Overview

overview

10

Static

static

8

document-1...37.xls

windows7_x64

10

document-1...37.xls

windows10_x64

10

Analysis

  • max time kernel
    140s
  • max time network
    134s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    27/11/2020, 15:40

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    document-1670320837.xls
  • Size 331KB
  • Sample201127-35ds3rk49x
  • SHA256 d42c4315790b03cf4dfc99b2daf0e00e445345f86b4d2c15a45ec764cc3e742e
  • MD5 SHA1 SHA512
Score
10/10
qakbottr021606301054bankerstealertrojan

Malware Config

Extracted

Family

  • qakbot

Botnet

  • tr02

Campaign

  • 1606301054

C2

  • 59.98.96.143:443

  • 86.122.248.164:2222

  • 101.185.175.169:2222

  • 71.187.170.235:443

  • 92.59.35.196:2222

  • 188.52.193.110:995

  • 90.175.88.99:2222

  • 37.107.111.46:995

  • 96.237.141.134:995

  • 2.50.143.154:2078

  • 109.205.204.229:2222

  • 90.101.62.189:2222

  • 41.228.220.155:443

  • 190.128.215.174:443

  • 188.26.243.119:443

  • 79.113.247.80:443

  • 82.76.47.211:443

  • 73.248.120.240:443

  • 72.36.59.46:2222

  • 74.129.26.119:443

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

    trojanbankerstealerqakbot
  • Loads dropped DLL 3 IoCs
  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 34 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\document-1670320837.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4768
    • C:\Windows\SYSTEM32\regsvr32.exe
      regsvr32 -s C:\giogti\mpomqr\fwpxeohi.dll
      2⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:1256
      • C:\Windows\SysWOW64\regsvr32.exe
        -s C:\giogti\mpomqr\fwpxeohi.dll
        3⤵
        • Loads dropped DLL
        • Checks SCSI registry key(s)
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:1376
        • C:\Windows\SysWOW64\explorer.exe
          C:\Windows\SysWOW64\explorer.exe
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1504
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn eemspcqh /tr "regsvr32.exe -s \"C:\giogti\mpomqr\fwpxeohi.dll\"" /SC ONCE /Z /ST 15:40 /ET 15:52
            5⤵
            • Creates scheduled task(s)
            PID:932
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1376 -s 832
          4⤵
          • Program crash
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1980
  • \??\c:\windows\system32\regsvr32.exe
    regsvr32.exe -s "C:\giogti\mpomqr\fwpxeohi.dll"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2004
    • C:\Windows\SysWOW64\regsvr32.exe
      -s "C:\giogti\mpomqr\fwpxeohi.dll"
      2⤵
      • Loads dropped DLL
      PID:4052
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4052 -s 596
        3⤵
        • Program crash
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4532

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/1376-8-0x0000000000C70000-0x0000000000C90000-memory.dmp
        Download

        memory/1504-12-0x0000000002D40000-0x0000000002D60000-memory.dmp
        Download

        memory/1980-17-0x0000000005280000-0x0000000005281000-memory.dmp
        Download

        memory/1980-10-0x0000000004C50000-0x0000000004C51000-memory.dmp
        Download

        memory/4532-29-0x0000000002F20000-0x0000000002F21000-memory.dmp
        Download

        memory/4532-31-0x0000000003550000-0x0000000003551000-memory.dmp
        Download

        memory/4768-2-0x00007FF93F5C0000-0x00007FF93FBF7000-memory.dmp
        Download