qulab | 2f29ff04628295bb49533a23bbc4b55e6ec1eaada8f792d5e67b5d555936fb30

Analysis

max time kernel
135s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04-05-2024 03:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1164ed5b77b553cde73fb40aa55bec22_JaffaCakes118.exe
Size

1.5MB
MD5

1164ed5b77b553cde73fb40aa55bec22
SHA1

3585a9dfd16fc1b1b5b8c9083aea42802462f3ca
SHA256

2f29ff04628295bb49533a23bbc4b55e6ec1eaada8f792d5e67b5d555936fb30
SHA512

07ee7a585715ab20f711829eae511acfda1490f86a928b1f979629310c493cd60134c5af776e3cf3fb6c805820b8c41b06ea48c7eda239b50239a0531e78c2b7
SSDEEP

24576:5AHnh+eWsN3skA4RV1Hom2KXMmHaXMC/V6CjiPkXGiJ78mdMsbrUt8P6wO5:Ah+ZkldoPK8YaX5/tjisXr+C1Sd

Score

10^/10

qulab discovery ransomware spyware stealer upx

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Roaming\amd64_wcf-system.identitymodel.selectors\1\Information.txt

Family

qulab

Ransom Note

# /===============================\ # |=== QULAB CLIPPER + STEALER ===| # |===============================| # |==== BUY CLIPPER + STEALER ====| # |=== http://teleg.run/QulabZ ===| # \===============================/ Date: 04.05.2024, 03:43:50 Main Information: - OS: Windows 10 X64 / Build: 19041 - UserName: Admin - ComputerName: EXNCLZLI - VideoCard: Microsoft Basic Display Adapter - Processor: 12th Gen Intel(R) Core(TM) i5-12400 - Memory: 8.00 Gb - KeyBoard Layout ID: 00000409 - Resolution: 1280x720x32, 64 GHz Other Information: <error> Soft / Windows Components / Windows Updates: - Google Chrome - Microsoft Edge - Microsoft Edge Update - Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 - Java Auto Updater - Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.30.30704 - Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.30.30704 - Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.40660 - Microsoft Windows Desktop Runtime - 8.0.2 (x64) - Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.40660 - Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 - Adobe Acrobat Reader DC - Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 - Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 - Microsoft Visual C++ 2022 X86 Additional Runtime - 14.30.30704 - Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 - Microsoft Windows Desktop Runtime - 6.0.27 (x64) - Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.40660 - Microsoft Windows Desktop Runtime - 7.0.16 (x64) - Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.40660 - Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 - Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.30.30704 Process List: - [System Process] / PID: 0 - System / PID: 4 - Registry / PID: 92 - smss.exe / PID: 352 - csrss.exe / PID: 440 - wininit.exe / PID: 516 - csrss.exe / PID: 528 - winlogon.exe / PID: 612 - services.exe / PID: 656 - lsass.exe / PID: 668 - svchost.exe / PID: 784 - fontdrvhost.exe / PID: 796 - fontdrvhost.exe / PID: 804 - svchost.exe / PID: 908 - svchost.exe / PID: 960 - dwm.exe / PID: 64 - svchost.exe / PID: 404 - svchost.exe / PID: 956 - svchost.exe / PID: 1040 - svchost.exe / PID: 1080 - svchost.exe / PID: 1120 - svchost.exe / PID: 1208 - svchost.exe / PID: 1240 - svchost.exe / PID: 1280 - svchost.exe / PID: 1304 - svchost.exe / PID: 1388 - svchost.exe / PID: 1456 - svchost.exe / PID: 1464 - svchost.exe / PID: 1476 - svchost.exe / PID: 1504 - svchost.exe / PID: 1656 - svchost.exe / PID: 1704 - svchost.exe / PID: 1712 - svchost.exe / PID: 1788 - svchost.exe / PID: 1812 - svchost.exe / PID: 1832 - svchost.exe / PID: 1844 - svchost.exe / PID: 1960 - svchost.exe / PID: 1452 - spoolsv.exe / PID: 2076 - svchost.exe / PID: 2116 - svchost.exe / PID: 2132 - svchost.exe / PID: 2168 - svchost.exe / PID: 2264 - svchost.exe / PID: 2416 - svchost.exe / PID: 2424 - sihost.exe / PID: 2604 - svchost.exe / PID: 2664 - svchost.exe / PID: 2752 - svchost.exe / PID: 2776 - taskhostw.exe / PID: 2796 - sysmon.exe / PID: 2824 - svchost.exe / PID: 2848 - svchost.exe / PID: 2856 - svchost.exe / PID: 3008 - unsecapp.exe / PID: 2820 - svchost.exe / PID: 3364 - svchost.exe / PID: 3424 - explorer.exe / PID: 3484 - svchost.exe / PID: 3672 - dllhost.exe / PID: 3880 - StartMenuExperienceHost.exe / PID: 3976 - RuntimeBroker.exe / PID: 4044 - SearchApp.exe / PID: 396 - RuntimeBroker.exe / PID: 4112 - RuntimeBroker.exe / PID: 4480 - sppsvc.exe / PID: 4524 - SppExtComObj.Exe / PID: 1472 - svchost.exe / PID: 3812 - svchost.exe / PID: 5112 - svchost.exe / PID: 1684 - svchost.exe / PID: 3116 - svchost.exe / PID: 4820 - OfficeClickToRun.exe / PID: 1772 - dllhost.exe / PID: 1104 - svchost.exe / PID: 4592 - TextInputHost.exe / PID: 5084 - upfc.exe / PID: 4584 - svchost.exe / PID: 900 - backgroundTaskHost.exe / PID: 1980 - backgroundTaskHost.exe / PID: 1728 - tsmf.exe / PID: 676 - backgroundTaskHost.exe / PID: 2700 - RuntimeBroker.exe / PID: 4676

