qulab | d688134cbb3f772d9da6dd8900b5ba32ae6fd356671deceee8f211a70d5595a2

Analysis

max time kernel
142s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13-06-2024 22:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a6eb72786833e41037b692d54a08d64b_JaffaCakes118.exe
Size

3.1MB
MD5

a6eb72786833e41037b692d54a08d64b
SHA1

209d8da4ba64ad038225b99bd2ae8d38eba63805
SHA256

d688134cbb3f772d9da6dd8900b5ba32ae6fd356671deceee8f211a70d5595a2
SHA512

69261858bb0aa897f5d80c40dbd66de905d347a94b72c98fd6fc6d1d6966d1cc4a2456aaa5a9b596b8a1109b66284bae89d01bbcfb2cb8c40bd2ac17a83cd193
SSDEEP

49152:Hs3dakSdDYG/RTi10rNdCvJOAcHgAlIZ3t61hAloK1Zlxv1yq1M8Il2jrY788GhY:HhdDE0rNdZrHgUIjQCowx/C5179GtQz

Score

10^/10

qulab discovery evasion ransomware spyware stealer upx

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\1\Information.txt

Family

qulab

Ransom Note

# /===============================\ # |=== QULAB CLIPPER + STEALER ===| # |===============================| # |==== BUY CLIPPER + STEALER ====| # |=== http://teleg.run/QulabZ ===| # \===============================/ Date: 13.06.2024, 22:36:33 Main Information: - OS: Windows 10 X64 / Build: 19041 - UserName: Admin - ComputerName: OBJIYUIE - Processor: 12th Gen Intel(R) Core(TM) i5-12400 - VideoCard: Microsoft Basic Display Adapter - Memory: 8.00 Gb - KeyBoard Layout ID: 00000409 - Resolution: 1280x720x32, 64 GHz Other Information: <error> Soft / Windows Components / Windows Updates: - Google Chrome - Microsoft Edge - Microsoft Edge Update - Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 - Java Auto Updater - Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.30.30704 - Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.30.30704 - Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.40660 - Microsoft Windows Desktop Runtime - 8.0.2 (x64) - Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.40660 - Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 - Adobe Acrobat Reader DC - Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 - Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 - Microsoft Visual C++ 2022 X86 Additional Runtime - 14.30.30704 - Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 - Microsoft Windows Desktop Runtime - 6.0.27 (x64) - Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.40660 - Microsoft Windows Desktop Runtime - 7.0.16 (x64) - Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.40660 - Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 - Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.30.30704 Process List: - [System Process] / PID: 0 - System / PID: 4 - Registry / PID: 92 - smss.exe / PID: 352 - csrss.exe / PID: 440 - wininit.exe / PID: 512 - csrss.exe / PID: 520 - winlogon.exe / PID: 608 - services.exe / PID: 648 - lsass.exe / PID: 660 - fontdrvhost.exe / PID: 760 - fontdrvhost.exe / PID: 768 - svchost.exe / PID: 776 - svchost.exe / PID: 884 - svchost.exe / PID: 932 - dwm.exe / PID: 1012 - svchost.exe / PID: 504 - svchost.exe / PID: 1044 - svchost.exe / PID: 1052 - svchost.exe / PID: 1060 - svchost.exe / PID: 1068 - svchost.exe / PID: 1180 - svchost.exe / PID: 1192 - svchost.exe / PID: 1264 - svchost.exe / PID: 1308 - svchost.exe / PID: 1392 - svchost.exe / PID: 1400 - svchost.exe / PID: 1420 - svchost.exe / PID: 1568 - svchost.exe / PID: 1584 - svchost.exe / PID: 1632 - svchost.exe / PID: 1720 - svchost.exe / PID: 1756 - svchost.exe / PID: 1764 - svchost.exe / PID: 1840 - svchost.exe / PID: 1984 - svchost.exe / PID: 1992 - svchost.exe / PID: 1028 - svchost.exe / PID: 1556 - svchost.exe / PID: 1628 - spoolsv.exe / PID: 2152 - svchost.exe / PID: 2196 - svchost.exe / PID: 2244 - svchost.exe / PID: 2380 - svchost.exe / PID: 2504 - svchost.exe / PID: 2512 - svchost.exe / PID: 2648 - sysmon.exe / PID: 2720 - svchost.exe / PID: 2732 - sihost.exe / PID: 2760 - svchost.exe / PID: 2768 - svchost.exe / PID: 2776 - svchost.exe / PID: 2856 - taskhostw.exe / PID: 3068 - unsecapp.exe / PID: 524 - svchost.exe / PID: 744 - svchost.exe / PID: 3112 - svchost.exe / PID: 3328 - explorer.exe / PID: 3412 - svchost.exe / PID: 3532 - dllhost.exe / PID: 3724 - StartMenuExperienceHost.exe / PID: 3812 - RuntimeBroker.exe / PID: 3876 - SearchApp.exe / PID: 3964 - RuntimeBroker.exe / PID: 2364 - RuntimeBroker.exe / PID: 4332 - sppsvc.exe / PID: 2392 - svchost.exe / PID: 2792 - svchost.exe / PID: 724 - svchost.exe / PID: 4676 - svchost.exe / PID: 1512 - OfficeClickToRun.exe / PID: 4504 - SppExtComObj.Exe / PID: 3080 - svchost.exe / PID: 2204 - svchost.exe / PID: 1224 - dllhost.exe / PID: 1112 - TextInputHost.exe / PID: 4920 - upfc.exe / PID: 3200 - svchost.exe / PID: 604 - backgroundTaskHost.exe / PID: 1452 - RuntimeBroker.exe / PID: 4764 - RuntimeBroker.exe / PID: 3156 - ddrawex.exe / PID: 1972

