769fc0e2eaf3f50f2207d7aadd86b11c1826ef31d6.exe	f842d68c4fc549af6ee798769fc0e2eaf3f50f2207d7aadd86b11c1826ef31d6.exe
PID 560 wrote to memory of 1368	560	f842d68c4fc549af6ee798769fc0e2eaf3f50f2207d7aadd86b11c1826ef31d6.exe	f842d68c4fc549af6ee798769fc0e2eaf3f50f2207d7aadd86b11c1826ef31d6.exe
PID 952 wrote to memory of 672	952	f842d68c4fc549af6ee798769fc0e2eaf3f50f2207d7aadd86b11c1826ef31d6.exe	QLUQL.exe
PID 952 wrote to memory of 672	952	f842d68c4fc549af6ee798769fc0e2eaf3f50f2207d7aadd86b11c1826ef31d6.exe	QLUQL.exe
PID 952 wrote to memory of 672	952	f842d68c4fc549af6ee798769fc0e2eaf3f50f2207d7aadd86b11c1826ef31d6.exe	QLUQL.exe
PID 952 wrote to memory of 672	952	f842d68c4fc549af6ee798769fc0e2eaf3f50f2207d7aadd86b11c1826ef31d6.exe	QLUQL.exe
PID 672 wrote to memory of 640	672	QLUQL.exe	QLUQL.exe
PID 672 wrote to memory of 640	672	QLUQL.exe	QLUQL.exe
PID 672 wrote to memory of 640	672	QLUQL.exe	QLUQL.exe
PID 672 wrote to memory of 640	672	QLUQL.exe	QLUQL.exe
PID 672 wrote to memory of 640	672	QLUQL.exe	QLUQL.exe
PID 672 wrote to memory of 640	672	QLUQL.exe	QLUQL.exe
PID 672 wrote to memory of 640	672	QLUQL.exe	QLUQL.exe
PID 672 wrote to memory of 640	672	QLUQL.exe	QLUQL.exe
PID 672 wrote to memory of 640	672	QLUQL.exe	QLUQL.exe
PID 672 wrote to memory of 1124	672	QLUQL.exe	QLUQL.exe
PID 672 wrote to memory of 1124	672	QLUQL.exe	QLUQL.exe
PID 672 wrote to memory of 1124	672	QLUQL.exe	QLUQL.exe
PID 672 wrote to memory of 1124	672	QLUQL.exe	QLUQL.exe
PID 672 wrote to memory of 1124	672	QLUQL.exe	QLUQL.exe
PID 672 wrote to memory of 1124	672	QLUQL.exe	QLUQL.exe
PID 672 wrote to memory of 1124	672	QLUQL.exe	QLUQL.exe
PID 672 wrote to memory of 1124	672	QLUQL.exe	QLUQL.exe
PID 672 wrote to memory of 1124	672	QLUQL.exe	QLUQL.exe

C:\Users\Admin\AppData\Local\Temp\f842d68c4fc549af6ee798769fc0e2eaf3f50f2207d7aadd86b11c1826ef31d6.exe
"C:\Users\Admin\AppData\Local\Temp\f842d68c4fc549af6ee798769fc0e2eaf3f50f2207d7aadd86b11c1826ef31d6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:560

C:\Users\Admin\AppData\Local\Temp\f842d68c4fc549af6ee798769fc0e2eaf3f50f2207d7aadd86b11c1826ef31d6.exe
"C:\Users\Admin\AppData\Local\Temp\f842d68c4fc549af6ee798769fc0e2eaf3f50f2207d7aadd86b11c1826ef31d6.exe"
2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:952

C:\Users\Admin\AppData\Local\Temp\QLUQL.exe
"C:\Users\Admin\AppData\Local\Temp\QLUQL.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:672

C:\Users\Admin\AppData\Local\Temp\QLUQL.exe
/scomma "C:\Users\Admin\AppData\Local\Temp\izGbnYURxF.ini"
4⤵
- Executes dropped EXE
PID:640

C:\Users\Admin\AppData\Local\Temp\QLUQL.exe
/scomma "C:\Users\Admin\AppData\Local\Temp\g8PeqvOjiC.ini"
4⤵
- Executes dropped EXE
- Accesses Microsoft Outlook accounts
PID:1124

C:\Users\Admin\AppData\Local\Temp\f842d68c4fc549af6ee798769fc0e2eaf3f50f2207d7aadd86b11c1826ef31d6.exe
"C:\Users\Admin\AppData\Local\Temp\f842d68c4fc549af6ee798769fc0e2eaf3f50f2207d7aadd86b11c1826ef31d6.exe"
2⤵
- Loads dropped DLL
PID:1368