URLs

http://teleg.run/QulabZ

Signatures

Qulab Stealer & Clipper
Infostealer and clipper created with AutoIt.
stealer qulab

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000a000000023b9f-12.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
3272	tsmf.module.exe

Loads dropped DLL 2 IoCs

pid	Process
676	tsmf.exe
676	tsmf.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000a000000023b9f-12.dat	upx
behavioral2/memory/676-14-0x0000000061E00000-0x0000000061ED1000-memory.dmp	upx
behavioral2/memory/676-17-0x0000000061E00000-0x0000000061ED1000-memory.dmp	upx
behavioral2/files/0x0014000000023a13-49.dat	upx
behavioral2/memory/3272-50-0x0000000000400000-0x000000000048E000-memory.dmp	upx
behavioral2/memory/3272-55-0x0000000000400000-0x000000000048E000-memory.dmp	upx
behavioral2/memory/676-62-0x0000000061E00000-0x0000000061ED1000-memory.dmp	upx
behavioral2/memory/676-63-0x0000000061E00000-0x0000000061ED1000-memory.dmp	upx

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
10	ipapi.co
12	ipapi.co

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/428-1-0x0000000000B00000-0x0000000000C8C000-memory.dmp	autoit_exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\winmgmts:\localhost\	tsmf.exe
File opened for modification	C:\Windows\SysWOW64\winmgmts:\localhost\	tsmf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\winmgmts:\localhost\	1164ed5b77b553cde73fb40aa55bec22_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\amd64_wcf-system.identitymodel.selectors\winmgmts:\localhost\	tsmf.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	38	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
676	tsmf.exe
676	tsmf.exe
676	tsmf.exe
676	tsmf.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
428	1164ed5b77b553cde73fb40aa55bec22_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	3272	tsmf.module.exe
Token: 35	3272	tsmf.module.exe
Token: SeSecurityPrivilege	3272	tsmf.module.exe
Token: SeSecurityPrivilege	3272	tsmf.module.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 428 wrote to memory of 676	428	1164ed5b77b553cde73fb40aa55bec22_JaffaCakes118.exe	83
PID 428 wrote to memory of 676	428	1164ed5b77b553cde73fb40aa55bec22_JaffaCakes118.exe	83
PID 428 wrote to memory of 676	428	1164ed5b77b553cde73fb40aa55bec22_JaffaCakes118.exe	83
PID 676 wrote to memory of 3272	676	tsmf.exe	89
PID 676 wrote to memory of 3272	676	tsmf.exe	89
PID 676 wrote to memory of 3272	676	tsmf.exe	89