URLs

http://teleg.run/QulabZ

Signatures

Qulab Stealer & Clipper
Infostealer and clipper created with AutoIt.
stealer qulab

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	a6eb72786833e41037b692d54a08d64b_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ddrawex.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ddrawex.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ddrawex.exe

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
4268	attrib.exe

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000d00000002338c-37.dat	acprotect

Checks BIOS information in registry 2 TTPs 8 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ddrawex.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ddrawex.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ddrawex.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ddrawex.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	a6eb72786833e41037b692d54a08d64b_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	a6eb72786833e41037b692d54a08d64b_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ddrawex.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ddrawex.exe

Executes dropped EXE 1 IoCs

pid	Process
4896	ddrawex.module.exe

Identifies Wine through registry keys 2 TTPs 4 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Wine	a6eb72786833e41037b692d54a08d64b_JaffaCakes118.exe
Key opened	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Wine	ddrawex.exe
Key opened	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Wine	ddrawex.exe
Key opened	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Wine	ddrawex.exe

Loads dropped DLL 2 IoCs

pid	Process
1972	ddrawex.exe
1972	ddrawex.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000d00000002338c-37.dat	upx
behavioral2/memory/1972-39-0x0000000061E00000-0x0000000061ED2000-memory.dmp	upx
behavioral2/files/0x0007000000023427-64.dat	upx
behavioral2/memory/1972-68-0x0000000061E00000-0x0000000061ED2000-memory.dmp	upx
behavioral2/memory/4896-67-0x0000000000400000-0x000000000047D000-memory.dmp	upx
behavioral2/memory/4896-73-0x0000000000400000-0x000000000047D000-memory.dmp	upx