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\QLUQL.exe
Filesize
260KB

MD5
82ce6a2616f9b8e7c9037df683083524

SHA1
bcdef4e3b26634d84f5c02148a7b720a3c434407

SHA256
5f178dd7febe66cf37bb293133a99315fc3b8b3b903655381a7404e79a969b42

SHA512
10d326f05eaa5e16b7d087fb54ce59a772e67f00b33b82356b47d73ad775fff74588d4bcee3760430c5de49d9220ca4f1e1eeacf87caad11d55e4fc5be133a4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\QLUQL.exe
Filesize
260KB

MD5
82ce6a2616f9b8e7c9037df683083524

SHA1
bcdef4e3b26634d84f5c02148a7b720a3c434407

SHA256
5f178dd7febe66cf37bb293133a99315fc3b8b3b903655381a7404e79a969b42

SHA512
10d326f05eaa5e16b7d087fb54ce59a772e67f00b33b82356b47d73ad775fff74588d4bcee3760430c5de49d9220ca4f1e1eeacf87caad11d55e4fc5be133a4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\QLUQL.exe
Filesize
260KB

MD5
82ce6a2616f9b8e7c9037df683083524

SHA1
bcdef4e3b26634d84f5c02148a7b720a3c434407

SHA256
5f178dd7febe66cf37bb293133a99315fc3b8b3b903655381a7404e79a969b42

SHA512
10d326f05eaa5e16b7d087fb54ce59a772e67f00b33b82356b47d73ad775fff74588d4bcee3760430c5de49d9220ca4f1e1eeacf87caad11d55e4fc5be133a4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\QLUQL.exe
Filesize
260KB

MD5
82ce6a2616f9b8e7c9037df683083524

SHA1
bcdef4e3b26634d84f5c02148a7b720a3c434407

SHA256
5f178dd7febe66cf37bb293133a99315fc3b8b3b903655381a7404e79a969b42

SHA512
10d326f05eaa5e16b7d087fb54ce59a772e67f00b33b82356b47d73ad775fff74588d4bcee3760430c5de49d9220ca4f1e1eeacf87caad11d55e4fc5be133a4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\izGbnYURxF.ini
Filesize
5B

MD5
d1ea279fb5559c020a1b4137dc4de237

SHA1
db6f8988af46b56216a6f0daf95ab8c9bdb57400

SHA256
fcdcc2c46896915a1c695d6231f0fee336a668531b7a3da46178c80362546dba

SHA512
720e9c284f0559015312df7fe977563e5e16f48d3506e51eb4016adf7971924d352f740b030aa3adc81b6f65fd1dba12df06d10fa6c115074e5097e7ee0f08b3

Download Submit
\Users\Admin\AppData\Local\Temp\QLUQL.exe
Filesize
260KB

MD5
82ce6a2616f9b8e7c9037df683083524

SHA1
bcdef4e3b26634d84f5c02148a7b720a3c434407

SHA256
5f178dd7febe66cf37bb293133a99315fc3b8b3b903655381a7404e79a969b42

SHA512
10d326f05eaa5e16b7d087fb54ce59a772e67f00b33b82356b47d73ad775fff74588d4bcee3760430c5de49d9220ca4f1e1eeacf87caad11d55e4fc5be133a4c

Download Submit
\Users\Admin\AppData\Local\Temp\QLUQL.exe
Filesize
260KB

MD5
82ce6a2616f9b8e7c9037df683083524

SHA1
bcdef4e3b26634d84f5c02148a7b720a3c434407

SHA256
5f178dd7febe66cf37bb293133a99315fc3b8b3b903655381a7404e79a969b42

SHA512
10d326f05eaa5e16b7d087fb54ce59a772e67f00b33b82356b47d73ad775fff74588d4bcee3760430c5de49d9220ca4f1e1eeacf87caad11d55e4fc5be133a4c

Download Submit
\Users\Admin\AppData\Local\Temp\QLUQL.exe
Filesize
260KB

MD5
82ce6a2616f9b8e7c9037df683083524

SHA1
bcdef4e3b26634d84f5c02148a7b720a3c434407

SHA256
5f178dd7febe66cf37bb293133a99315fc3b8b3b903655381a7404e79a969b42

SHA512
10d326f05eaa5e16b7d087fb54ce59a772e67f00b33b82356b47d73ad775fff74588d4bcee3760430c5de49d9220ca4f1e1eeacf87caad11d55e4fc5be133a4c