C:\Users\Admin\AppData\Local\Temp\1164ed5b77b553cde73fb40aa55bec22_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1164ed5b77b553cde73fb40aa55bec22_JaffaCakes118.exe"
1⤵
- NTFS ADS
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:428
- C:\Users\Admin\AppData\Roaming\amd64_wcf-system.identitymodel.selectors\tsmf.exe
  C:\Users\Admin\AppData\Roaming\amd64_wcf-system.identitymodel.selectors\tsmf.exe
  2⤵
  - Loads dropped DLL
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:676
- - C:\Users\Admin\AppData\Roaming\amd64_wcf-system.identitymodel.selectors\tsmf.module.exe
    C:\Users\Admin\AppData\Roaming\amd64_wcf-system.identitymodel.selectors\tsmf.module.exe a -y -mx9 -ssw "C:\Users\Admin\AppData\Roaming\amd64_wcf-system.identitymodel.selectors\ENU_801FE979CAC3E85E9D41.7z" "C:\Users\Admin\AppData\Roaming\amd64_wcf-system.identitymodel.selectors\1\*"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:3272

C:\Users\Admin\AppData\Roaming\amd64_wcf-system.identitymodel.selectors\tsmf.exe
C:\Users\Admin\AppData\Roaming\amd64_wcf-system.identitymodel.selectors\tsmf.exe
1⤵
- Drops file in System32 directory
PID:5076

C:\Users\Admin\AppData\Roaming\amd64_wcf-system.identitymodel.selectors\tsmf.exe
C:\Users\Admin\AppData\Roaming\amd64_wcf-system.identitymodel.selectors\tsmf.exe
1⤵
- Drops file in System32 directory
PID:1192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\aut37AA.tmp

Filesize
359KB

MD5
b4c60e14908df45d429ce700fd64bfc5

SHA1
0af1f2fb9a74d6803997500796576e28a6417f88

SHA256
eb99416a69be5a37b6a57880b7835585380b024f055dde7b338c874bafe403ca

SHA512
e31eda7afd79c64453c5324e42f738d7cdce490062627cb733ca19d7828e4a0e915909bf0652365d86effd7ab732798f4d6850afbd52aae45f9921d238487f1d

Download Submit
C:\Users\Admin\AppData\Roaming\amd64_wcf-system.identitymodel.selectors\1\Information.txt

Filesize
4KB

MD5
da904f1399ee65d387bdd4024e6de5c5

SHA1
c326f6ebb3e645758a9ca9566eb87619a79d9d52

SHA256
dad8d90b4ebff409e4bc359e8dbcc95f37ab9df8ac444fd076f8d2d7e110c253

SHA512
34aad12fe5f8bd6e578e8a96e28de296abb0fcb5a87637dece4d0ffbc1494a120571da8cc7596b6ace90c8b004eceaf152718666cb3255c07aefa49c7c2d06a1

Download Submit
C:\Users\Admin\AppData\Roaming\amd64_wcf-system.identitymodel.selectors\1\Screen.jpg

Filesize
52KB

MD5
0540634731a938aa00e5267b0e24335b

SHA1
4d4a26c43a3898c854e95fad30ce5af6afe070b5

SHA256
c5ccecb1aecb8e4b24d5f75c11c4f3976dbffd6087219a57fa01a8de83099ff7

SHA512
ed39f737070642dcc8e8639d629d9e85eb5eecab4a6fe8628dfd56dd7c6e22a0bd2040322ad8667433eb72eaf1487137e8814b872b97881a6ad2b90652a916f1