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ipapi.co

AutoIT Executable 52 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/1696-3-0x0000000000E20000-0x0000000001455000-memory.dmp	autoit_exe
behavioral2/memory/1696-4-0x0000000000E20000-0x0000000001455000-memory.dmp	autoit_exe
behavioral2/memory/1696-5-0x0000000000E20000-0x0000000001455000-memory.dmp	autoit_exe
behavioral2/memory/1696-6-0x0000000000E20000-0x0000000001455000-memory.dmp	autoit_exe
behavioral2/memory/1696-7-0x0000000000E20000-0x0000000001455000-memory.dmp	autoit_exe
behavioral2/memory/1696-9-0x0000000000E20000-0x0000000001455000-memory.dmp	autoit_exe
behavioral2/memory/1696-10-0x0000000000E20000-0x0000000001455000-memory.dmp	autoit_exe
behavioral2/memory/1696-11-0x0000000000E20000-0x0000000001455000-memory.dmp	autoit_exe
behavioral2/memory/1696-12-0x0000000000E20000-0x0000000001455000-memory.dmp	autoit_exe
behavioral2/memory/1972-15-0x0000000000E20000-0x0000000001455000-memory.dmp	autoit_exe
behavioral2/memory/1972-16-0x0000000000E20000-0x0000000001455000-memory.dmp	autoit_exe
behavioral2/memory/1972-18-0x0000000000E20000-0x0000000001455000-memory.dmp	autoit_exe
behavioral2/memory/1972-17-0x0000000000E20000-0x0000000001455000-memory.dmp	autoit_exe
behavioral2/memory/1972-19-0x0000000000E20000-0x0000000001455000-memory.dmp	autoit_exe
behavioral2/memory/1972-20-0x0000000000E20000-0x0000000001455000-memory.dmp	autoit_exe
behavioral2/memory/1972-22-0x0000000000E20000-0x0000000001455000-memory.dmp	autoit_exe
behavioral2/memory/1972-21-0x0000000000E20000-0x0000000001455000-memory.dmp	autoit_exe
behavioral2/memory/1972-23-0x0000000000E20000-0x0000000001455000-memory.dmp	autoit_exe
behavioral2/memory/1972-24-0x0000000000E20000-0x0000000001455000-memory.dmp	autoit_exe
behavioral2/memory/1972-25-0x0000000000E20000-0x0000000001455000-memory.dmp	autoit_exe
behavioral2/memory/1972-26-0x0000000000E20000-0x0000000001455000-memory.dmp	autoit_exe
behavioral2/memory/1972-45-0x0000000000E20000-0x0000000001455000-memory.dmp	autoit_exe
behavioral2/memory/1972-46-0x0000000000E20000-0x0000000001455000-memory.dmp	autoit_exe
behavioral2/memory/1972-47-0x0000000000E20000-0x0000000001455000-memory.dmp	autoit_exe
behavioral2/memory/1972-48-0x0000000000E20000-0x0000000001455000-memory.dmp	autoit_exe
behavioral2/memory/1972-49-0x0000000000E20000-0x0000000001455000-memory.dmp	autoit_exe
behavioral2/memory/1972-51-0x0000000000E20000-0x0000000001455000-memory.dmp	autoit_exe
behavioral2/memory/1972-50-0x0000000000E20000-0x0000000001455000-memory.dmp	autoit_exe
behavioral2/memory/1972-52-0x0000000000E20000-0x0000000001455000-memory.dmp	autoit_exe
behavioral2/memory/1972-65-0x0000000000E20000-0x0000000001455000-memory.dmp	autoit_exe
behavioral2/memory/1972-66-0x0000000000E20000-0x0000000001455000-memory.dmp	autoit_exe
behavioral2/memory/1972-76-0x0000000000E20000-0x0000000001455000-memory.dmp	autoit_exe
behavioral2/memory/1972-75-0x0000000000E20000-0x0000000001455000-memory.dmp	autoit_exe
behavioral2/memory/1972-77-0x0000000000E20000-0x0000000001455000-memory.dmp	autoit_exe
behavioral2/memory/1972-78-0x0000000000E20000-0x0000000001455000-memory.dmp	autoit_exe
