Overview

overview

10

Static

static

8

Document_2...y.xlsm

windows7_x64

10

Document_2...y.xlsm

windows10_x64

10

Analysis

  • max time kernel
    139s
  • max time network
    132s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    24-12-2020 10:20

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Document_2124969363-12232020-Copy.xlsm

  • Size

    25KB

  • MD5

    fdd92a903be9c2313c7a2caa1c2ed536

  • SHA1

    fad193a01a203670247e3ccb0d94fbae1be3e391

  • SHA256

    ed19c01f859cfb2f8432e280379edf45dc2d02e152360ffb3199f8f47deea73c

  • SHA512

    95fd89a469e482c4bf489d7845a3228942785b7924bfa47449f4da9721270716d65b7daf24ca195dee1d9aa508fe34b8864fe7a4352c363814e764b30ca2d640

Score
10/10
qakbotabc1171608747966bankercryptonepackerstealertrojan

Malware Config

Extracted

Family

qakbot

Botnet

abc117

Campaign

1608747966

C2

67.6.54.180:443

187.250.170.34:995

67.141.11.98:443

109.154.79.222:2222

2.88.184.160:443

85.52.72.32:2222

86.98.21.234:443

73.166.10.38:50003

90.61.30.155:2222

71.182.142.63:443

178.223.22.192:995

184.189.122.72:443

181.39.236.199:443

72.240.200.181:2222

154.238.45.174:995

47.22.148.6:443

2.51.251.47:995

199.19.117.131:443

200.76.215.87:443

37.104.39.32:995

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

    trojanbankerstealerqakbot
  • CryptOne packer 2 IoCs

    Detects CryptOne packer defined in NCC blogpost.

    cryptonepacker
  • Loads dropped DLL 2 IoCs
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Document_2124969363-12232020-Copy.xlsm"
    1⤵
    • Enumerates connected drives
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:640
    • C:\Windows\SYSTEM32\rundll32.exe
      rundll32.exe ..\AppData\Roaming\Gertik.JJSSDDFF,DllRegisterServer
      2⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:2124
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe ..\AppData\Roaming\Gertik.JJSSDDFF,DllRegisterServer
        3⤵
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:3932
        • C:\Windows\SysWOW64\explorer.exe
          C:\Windows\SysWOW64\explorer.exe
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3948
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn kwvglooucl /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Roaming\Gertik.JJSSDDFF\"" /SC ONCE /Z /ST 11:20 /ET 11:32
            5⤵
            • Creates scheduled task(s)
            PID:732
  • \??\c:\windows\system32\regsvr32.exe
    regsvr32.exe -s "C:\Users\Admin\AppData\Roaming\Gertik.JJSSDDFF"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1928
    • C:\Windows\SysWOW64\regsvr32.exe
      -s "C:\Users\Admin\AppData\Roaming\Gertik.JJSSDDFF"
      2⤵
      • Loads dropped DLL
      PID:800
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 800 -s 596
        3⤵
        • Program crash
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2256

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

3
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Gertik.JJSSDDFF
    MD5

    2baacc25573c8079c754a8c80e7c8a71

    SHA1

    4a3e5524556c6f3b17bf5336fb7ad64f78602f26

    SHA256

    9fae2f37c7218e37fa5edd8b9b0b5d9da559f525b90074a9ea0ac8e5ca5aeff2

    SHA512

    4bad1d8ffcfb63e8012668960e53625f9e093253e13a971d44b78ed097b3fb872d8536909f864aa3c8287f0c557ad0a5ef78e33e337eb607ac112b0ce0e0a683

    Download Submit
  • C:\Users\Admin\AppData\Roaming\Gertik.JJSSDDFF
    MD5

    328be2bfc1b55125b50988a281c6432d

    SHA1

    134651422c44d02bd64e648a84136f3448f6614e

    SHA256

    41ecc1ee33949c5a65f3ac2df1466e514166fd93d2f31dc89197aa4e30f008b4

    SHA512

    6a46d90133e4a61fcef0f407f2f4d1b1f9a8134ed6708ac0021c3b09d9a8b76af8484180b17c1714ed2e6cc21a46e531c585a9b48bf8aa9bc6e3ecb93dbcf237

    Download Submit
  • \Users\Admin\AppData\Roaming\Gertik.JJSSDDFF
    MD5

    2baacc25573c8079c754a8c80e7c8a71

    SHA1

    4a3e5524556c6f3b17bf5336fb7ad64f78602f26

    SHA256

    9fae2f37c7218e37fa5edd8b9b0b5d9da559f525b90074a9ea0ac8e5ca5aeff2

    SHA512

    4bad1d8ffcfb63e8012668960e53625f9e093253e13a971d44b78ed097b3fb872d8536909f864aa3c8287f0c557ad0a5ef78e33e337eb607ac112b0ce0e0a683

    Download Submit
  • \Users\Admin\AppData\Roaming\Gertik.JJSSDDFF
    MD5

    328be2bfc1b55125b50988a281c6432d

    SHA1

    134651422c44d02bd64e648a84136f3448f6614e

    SHA256

    41ecc1ee33949c5a65f3ac2df1466e514166fd93d2f31dc89197aa4e30f008b4

    SHA512

    6a46d90133e4a61fcef0f407f2f4d1b1f9a8134ed6708ac0021c3b09d9a8b76af8484180b17c1714ed2e6cc21a46e531c585a9b48bf8aa9bc6e3ecb93dbcf237

    Download Submit
  • memory/640-2-0x00007FFC34060000-0x00007FFC34697000-memory.dmp
    Filesize

    6.2MB

    Download
  • memory/732-10-0x0000000000000000-mapping.dmp
    Download
  • memory/800-16-0x0000000000000000-mapping.dmp
    Download
  • memory/800-13-0x0000000000000000-mapping.dmp
    Download
  • memory/2124-3-0x0000000000000000-mapping.dmp
    Download
  • memory/2256-15-0x0000000002F10000-0x0000000002F11000-memory.dmp
    Filesize

    4KB

    Download
  • memory/3932-9-0x0000000010000000-0x0000000010034000-memory.dmp
    Filesize

    208KB

    Download
  • memory/3932-7-0x0000000004BB0000-0x0000000004BE4000-memory.dmp
    Filesize

    208KB

    Download
  • memory/3932-5-0x0000000000000000-mapping.dmp
    Download
  • memory/3948-8-0x0000000000000000-mapping.dmp
    Download
  • memory/3948-11-0x0000000000B20000-0x0000000000B54000-memory.dmp
    Filesize

    208KB

    Download