Download Submit
\Users\Admin\AppData\Local\Temp\QLUQL.exe
Filesize
260KB

MD5
82ce6a2616f9b8e7c9037df683083524

SHA1
bcdef4e3b26634d84f5c02148a7b720a3c434407

SHA256
5f178dd7febe66cf37bb293133a99315fc3b8b3b903655381a7404e79a969b42

SHA512
10d326f05eaa5e16b7d087fb54ce59a772e67f00b33b82356b47d73ad775fff74588d4bcee3760430c5de49d9220ca4f1e1eeacf87caad11d55e4fc5be133a4c

Download Submit
\Users\Admin\AppData\Local\Temp\QLUQL.exe
Filesize
260KB

MD5
82ce6a2616f9b8e7c9037df683083524

SHA1
bcdef4e3b26634d84f5c02148a7b720a3c434407

SHA256
5f178dd7febe66cf37bb293133a99315fc3b8b3b903655381a7404e79a969b42

SHA512
10d326f05eaa5e16b7d087fb54ce59a772e67f00b33b82356b47d73ad775fff74588d4bcee3760430c5de49d9220ca4f1e1eeacf87caad11d55e4fc5be133a4c

Download Submit
\Users\Admin\AppData\Local\Temp\QLUQL.exe
Filesize
260KB

MD5
82ce6a2616f9b8e7c9037df683083524

SHA1
bcdef4e3b26634d84f5c02148a7b720a3c434407

SHA256
5f178dd7febe66cf37bb293133a99315fc3b8b3b903655381a7404e79a969b42

SHA512
10d326f05eaa5e16b7d087fb54ce59a772e67f00b33b82356b47d73ad775fff74588d4bcee3760430c5de49d9220ca4f1e1eeacf87caad11d55e4fc5be133a4c

Download Submit
\Users\Admin\AppData\Local\Temp\QLUQL.exe
Filesize
260KB

MD5
82ce6a2616f9b8e7c9037df683083524

SHA1
bcdef4e3b26634d84f5c02148a7b720a3c434407

SHA256
5f178dd7febe66cf37bb293133a99315fc3b8b3b903655381a7404e79a969b42

SHA512
10d326f05eaa5e16b7d087fb54ce59a772e67f00b33b82356b47d73ad775fff74588d4bcee3760430c5de49d9220ca4f1e1eeacf87caad11d55e4fc5be133a4c

Download Submit
\Users\Admin\AppData\Local\Temp\dup2patcher.dll
Filesize
55KB

MD5
43bcd632e19ac3fdc43e7958465ce835

SHA1
30454241e95b78ddb125a4c784f160609589ee5f

SHA256
7694627600115240b503f214cbfb9106415802c345e982c3bf9c8d05910a1a7c

SHA512
ffe7507bcc2413a5b846ec62b9edd3ec94d79a2fd3ecaf4ce2ddb96a7d42facdfa9aabd84d06e15ab644ae478715c566a91e9bb8ba12fc9ff9a3b8390ca6d886

Download Submit
memory/560-59-0x00000000024F0000-0x00000000025AA000-memory.dmp

Filesize
744KB

Download
memory/560-56-0x00000000005C0000-0x00000000005C4000-memory.dmp

Filesize
16KB

Download
memory/560-58-0x00000000005C0000-0x00000000005C4000-memory.dmp

Filesize
16KB

Download
memory/560-57-0x00000000005C0000-0x00000000005C4000-memory.dmp

Filesize
16KB

Download
memory/640-103-0x00000000004512E0-mapping.dmp

Download
memory/640-110-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/640-109-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/640-108-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/640-107-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/640-102-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/672-96-0x0000000000000000-mapping.dmp

Download
memory/952-71-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/952-64-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/952-122-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/952-86-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/952-85-0x0000000076041000-0x0000000076043000-memory.dmp

Filesize
8KB

Download
memory/952-66-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/952-63-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/952-67-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/952-74-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/952-68-0x00000000004472A0-mapping.dmp

Download
memory/1124-120-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1124-114-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1124-115-0x000000000041C410-mapping.dmp

Download
memory/1124-119-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1124-121-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1368-77-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1368-84-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1368-87-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1368-80-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1368-72-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1368-70-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1368-90-0x00000000747D0000-0x00000000747F6000-memory.dmp

Filesize
152KB

Download
memory/1368-75-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1368-73-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1368-79-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1368-81-0x000000000040102B-mapping.dmp

Download