behavioral2/memory/1972-79-0x0000000000E20000-0x0000000001455000-memory.dmp	autoit_exe
behavioral2/memory/1972-80-0x0000000000E20000-0x0000000001455000-memory.dmp	autoit_exe
behavioral2/memory/1972-81-0x0000000000E20000-0x0000000001455000-memory.dmp	autoit_exe
behavioral2/memory/1972-82-0x0000000000E20000-0x0000000001455000-memory.dmp	autoit_exe
behavioral2/memory/1972-83-0x0000000000E20000-0x0000000001455000-memory.dmp	autoit_exe
behavioral2/memory/1972-84-0x0000000000E20000-0x0000000001455000-memory.dmp	autoit_exe
behavioral2/memory/1972-85-0x0000000000E20000-0x0000000001455000-memory.dmp	autoit_exe
behavioral2/memory/1528-88-0x0000000000E20000-0x0000000001455000-memory.dmp	autoit_exe
behavioral2/memory/1972-89-0x0000000000E20000-0x0000000001455000-memory.dmp	autoit_exe
behavioral2/memory/1972-90-0x0000000000E20000-0x0000000001455000-memory.dmp	autoit_exe
behavioral2/memory/1972-91-0x0000000000E20000-0x0000000001455000-memory.dmp	autoit_exe
behavioral2/memory/1972-92-0x0000000000E20000-0x0000000001455000-memory.dmp	autoit_exe
behavioral2/memory/1972-93-0x0000000000E20000-0x0000000001455000-memory.dmp	autoit_exe
behavioral2/memory/1972-94-0x0000000000E20000-0x0000000001455000-memory.dmp	autoit_exe
behavioral2/memory/4932-96-0x0000000000E20000-0x0000000001455000-memory.dmp	autoit_exe
behavioral2/memory/1972-97-0x0000000000E20000-0x0000000001455000-memory.dmp	autoit_exe
behavioral2/memory/1972-98-0x0000000000E20000-0x0000000001455000-memory.dmp	autoit_exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\winmgmts:\localhost\	ddrawex.exe
File opened for modification	C:\Windows\SysWOW64\winmgmts:\localhost\	ddrawex.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
1696	a6eb72786833e41037b692d54a08d64b_JaffaCakes118.exe
1972	ddrawex.exe
1528	ddrawex.exe
4932	ddrawex.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\winmgmts:\localhost\	a6eb72786833e41037b692d54a08d64b_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\winmgmts:\localhost\	ddrawex.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1696	a6eb72786833e41037b692d54a08d64b_JaffaCakes118.exe
1696	a6eb72786833e41037b692d54a08d64b_JaffaCakes118.exe
1972	ddrawex.exe
1972	ddrawex.exe
1972	ddrawex.exe
1972	ddrawex.exe
1528	ddrawex.exe
1528	ddrawex.exe
4932	ddrawex.exe
4932	ddrawex.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1696	a6eb72786833e41037b692d54a08d64b_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	4896	ddrawex.module.exe
Token: 35	4896	ddrawex.module.exe
Token: SeSecurityPrivilege	4896	ddrawex.module.exe
Token: SeSecurityPrivilege	4896	ddrawex.module.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 1972	1696	a6eb72786833e41037b692d54a08d64b_JaffaCakes118.exe	85
PID 1696 wrote to memory of 1972	1696	a6eb72786833e41037b692d54a08d64b_JaffaCakes118.exe	85
PID 1696 wrote to memory of 1972	1696	a6eb72786833e41037b692d54a08d64b_JaffaCakes118.exe	85
PID 1972 wrote to memory of 4896	1972	ddrawex.exe	87
PID 1972 wrote to memory of 4896	1972	ddrawex.exe	87
PID 1972 wrote to memory of 4896	1972	ddrawex.exe	87
PID 1972 wrote to memory of 4268	1972	ddrawex.exe	90
PID 1972 wrote to memory of 4268	1972	ddrawex.exe	90
PID 1972 wrote to memory of 4268	1972	ddrawex.exe	90

