Overview

overview

10

Static

static

8

Document_3...y.xlsm

windows7_x64

10

Document_3...y.xlsm

windows10_x64

10

Analysis

  • max time kernel
    143s
  • max time network
    133s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    25-12-2020 08:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Document_312780006-12232020-Copy.xlsm

  • Size

    25KB

  • MD5

    c22078f129f1d702314102bc47fa5a77

  • SHA1

    b9fb91344d5276c9ca779867fecea5ac80c89f21

  • SHA256

    d85b3c0bee9a537ec923c070fde22f9e275130ab2c3e031397796cc856a44588

  • SHA512

    aad36bb3ce63f59fae9b4d66ec5a6921edba8903c684746021a44c04817635513cedf48fb34bd69c14637874313de66a7e5d623dd36011bffae1728e7398cd9e

Score
10/10
qakbotabc1171608747966bankercryptonepackerstealertrojan

Malware Config

Extracted

Family

qakbot

Botnet

abc117

Campaign

1608747966

C2

67.6.54.180:443

187.250.170.34:995

67.141.11.98:443

109.154.79.222:2222

2.88.184.160:443

85.52.72.32:2222

86.98.21.234:443

73.166.10.38:50003

90.61.30.155:2222

71.182.142.63:443

178.223.22.192:995

184.189.122.72:443

181.39.236.199:443

72.240.200.181:2222

154.238.45.174:995

47.22.148.6:443

2.51.251.47:995

199.19.117.131:443

200.76.215.87:443

37.104.39.32:995

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

    trojanbankerstealerqakbot
  • CryptOne packer 2 IoCs

    Detects CryptOne packer defined in NCC blogpost.

    cryptonepacker
  • Loads dropped DLL 2 IoCs
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Document_312780006-12232020-Copy.xlsm"
    1⤵
    • Enumerates connected drives
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:732
    • C:\Windows\SYSTEM32\rundll32.exe
      rundll32.exe ..\AppData\Roaming\Gertik.JJSSDDFF,DllRegisterServer
      2⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:3984
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe ..\AppData\Roaming\Gertik.JJSSDDFF,DllRegisterServer
        3⤵
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:3212
        • C:\Windows\SysWOW64\explorer.exe
          C:\Windows\SysWOW64\explorer.exe
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3172
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn qprdqxq /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Roaming\Gertik.JJSSDDFF\"" /SC ONCE /Z /ST 09:42 /ET 09:54
            5⤵
            • Creates scheduled task(s)
            PID:3728
  • \??\c:\windows\system32\regsvr32.exe
    regsvr32.exe -s "C:\Users\Admin\AppData\Roaming\Gertik.JJSSDDFF"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3548
    • C:\Windows\SysWOW64\regsvr32.exe
      -s "C:\Users\Admin\AppData\Roaming\Gertik.JJSSDDFF"
      2⤵
      • Loads dropped DLL
      PID:1188
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1188 -s 596
        3⤵
        • Program crash
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1500

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

3
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Gertik.JJSSDDFF
    MD5

    f9d744c32aef48e8293c2ebf609fed49

    SHA1

    d69f3f62bfc0199b6a4cdec40961126148863f2f

    SHA256

    2e92c5e1d166b2771273f186e5a6bbbf0556baae545680a61e9c5423dbfa9ee8

    SHA512

    8c3cb155e0d60d160e2ba7b46d0aa7f32e239f5e0626934c5a78a313eb18a4beb439d9a6cde75120a07a07902d3a5ec07b4e635c0ebe634311c2c1514928859c

    Download Submit
  • C:\Users\Admin\AppData\Roaming\Gertik.JJSSDDFF
    MD5

    8975d15acdfa4ca3424ab401e1ae37d1

    SHA1

    013a41ce926680dbc80045b3b91dfd2c18c1b936

    SHA256

    8f37755854059b5e99553b850155ec2e42fc05b58d89c2ab482f80213491a4d4

    SHA512

    a2196e4ec2e91fbc8e1a3be9b63de7e83ada92237b5c6e8302c7343917ba2d5d5a418cc119a5fea096f4b1a32d4cd76725952609b604b219632fb0133dc5616e

    Download Submit
  • \Users\Admin\AppData\Roaming\Gertik.JJSSDDFF
    MD5

    f9d744c32aef48e8293c2ebf609fed49

    SHA1

    d69f3f62bfc0199b6a4cdec40961126148863f2f

    SHA256

    2e92c5e1d166b2771273f186e5a6bbbf0556baae545680a61e9c5423dbfa9ee8

    SHA512

    8c3cb155e0d60d160e2ba7b46d0aa7f32e239f5e0626934c5a78a313eb18a4beb439d9a6cde75120a07a07902d3a5ec07b4e635c0ebe634311c2c1514928859c

    Download Submit
  • \Users\Admin\AppData\Roaming\Gertik.JJSSDDFF
    MD5

    8975d15acdfa4ca3424ab401e1ae37d1

    SHA1

    013a41ce926680dbc80045b3b91dfd2c18c1b936

    SHA256

    8f37755854059b5e99553b850155ec2e42fc05b58d89c2ab482f80213491a4d4

    SHA512

    a2196e4ec2e91fbc8e1a3be9b63de7e83ada92237b5c6e8302c7343917ba2d5d5a418cc119a5fea096f4b1a32d4cd76725952609b604b219632fb0133dc5616e

    Download Submit
  • memory/732-2-0x00007FFD71300000-0x00007FFD71937000-memory.dmp
    Filesize

    6.2MB

    Download
  • memory/1188-16-0x0000000000000000-mapping.dmp
    Download
  • memory/1188-13-0x0000000000000000-mapping.dmp
    Download
  • memory/1500-15-0x0000000003420000-0x0000000003421000-memory.dmp
    Filesize

    4KB

    Download
  • memory/3172-11-0x00000000008B0000-0x00000000008E4000-memory.dmp
    Filesize

    208KB

    Download
  • memory/3172-8-0x0000000000000000-mapping.dmp
    Download
  • memory/3212-9-0x0000000010000000-0x0000000010034000-memory.dmp
    Filesize

    208KB

    Download
  • memory/3212-7-0x00000000042B0000-0x00000000042E4000-memory.dmp
    Filesize

    208KB

    Download
  • memory/3212-5-0x0000000000000000-mapping.dmp
    Download
  • memory/3728-10-0x0000000000000000-mapping.dmp
    Download
  • memory/3984-3-0x0000000000000000-mapping.dmp
    Download