Analysis
-
max time kernel
136s -
max time network
134s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
14-12-2020 22:28
General
-
Target
Document_1028174287-Copy.xls
-
Size
54KB
-
MD5
08037f2bf6b8fe9ae8c245903af45729
-
SHA1
2836aa101a02a284c6df9ed17bd092f25c34f80f
-
SHA256
586bd4e1f5f41569b260ce6cc6b5243bee2209c35915d1a3050cf4196c6133eb
-
SHA512
2e0ffec3933f66b623e2eded690497115f251036d282dc915721b61175164eeb0573a1c4706b1f84453c9286ff1b8c3f7a1756fdd41d532dcf8e9dc24c22dc1e
Malware Config
Extracted
qakbot
abc112
1607942962
66.26.160.37:443
84.78.128.76:2222
45.250.69.150:443
108.31.15.10:995
50.244.112.10:995
47.146.34.236:443
24.95.61.62:443
31.5.21.66:995
59.99.37.134:443
79.115.134.161:443
39.57.127.126:995
120.151.95.167:443
47.44.217.98:443
32.212.117.188:443
37.21.231.245:995
184.97.145.239:443
86.121.3.80:443
83.110.97.149:443
83.194.193.247:2222
78.101.158.1:61201
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
-
Loads dropped DLL 2 IoCs
-
Program crash 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 18 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 12 IoCs
-
Suspicious use of WriteProcessMemory 16 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Document_1028174287-Copy.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\rundll32.exerundll32 C:\IntelCompany\JIOLAS.RRTTOOKK,DllRegisterServer2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32 C:\IntelCompany\JIOLAS.RRTTOOKK,DllRegisterServer3⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn wmecgmlbs /tr "regsvr32.exe -s \"C:\IntelCompany\JIOLAS.RRTTOOKK\"" /SC ONCE /Z /ST 22:33 /ET 22:455⤵
- Creates scheduled task(s)
-
\??\c:\windows\system32\regsvr32.exeregsvr32.exe -s "C:\IntelCompany\JIOLAS.RRTTOOKK"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe-s "C:\IntelCompany\JIOLAS.RRTTOOKK"2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3108 -s 5963⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\IntelCompany\JIOLAS.RRTTOOKKMD5
37638544ad2872186e7be440c1ce2db8
SHA1c4947e95605c9f270cc40fbfd43f68f058a9e15b
SHA2565663904ac0902cf42a9f562733ef43e83d8faed39443634412bf6083304f819e
SHA5120edf782169262031cf2325962a66e95bbf89a1085ec49ba4a6e44b93370982e226b79c31e8d2cd61495cbfa6af716634e4bc210549637f75d57f8b9c247459a8
-
C:\IntelCompany\JIOLAS.RRTTOOKKMD5
f8438127f3e1aa22ab9ee82950e20fec
SHA1f77d5a33a2b9dfeb80ca56ee25a43b52ca2b685e
SHA2568891317cdad2b03f900aad14fe4c029ad8966874a444ca290cc5c915cf7f7532
SHA512f62b826974e3e19b0e68fba5dcb186ed01f607a32d3cd366e0472adc23a3d879aea31d01c5b09d106411db4a09d1e7f2996bc15d52008466f3e2442641b91337
-
\IntelCompany\JIOLAS.RRTTOOKKMD5
37638544ad2872186e7be440c1ce2db8
SHA1c4947e95605c9f270cc40fbfd43f68f058a9e15b
SHA2565663904ac0902cf42a9f562733ef43e83d8faed39443634412bf6083304f819e
SHA5120edf782169262031cf2325962a66e95bbf89a1085ec49ba4a6e44b93370982e226b79c31e8d2cd61495cbfa6af716634e4bc210549637f75d57f8b9c247459a8
-
\IntelCompany\JIOLAS.RRTTOOKKMD5
f8438127f3e1aa22ab9ee82950e20fec
SHA1f77d5a33a2b9dfeb80ca56ee25a43b52ca2b685e
SHA2568891317cdad2b03f900aad14fe4c029ad8966874a444ca290cc5c915cf7f7532
SHA512f62b826974e3e19b0e68fba5dcb186ed01f607a32d3cd366e0472adc23a3d879aea31d01c5b09d106411db4a09d1e7f2996bc15d52008466f3e2442641b91337
-
memory/1932-19-0x0000000003920000-0x0000000003921000-memory.dmpFilesize
4KB
-
memory/1932-17-0x00000000032D0000-0x00000000032D1000-memory.dmpFilesize
4KB
-
memory/1932-16-0x00000000032D0000-0x00000000032D1000-memory.dmpFilesize
4KB
-
memory/2612-10-0x0000000000000000-mapping.dmp
-
memory/2612-12-0x0000000003280000-0x00000000032A1000-memory.dmpFilesize
132KB
-
memory/2964-11-0x0000000000000000-mapping.dmp
-
memory/3108-14-0x0000000000000000-mapping.dmp
-
memory/3108-18-0x0000000000000000-mapping.dmp
-
memory/3936-9-0x0000000004B10000-0x0000000004B31000-memory.dmpFilesize
132KB
-
memory/3936-7-0x0000000000000000-mapping.dmp
-
memory/3956-5-0x0000000000000000-mapping.dmp
-
memory/4068-2-0x00007FFED8840000-0x00007FFED8E77000-memory.dmpFilesize
6.2MB
-
memory/4068-4-0x000002023A77B000-0x000002023A780000-memory.dmpFilesize
20KB
-
memory/4068-3-0x000002023A77B000-0x000002023A780000-memory.dmpFilesize
20KB