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
4268	attrib.exe

C:\Users\Admin\AppData\Local\Temp\a6eb72786833e41037b692d54a08d64b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a6eb72786833e41037b692d54a08d64b_JaffaCakes118.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe
  C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Identifies Wine through registry keys
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1972
- - C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.module.exe
    C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.module.exe a -y -mx9 -ssw "C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ENU_801FE9759599A2FE9D41.7z" "C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\1\*"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4896
- - C:\Windows\SysWOW64\attrib.exe
    attrib +s +h "C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007"
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:4268

C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe
C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1528

C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe
C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\aut7251.tmp

Filesize
360KB

MD5
44dbe3105e40cc8d527de135be76fb7b

SHA1
4918e373c2282db8a66a38ac2a6dc85b5004c623

SHA256
05d638f246c96219011a470cd32626c3f88f43ab8d0ece6883969efb0d704d1b

SHA512
6f8829162b3af1df1c914e879cb8ff71983574c0286d4dc7e63b49c7a6162728ae0c3add50f3cd54f6563e0e4df7ff82a13a30abb078a536847ec3dca8e0a843

Download Submit
C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\1\Information.txt

Filesize
4KB

MD5
29bce60e684d33f6e02cb0592103b5cb

SHA1
e2dc6c9129b3963960f1b52a5fc45997cfc37548

SHA256
880a04bfb0adef409f3ae5c311017a7abbd9501003131114e062647dc9e1056a

SHA512
9b2c0bf3b939cdd1370fe717ac4f4af9bf907a409a000a475302b60d1d32a3b638af5faccbf9718c523bb58c7886adfe6ee3c3c59df45d61f63acfcd803c8620

Download Submit
C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\1\Screen.jpg

Filesize
50KB

MD5
7e009f0a7dc4c4ad0d847479eae5a8a1

SHA1
ff28aa0386785522a1af1085d68b31a077ca9e7c

SHA256
da63b3450a197d20d16810230067127f0d1c5bcb992b330cdc8b410c0df0fd78

SHA512
d6bd31ca69a8ed3d7ec5e4b720f3224777d934558643e2ef2901b57c0aa2b6bb02af0ec7f1fb25ceb9ce7fda8406d1b665fa09c3ecaea8ba8b19b6c24bec4ba3

Download Submit
C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.module.exe

Filesize
197KB

MD5
946285055913d457fda78a4484266e96

SHA1
668661955bf3c20b9dc8cdaa7ec6e8dbbbd63285

SHA256
23ca34a7d22fdb7d36014928c089c982cdfb903e9143aea60d38f228c9594beb

SHA512
30a490b774d5736215b340d3a192825dc1dfbb7c8d9974c8ab2a09eff2429ed7cf99969ec6d651c8056549798da092ffa600681288dbd7c6f60515acd3630d95

Download Submit
C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.module.exe.4

Filesize
197KB

MD5
f9b5932ee6439bf0a6ff00d00edc813c

SHA1
8a45baab0364f4056676037224f9f150a358dd35

SHA256
6f3de48abc20c63dcd02a347bc1c54d792d89f2587588ecd0de1330343850c4a

SHA512
0d804a19036f436296af33876bf0fab3062cac62c1f16ff3f5a83f73eb325d7674f5c2a0b23267c4bd42584c332a6e3cc7239660f7d2f877eaaf458cc7b55846

Download Submit
C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..-wow64-setupdll0007\ddrawex.sqlite3.module.dll

Filesize
360KB

MD5
8c127ce55bfbb55eb9a843c693c9f240

SHA1
75c462c935a7ff2c90030c684440d61d48bb1858

SHA256
4f93f3543139febb91e0c95dc9351008e9147a484732ee5962c7df64f6868028

SHA512
d3578bd7ef01f9e25983c24eb9bb33f25c37d650cc79b823c3ec19f196d4a00deb506c1e1f774f15e5664d5263b02570fec11b322022b90a0ff1b10943188a02