Download Submit
C:\Users\Admin\AppData\Roaming\amd64_wcf-system.identitymodel.selectors\ENU_801FE979CAC3E85E9D41.7z

Filesize
46KB

MD5
d2ee666e5dad91dae80e491972c8f24f

SHA1
3d3856a5e0a16fce2ef36ff7e801243da41ce805

SHA256
58dce223101f5a82546d43514219c92e686d56e38f14ed87b97b9cba11b14465

SHA512
f59690f13611468bc2adceb6599f28162d6194a0052de411f22bf86bafece948a366b5088212e920a8b38d66d3b4daa7b6320d1c35544ce37b650e79312ffa85

Download Submit
C:\Users\Admin\AppData\Roaming\amd64_wcf-system.identitymodel.selectors\tsmf.module.exe

Filesize
218KB

MD5
9c5b4e4fcae7eb410f09c9e46ffb4a6d

SHA1
9d233bbe69676b1064f1deafba8e70a9acc00773

SHA256
0376139308f3e83a73b76d3938d9c100779a83b98eeb3b3ebacfcbd1cc027fe9

SHA512
59c35d730dc17e790aa4c89f82fd2f64b4d67405c2bdf21d4a9757fa8bfb64461f1247c9da482b310b117f1a24144bf6c612c9f7587577b7a286e2e3de724ee5

Download Submit
C:\Users\Admin\AppData\Roaming\amd64_wcf-system.identitymodel.selectors\tsmf.module.exe.5

Filesize
218KB

MD5
9c4cce04f36f9fadba9611616dff6d86

SHA1
b97c47a334866da42c91968be03514f4aeeb37df

SHA256
f3158d335a0b91f3ba1af5e1f8c602341b8bd36c50bbfd2d0c6a312d0d638f8c

SHA512
aed03d651511358ffcdc667b2707139f3e29f7d5925ce6a5c6c1c79f16bc8f94c70d7f80ea5db6d24500e9efd88a159fe9c3cd599539758b2042d2a3ce5606b1

Download Submit
C:\Users\Admin\AppData\Roaming\amd64_wcf-system.identitymodel.selectors\tsmf.sqlite3.module.dll

Filesize
359KB

MD5
a6e1b13b0b624094e6fb3a7bedb70930

SHA1
84b58920afd8e88181c4286fa2438af81f097781

SHA256
3b266088e1eb148534a8f95610e07749f7254f29d19f6f6686a1f0c85c9241bd

SHA512
26c2dffb44b7b0c2eb6e8fde7d5c6dce118af14971552bedeb131436f53edd28da98af8cf219bb7814cf4563624638cf73c7017fc3936b5112ff9f8c43f11591

Download Submit
memory/428-1-0x0000000000B00000-0x0000000000C8C000-memory.dmp

Filesize
1.5MB

Download
memory/676-17-0x0000000061E00000-0x0000000061ED1000-memory.dmp

Filesize
836KB

Download
memory/676-60-0x0000000004F60000-0x0000000004F61000-memory.dmp

Filesize
4KB

Download
memory/676-59-0x0000000004F40000-0x0000000004F41000-memory.dmp

Filesize
4KB

Download
memory/676-58-0x0000000004F50000-0x0000000004F51000-memory.dmp

Filesize
4KB

Download
memory/676-57-0x0000000004F10000-0x0000000004F11000-memory.dmp

Filesize
4KB

Download
memory/676-14-0x0000000061E00000-0x0000000061ED1000-memory.dmp

Filesize
836KB

Download
memory/676-62-0x0000000061E00000-0x0000000061ED1000-memory.dmp

Filesize
836KB

Download
memory/676-63-0x0000000061E00000-0x0000000061ED1000-memory.dmp

Filesize
836KB

Download
memory/3272-50-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/3272-55-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download