Analysis
-
max time kernel
151s -
max time network
18s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
28-01-2021 17:21
General
-
Target
file.01.21.doc
-
Size
92KB
-
MD5
cfbd343882b57a2d395ddb566984a0dd
-
SHA1
8baa1cb1935bafa0f89bd4fc5d5c8c47d05d1f4c
-
SHA256
dfffacd10a8887ff9e48cb452696fa8a9b6b83ea3e285b4f7d3692677c8c30fc
-
SHA512
e3606d5bc2354c7e4b3eff6aa681ee77d8f9aeaec07641a93ac02aed063b952feaa8ffebbb1fb4e68e5d131ece24264c03a6f4a5191d15e42767203bf83e1653
Malware Config
Extracted
qakbot
krk01
1611569149
31.5.21.66:995
89.3.198.238:443
202.188.138.162:443
188.24.128.253:443
175.141.219.71:443
151.60.15.183:443
184.189.122.72:443
80.227.5.70:443
140.82.49.12:443
89.211.241.100:995
81.97.154.100:443
77.27.174.49:995
92.154.83.96:2078
42.3.8.54:443
71.187.170.235:443
46.153.36.53:995
71.182.142.63:443
105.186.102.16:443
50.244.112.106:443
78.63.226.32:443
Signatures
-
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Drops file in Windows directory 1 IoCs
-
Office loads VBA resources, possible macro or embedded object present
-
Modifies Internet Explorer settings 1 TTPs 9 IoCs
-
Modifies registry class 280 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 40 IoCs
-
Suspicious use of SetWindowsHookEx 16 IoCs
-
Suspicious use of WriteProcessMemory 21 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\file.01.21.doc"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\programdata\hello.comc:\programdata\hello.com pagefile get /format:"c:\programdata\hello.xsL"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 c:\programdata\41401.jpg3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe4⤵
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\hello.comMD5
a03cf3838775e0801a0894c8bacd2e56
SHA14368dbd172224ec9461364be1ac9dffc5d9224a8
SHA256132aa270790f56a7524cab968927ed5e1d91b9a26d4badcb24e450e7decc5f81
SHA512b9e2467157139cc288e027d34865034eaf441dd69981a91df18d60e6b6a7cc53f8102230d18e4c6de2f3ad3ab413d755663bfc82d3033e52faf38509a7cdfcdc
-
\??\c:\programdata\41401.jpgMD5
e64137072aa73702889674831b424cbb
SHA1beb3fe4681e84941617ccaeb89169efc7268a0ba
SHA2568f3f6fcef89bdf02fe1108b0452bd701860ef8ca111d09859daba97fc1d3ef9a
SHA51256bdae98e5b186e342112b1ff44e4116c8e40f964f4c0cadd7ad09e2172b70c7019b7450a0a87574626cf4786f2d187592711c57f740d8d8757a9e36dc3d646c
-
\??\c:\programdata\hello.comMD5
a03cf3838775e0801a0894c8bacd2e56
SHA14368dbd172224ec9461364be1ac9dffc5d9224a8
SHA256132aa270790f56a7524cab968927ed5e1d91b9a26d4badcb24e450e7decc5f81
SHA512b9e2467157139cc288e027d34865034eaf441dd69981a91df18d60e6b6a7cc53f8102230d18e4c6de2f3ad3ab413d755663bfc82d3033e52faf38509a7cdfcdc
-
\??\c:\programdata\hello.xsLMD5
886f82da2d65f460b35eb737d2897940
SHA1bd75c902bb9b490cb38667e11ee5979187b82468
SHA25604d407837c3a0a82ecc6d73c8d5685ca48621ee018b698f469bc954506a14f74
SHA512fff94b2555fa49f7b4f03d2bfd1bdb14c24ed2947f0332f6e65046b98406c706224a612dac74bebad14cfe0f1cbe88e3df51b2b5b25fb2f436d53d29357d2ca8
-
\ProgramData\41401.jpgMD5
e64137072aa73702889674831b424cbb
SHA1beb3fe4681e84941617ccaeb89169efc7268a0ba
SHA2568f3f6fcef89bdf02fe1108b0452bd701860ef8ca111d09859daba97fc1d3ef9a
SHA51256bdae98e5b186e342112b1ff44e4116c8e40f964f4c0cadd7ad09e2172b70c7019b7450a0a87574626cf4786f2d187592711c57f740d8d8757a9e36dc3d646c
-
\ProgramData\hello.comMD5
a03cf3838775e0801a0894c8bacd2e56
SHA14368dbd172224ec9461364be1ac9dffc5d9224a8
SHA256132aa270790f56a7524cab968927ed5e1d91b9a26d4badcb24e450e7decc5f81
SHA512b9e2467157139cc288e027d34865034eaf441dd69981a91df18d60e6b6a7cc53f8102230d18e4c6de2f3ad3ab413d755663bfc82d3033e52faf38509a7cdfcdc
-
memory/916-13-0x000007FEF76B0000-0x000007FEF792A000-memory.dmpFilesize
2.5MB
-
memory/1668-19-0x000000006AFF0000-0x000000006B025000-memory.dmpFilesize
212KB
-
memory/1668-16-0x0000000076271000-0x0000000076273000-memory.dmpFilesize
8KB
-
memory/1668-15-0x0000000000000000-mapping.dmp
-
memory/1668-20-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/1668-25-0x00000000009A0000-0x00000000009A1000-memory.dmpFilesize
4KB
-
memory/1692-21-0x0000000000000000-mapping.dmp
-
memory/1692-23-0x000000006A8F1000-0x000000006A8F3000-memory.dmpFilesize
8KB
-
memory/1692-24-0x0000000000080000-0x00000000000B5000-memory.dmpFilesize
212KB
-
memory/1764-9-0x0000000000000000-mapping.dmp
-
memory/1764-10-0x000007FEFBBF1000-0x000007FEFBBF3000-memory.dmpFilesize
8KB
-
memory/1908-8-0x0000000006280000-0x0000000006282000-memory.dmpFilesize
8KB
-
memory/1908-2-0x00000000727A1000-0x00000000727A4000-memory.dmpFilesize
12KB
-
memory/1908-3-0x0000000070221000-0x0000000070223000-memory.dmpFilesize
8KB
-
memory/1908-4-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/2040-12-0x00000000001F0000-0x00000000001F2000-memory.dmpFilesize
8KB
-
memory/2040-6-0x0000000000000000-mapping.dmp