Download Submit
memory/1528-86-0x0000000000E20000-0x0000000001455000-memory.dmp

Filesize
6.2MB

Download
memory/1528-88-0x0000000000E20000-0x0000000001455000-memory.dmp

Filesize
6.2MB

Download
memory/1696-5-0x0000000000E20000-0x0000000001455000-memory.dmp

Filesize
6.2MB

Download
memory/1696-4-0x0000000000E20000-0x0000000001455000-memory.dmp

Filesize
6.2MB

Download
memory/1696-3-0x0000000000E20000-0x0000000001455000-memory.dmp

Filesize
6.2MB

Download
memory/1696-6-0x0000000000E20000-0x0000000001455000-memory.dmp

Filesize
6.2MB

Download
memory/1696-7-0x0000000000E20000-0x0000000001455000-memory.dmp

Filesize
6.2MB

Download
memory/1696-9-0x0000000000E20000-0x0000000001455000-memory.dmp

Filesize
6.2MB

Download
memory/1696-10-0x0000000000E20000-0x0000000001455000-memory.dmp

Filesize
6.2MB

Download
memory/1696-11-0x0000000000E20000-0x0000000001455000-memory.dmp

Filesize
6.2MB

Download
memory/1696-12-0x0000000000E20000-0x0000000001455000-memory.dmp

Filesize
6.2MB

Download
memory/1696-2-0x0000000000E21000-0x0000000000E7E000-memory.dmp

Filesize
372KB

Download
memory/1696-1-0x0000000077794000-0x0000000077796000-memory.dmp

Filesize
8KB

Download
memory/1696-0-0x0000000000E20000-0x0000000001455000-memory.dmp

Filesize
6.2MB

Download
memory/1972-47-0x0000000000E20000-0x0000000001455000-memory.dmp

Filesize
6.2MB

Download
memory/1972-85-0x0000000000E20000-0x0000000001455000-memory.dmp

Filesize
6.2MB

Download
memory/1972-19-0x0000000000E20000-0x0000000001455000-memory.dmp

Filesize
6.2MB

Download
memory/1972-20-0x0000000000E20000-0x0000000001455000-memory.dmp

Filesize
6.2MB

Download
memory/1972-22-0x0000000000E20000-0x0000000001455000-memory.dmp

Filesize
6.2MB

Download
memory/1972-21-0x0000000000E20000-0x0000000001455000-memory.dmp

Filesize
6.2MB

Download
memory/1972-23-0x0000000000E20000-0x0000000001455000-memory.dmp

Filesize
6.2MB

Download
memory/1972-24-0x0000000000E20000-0x0000000001455000-memory.dmp

Filesize
6.2MB

Download
memory/1972-25-0x0000000000E20000-0x0000000001455000-memory.dmp

Filesize
6.2MB

Download
memory/1972-26-0x0000000000E20000-0x0000000001455000-memory.dmp

Filesize
6.2MB

Download
memory/1972-39-0x0000000061E00000-0x0000000061ED2000-memory.dmp

Filesize
840KB

Download
memory/1972-43-0x0000000061E00000-0x0000000061ED2000-memory.dmp

Filesize
840KB

Download
memory/1972-45-0x0000000000E20000-0x0000000001455000-memory.dmp

Filesize
6.2MB

Download
memory/1972-46-0x0000000000E20000-0x0000000001455000-memory.dmp

Filesize
6.2MB

Download
memory/1972-18-0x0000000000E20000-0x0000000001455000-memory.dmp

Filesize
6.2MB

Download
memory/1972-48-0x0000000000E20000-0x0000000001455000-memory.dmp

Filesize
6.2MB

Download
memory/1972-49-0x0000000000E20000-0x0000000001455000-memory.dmp

Filesize
6.2MB

Download
memory/1972-51-0x0000000000E20000-0x0000000001455000-memory.dmp

Filesize
