Analysis
-
max time kernel
151s -
max time network
19s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
29-01-2021 16:07
General
-
Target
decree 01.21_9.doc
-
Size
79KB
-
MD5
abc0d29ef28b541636da5ed712551f47
-
SHA1
a13e4da3eb973af3afb00b46dc236353c808376b
-
SHA256
ba88ae16f19ddf0576a036516ca9385feae8b79e4f8f4b48e537d43ad046d6cf
-
SHA512
c348db71255d1d89aad470c829c8a98ab50edde3fa8a908d31c2f79e741c6cc9584b76cb8c0243810e0755c7c4e25c885f6b6a089e0e0ef31028a172212af304
Malware Config
Extracted
qakbot
krk01
1611569149
31.5.21.66:995
89.3.198.238:443
202.188.138.162:443
188.24.128.253:443
175.141.219.71:443
151.60.15.183:443
184.189.122.72:443
80.227.5.70:443
140.82.49.12:443
89.211.241.100:995
81.97.154.100:443
77.27.174.49:995
92.154.83.96:2078
42.3.8.54:443
71.187.170.235:443
46.153.36.53:995
71.182.142.63:443
105.186.102.16:443
50.244.112.106:443
78.63.226.32:443
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
-
Blocklisted process makes network request 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Drops file in Windows directory 1 IoCs
-
Office loads VBA resources, possible macro or embedded object present
-
Modifies Internet Explorer settings 1 TTPs 10 IoCs
-
Modifies registry class 280 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of SetWindowsHookEx 16 IoCs
-
Suspicious use of WriteProcessMemory 25 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\decree 01.21_9.doc"1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeexplorer c:\programdata\aYDE3y.hta2⤵
- Process spawned unexpected child process
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\ProgramData\aYDE3y.hta"2⤵
- Blocklisted process makes network request
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" c:\programdata\aYDE3y.tmp3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\aYDE3y.htaMD5
4187a962a539674a8a39a5885a2d72e6
SHA151cc8038767d9ccc2296a33bf5548d36420992df
SHA256c7b67501234f165839e40c99bb053873a9ece9e6e83706b6e39ca8fd5d124e36
SHA512e9baae1e1082de04e8c6f05ec314a241bbd0f5259978d36f94683f8cc0a2d1a2c1e560ce722124c5586166ca5cea4b7570b163220b519957e829dee7b50c0005
-
\??\c:\programdata\aYDE3y.tmpMD5
25184c8b113923fe03fd233744c04a35
SHA1cd6946df3b014b93b28077c778310675dd449784
SHA256f4d5e26c2e949af8c0b4fdf216fea607c1fc7b14665e7590e120b139388c9ef0
SHA512e1988cc0b642ceac1f728064c30e1230d92f42b33c37fef8617d55480140e5ab8a09900f09f685ae7341df4726207f495ae7575de6f3be45bf9d05ebd026a0b0
-
\ProgramData\aYDE3y.tmpMD5
25184c8b113923fe03fd233744c04a35
SHA1cd6946df3b014b93b28077c778310675dd449784
SHA256f4d5e26c2e949af8c0b4fdf216fea607c1fc7b14665e7590e120b139388c9ef0
SHA512e1988cc0b642ceac1f728064c30e1230d92f42b33c37fef8617d55480140e5ab8a09900f09f685ae7341df4726207f495ae7575de6f3be45bf9d05ebd026a0b0
-
memory/588-25-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/588-20-0x0000000000140000-0x0000000000141000-memory.dmpFilesize
4KB
-
memory/588-19-0x0000000010000000-0x0000000010035000-memory.dmpFilesize
212KB
-
memory/588-15-0x0000000000000000-mapping.dmp
-
memory/768-9-0x000007FEFB6F1000-0x000007FEFB6F3000-memory.dmpFilesize
8KB
-
memory/980-11-0x0000000000000000-mapping.dmp
-
memory/1388-12-0x0000000000000000-mapping.dmp
-
memory/1440-21-0x0000000000000000-mapping.dmp
-
memory/1440-23-0x000000006A8F1000-0x000000006A8F3000-memory.dmpFilesize
8KB
-
memory/1440-24-0x0000000000080000-0x00000000000B5000-memory.dmpFilesize
212KB
-
memory/1520-14-0x000007FEF5D40000-0x000007FEF5FBA000-memory.dmpFilesize
2.5MB
-
memory/1648-2-0x0000000072301000-0x0000000072304000-memory.dmpFilesize
12KB
-
memory/1648-8-0x00000000061E0000-0x00000000061E2000-memory.dmpFilesize
8KB
-
memory/1648-4-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1648-3-0x000000006FD81000-0x000000006FD83000-memory.dmpFilesize
8KB
-
memory/2024-7-0x000000006AC41000-0x000000006AC43000-memory.dmpFilesize
8KB
-
memory/2024-6-0x0000000074B31000-0x0000000074B33000-memory.dmpFilesize
8KB
-
memory/2024-5-0x0000000000000000-mapping.dmp