Analysis
- max time kernel
148s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
25/10/2026, 01:05
General
- Target 2026-10-24_f809b44da445b8391b1daefad55bfa6b_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
- Size 1.8MB
- Sample261025-bfwadasz4l
- SHA256 27dddf0b8a01db44e62b5058094bcbb63201ac5365e2b243badbfc64b57d1a39
Score
10/10
Malware Config
Extracted
Path
-
C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-sqlliteqp\1\Information.txt
-
qulab
Ransom Note
- # /===============================\ # |=== QULAB CLIPPER + STEALER ===| # |===============================| # |==== BUY CLIPPER + STEALER ====| # |=== http://teleg.run/QulabZ ===| # \===============================/ Date: 25.10.2026, 01:05:50 Main Information: - OS: Windows 10 X64 / Build: 26100 - UserName: Admin - ComputerName: SZAPMTOP - VideoCard: NVIDIA GeForce 210 - Processor: 12th Gen Intel(R) Core(TM) i5-12400 - Memory: 16.00 Gb - KeyBoard Layout ID: 00000409 - Resolution: 1920x1080x32, 64 GHz Other Information: <error> Soft / Windows Components / Windows Updates: - Google Chrome - Microsoft Edge WebView2 Runtime - Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 - Java Auto Updater - Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.30.30704 - Microsoft Windows Desktop Runtime - 8.0.15 (x64) - Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.30.30704 - Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.40660 - Microsoft Edge - Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.40660 - Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 - Adobe Acrobat Reader DC - Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 - Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 - Microsoft Visual C++ 2022 X86 Additional Runtime - 14.30.30704 - Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 - Microsoft Windows Desktop Runtime - 6.0.27 (x64) - Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.40660 - Microsoft Windows Desktop Runtime - 7.0.16 (x64) - Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.40660 - Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 - Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.30.30704 Process List: - [System Process] / PID: 0 - System / PID: 4 - Registry / PID: 100 - smss.exe / PID: 440 - csrss.exe / PID: 604 - wininit.exe / PID: 676 - csrss.exe / PID: 692 - winlogon.exe / PID: 740 - services.exe / PID: 812 - lsass.exe / PID: 832 - svchost.exe / PID: 948 - fontdrvhost.exe / PID: 956 - fontdrvhost.exe / PID: 968 - WUDFHost.exe / PID: 480 - svchost.exe / PID: 424 - svchost.exe / PID: 1032 - svchost.exe / PID: 1120 - svchost.exe / PID: 1128 - dwm.exe / PID: 1188 - svchost.exe / PID: 1272 - svchost.exe / PID: 1352 - svchost.exe / PID: 1368 - svchost.exe / PID: 1376 - svchost.exe / PID: 1496 - svchost.exe / PID: 1512 - svchost.exe / PID: 1568 - svchost.exe / PID: 1596 - svchost.exe / PID: 1688 - svchost.exe / PID: 1768 - svchost.exe / PID: 1776 - svchost.exe / PID: 1792 - svchost.exe / PID: 1972 - svchost.exe / PID: 1396 - svchost.exe / PID: 1784 - svchost.exe / PID: 1932 - svchost.exe / PID: 2180 - svchost.exe / PID: 2188 - svchost.exe / PID: 2268 - svchost.exe / PID: 2408 - svchost.exe / PID: 2416 - svchost.exe / PID: 2500 - svchost.exe / PID: 2568 - svchost.exe / PID: 2592 - svchost.exe / PID: 2756 - svchost.exe / PID: 2856 - svchost.exe / PID: 2992 - svchost.exe / PID: 3012 - svchost.exe / PID: 716 - svchost.exe / PID: 2124 - spoolsv.exe / PID: 3164 - svchost.exe / PID: 3208 - svchost.exe / PID: 3252 - svchost.exe / PID: 3304 - ShellHost.exe / PID: 3488 - svchost.exe / PID: 3628 - svchost.exe / PID: 3660 - svchost.exe / PID: 3672 - svchost.exe / PID: 3692 - svchost.exe / PID: 3720 - svchost.exe / PID: 3736 - svchost.exe / PID: 3388 - svchost.exe / PID: 1100 - RuntimeBroker.exe / PID: 4380 - RuntimeBroker.exe / PID: 4440 - svchost.exe / PID: 4472 - svchost.exe / PID: 4660 - dllhost.exe / PID: 4724 - ctfmon.exe / PID: 4512 - dllhost.exe / PID: 5168 - smartscreen.exe / PID: 5268 - SecurityHealthSystray.exe / PID: 5308 - SecurityHealthService.exe / PID: 5324 - svchost.exe / PID: 5532 - svchost.exe / PID: 3456 - sppsvc.exe / PID: 4496 - svchost.exe / PID: 1840 - svchost.exe / PID: 2900 - svchost.exe / PID: 3260 - svchost.exe / PID: 5136 - OfficeClickToRun.exe / PID: 3940 - sihost.exe / PID: 5884 - explorer.exe / PID: 5932 - StartMenuExperienceHost.exe / PID: 6000 - SearchHost.exe / PID: 3448 - upfc.exe / PID: 2460 - svchost.exe / PID: 6056 - svchost.exe / PID: 4080 - stclient.exe / PID: 3444
URLs
-
http://teleg.run/QulabZ
Signatures
- Family: Qulab Stealer & Clipper
Infostealer and clipper created with AutoIt.
- UPX dump on OEP (original entry point) 8 IoCs
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 2 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable 6 IoCs
AutoIT scripts compiled to PE executables.
- Drops file in System32 directory 2 IoCs
- UPX packed file 8 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Windows directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 10 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 16 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 6 IoCs
- NTFS ADS 3 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-24_f809b44da445b8391b1daefad55bfa6b_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-24_f809b44da445b8391b1daefad55bfa6b_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-sqlliteqp\stclient.exeC:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-sqlliteqp\stclient.exe2⤵
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-sqlliteqp\stclient.module.exeC:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-sqlliteqp\stclient.module.exe a -y -mx9 -ssw "C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-sqlliteqp\ENU_801FE970F4D01A3E9D41.7z" "C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-sqlliteqp\1\*"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-sqlliteqp\stclient.exe"C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-sqlliteqp\stclient.exe"1⤵
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- NTFS ADS
-
C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-sqlliteqp\stclient.exe"C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-sqlliteqp\stclient.exe"1⤵
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-sqlliteqp\stclient.exe"C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-sqlliteqp\stclient.exe"1⤵
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
Information.txt
Screen.jpg
stclient.module.exe
stclient.sqlite3.module.dll
memory/2492-48-0x0000000000B10000-0x0000000000CD8000-memory.dmp
memory/2704-49-0x0000000000B10000-0x0000000000CD8000-memory.dmp
memory/2768-19-0x0000000000B10000-0x0000000000CD8000-memory.dmp
memory/3280-4-0x0000000000B10000-0x0000000000CD8000-memory.dmp
memory/3280-0-0x0000000000B10000-0x0000000000CD8000-memory.dmp
memory/3444-45-0x0000000061E00000-0x0000000061ED1000-memory.dmp
memory/3444-14-0x0000000061E00000-0x0000000061ED1000-memory.dmp
memory/3444-46-0x0000000061E00000-0x0000000061ED1000-memory.dmp
memory/3444-11-0x0000000061E00000-0x0000000061ED1000-memory.dmp
memory/3444-3-0x0000000000B10000-0x0000000000CD8000-memory.dmp
memory/5640-40-0x0000000000400000-0x000000000048E000-memory.dmp
memory/5640-44-0x0000000000400000-0x000000000048E000-memory.dmp