6.2MB

Download
memory/1972-50-0x0000000000E20000-0x0000000001455000-memory.dmp

Filesize
6.2MB

Download
memory/1972-52-0x0000000000E20000-0x0000000001455000-memory.dmp

Filesize
6.2MB

Download
memory/1972-65-0x0000000000E20000-0x0000000001455000-memory.dmp

Filesize
6.2MB

Download
memory/1972-66-0x0000000000E20000-0x0000000001455000-memory.dmp

Filesize
6.2MB

Download
memory/1972-68-0x0000000061E00000-0x0000000061ED2000-memory.dmp

Filesize
840KB

Download
memory/1972-16-0x0000000000E20000-0x0000000001455000-memory.dmp

Filesize
6.2MB

Download
memory/1972-98-0x0000000000E20000-0x0000000001455000-memory.dmp

Filesize
6.2MB

Download
memory/1972-97-0x0000000000E20000-0x0000000001455000-memory.dmp

Filesize
6.2MB

Download
memory/1972-74-0x0000000061E00000-0x0000000061ED2000-memory.dmp

Filesize
840KB

Download
memory/1972-76-0x0000000000E20000-0x0000000001455000-memory.dmp

Filesize
6.2MB

Download
memory/1972-75-0x0000000000E20000-0x0000000001455000-memory.dmp

Filesize
6.2MB

Download
memory/1972-77-0x0000000000E20000-0x0000000001455000-memory.dmp

Filesize
6.2MB

Download
memory/1972-78-0x0000000000E20000-0x0000000001455000-memory.dmp

Filesize
6.2MB

Download
memory/1972-79-0x0000000000E20000-0x0000000001455000-memory.dmp

Filesize
6.2MB

Download
memory/1972-80-0x0000000000E20000-0x0000000001455000-memory.dmp

Filesize
6.2MB

Download
memory/1972-81-0x0000000000E20000-0x0000000001455000-memory.dmp

Filesize
6.2MB

Download
memory/1972-82-0x0000000000E20000-0x0000000001455000-memory.dmp

Filesize
6.2MB

Download
memory/1972-83-0x0000000000E20000-0x0000000001455000-memory.dmp

Filesize
6.2MB

Download
memory/1972-84-0x0000000000E20000-0x0000000001455000-memory.dmp

Filesize
6.2MB

Download
memory/1972-17-0x0000000000E20000-0x0000000001455000-memory.dmp

Filesize
6.2MB

Download
memory/1972-15-0x0000000000E20000-0x0000000001455000-memory.dmp

Filesize
6.2MB

Download
memory/1972-14-0x0000000000E20000-0x0000000001455000-memory.dmp

Filesize
6.2MB

Download
memory/1972-89-0x0000000000E20000-0x0000000001455000-memory.dmp

Filesize
6.2MB

Download
memory/1972-90-0x0000000000E20000-0x0000000001455000-memory.dmp

Filesize
6.2MB

Download
memory/1972-91-0x0000000000E20000-0x0000000001455000-memory.dmp

Filesize
6.2MB

Download
memory/1972-92-0x0000000000E20000-0x0000000001455000-memory.dmp

Filesize
6.2MB

Download
memory/1972-93-0x0000000000E20000-0x0000000001455000-memory.dmp

Filesize
6.2MB

Download
memory/1972-94-0x0000000000E20000-0x0000000001455000-memory.dmp

Filesize
6.2MB

Download
memory/4896-73-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download
memory/4896-67-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download
memory/4932-95-0x0000000000E20000-0x0000000001455000-memory.dmp

Filesize
6.2MB

Download
memory/4932-96-0x0000000000E20000-0x0000000001455000-memory.dmp

Filesize
6.2MB

Download