Analysis

  • max time kernel
    151s
  • max time network
    34s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    02-02-2021 00:18

General

  • Target

    statistics-02.01.2021.doc

  • Size

    75KB

  • MD5

    d96fc74b09a71eee68373613f67da85b

  • SHA1

    affa834fcdc0e67ebf0388b4d90505b9afcd0f96

  • SHA256

    e604d957f6bc4ee372e7a82b7e6efc013d7766fb34cd7fd1ef91725a39214ab3

  • SHA512

    5928d99190f4fe4f7dbd5842bcfbcc820304a13b706a69fc1b5f86059d2bac9762965f67faa400a315dccaa1af2766f5907b28021ec73099707f2a17ea7bef7f

Malware Config

Extracted

Family

qakbot

Botnet

krk01

Campaign

1611569149

C2

31.5.21.66:995

89.3.198.238:443

202.188.138.162:443

188.24.128.253:443

175.141.219.71:443

151.60.15.183:443

184.189.122.72:443

80.227.5.70:443

140.82.49.12:443

89.211.241.100:995

81.97.154.100:443

77.27.174.49:995

92.154.83.96:2078

42.3.8.54:443

71.187.170.235:443

46.153.36.53:995

71.182.142.63:443

105.186.102.16:443

50.244.112.106:443

78.63.226.32:443

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • Blocklisted process makes network request 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 10 IoCs
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of SetWindowsHookEx 16 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\statistics-02.01.2021.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1108
    • C:\Windows\SysWOW64\explorer.exe
      explorer c:\programdata\avYth.hta
      2⤵
      • Process spawned unexpected child process
      PID:1496
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:848
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:1528
      • C:\Windows\SysWOW64\mshta.exe
        "C:\Windows\SysWOW64\mshta.exe" "C:\ProgramData\avYth.hta"
        2⤵
        • Blocklisted process makes network request
        • Modifies Internet Explorer settings
        • Suspicious use of WriteProcessMemory
        PID:788
        • C:\Windows\SysWOW64\regsvr32.exe
          "C:\Windows\System32\regsvr32.exe" c:\programdata\avYth.tmp
          3⤵
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of WriteProcessMemory
          PID:540
          • C:\Windows\SysWOW64\explorer.exe
            C:\Windows\SysWOW64\explorer.exe
            4⤵
              PID:792

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Defense Evasion

      Modify Registry

      1
      T1112

      Discovery

      System Information Discovery

      1
      T1082

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\ProgramData\avYth.hta
        MD5

        a52fa7ed528fae4b53fc8ad923b7f861

        SHA1

        3a7d4104a52bceb9ab110039ab144ffe7faff301

        SHA256

        474446f37a896729676846ae4fdb8225dec3073e38454d2844e8b3d14ff4d9c6

        SHA512

        407d2453df83106c899f018edb4a3819c3ffc6d72b5a382696c7738497cacb2ca4bf31001b02fda86827649d9d45057d93f79f328f605217a814cdf8f1b27efd

      • \??\c:\programdata\avYth.tmp
        MD5

        591029c3d7c0a071eb4ae19b04123b2b

        SHA1

        3bffaeff65bb52989265e9d5c823b9e3dbb253fa

        SHA256

        4bca5c5799463f330312cbf943069ee228a4c55fe7db6b4232820b0d9b91e84e

        SHA512

        7c58d3bb296a8e5fc4e49cbb6c813501a45843db2a63a27c5ded937d95ab6f10a58a1061bb414f4e0663984be8ee572aff5548cd7783d6ffe2829f29f702d33b

      • \ProgramData\avYth.tmp
        MD5

        591029c3d7c0a071eb4ae19b04123b2b

        SHA1

        3bffaeff65bb52989265e9d5c823b9e3dbb253fa

        SHA256

        4bca5c5799463f330312cbf943069ee228a4c55fe7db6b4232820b0d9b91e84e

        SHA512

        7c58d3bb296a8e5fc4e49cbb6c813501a45843db2a63a27c5ded937d95ab6f10a58a1061bb414f4e0663984be8ee572aff5548cd7783d6ffe2829f29f702d33b

      • memory/540-16-0x0000000000000000-mapping.dmp
      • memory/540-26-0x0000000000280000-0x0000000000281000-memory.dmp
        Filesize

        4KB

      • memory/540-21-0x0000000000170000-0x0000000000171000-memory.dmp
        Filesize

        4KB

      • memory/540-20-0x0000000010000000-0x0000000010035000-memory.dmp
        Filesize

        212KB

      • memory/788-11-0x0000000000000000-mapping.dmp
      • memory/792-25-0x0000000000080000-0x00000000000B5000-memory.dmp
        Filesize

        212KB

      • memory/792-24-0x000000006AE91000-0x000000006AE93000-memory.dmp
        Filesize

        8KB

      • memory/792-22-0x0000000000000000-mapping.dmp
      • memory/848-12-0x0000000000000000-mapping.dmp
      • memory/988-15-0x000007FEF7510000-0x000007FEF778A000-memory.dmp
        Filesize

        2.5MB

      • memory/1108-2-0x0000000072551000-0x0000000072554000-memory.dmp
        Filesize

        12KB

      • memory/1108-6-0x00000000063B0000-0x00000000063B2000-memory.dmp
        Filesize

        8KB

      • memory/1108-4-0x000000005FFF0000-0x0000000060000000-memory.dmp
        Filesize

        64KB

      • memory/1108-3-0x000000006FFD1000-0x000000006FFD3000-memory.dmp
        Filesize

        8KB

      • memory/1496-8-0x000000006AF11000-0x000000006AF13000-memory.dmp
        Filesize

        8KB

      • memory/1496-7-0x00000000760D1000-0x00000000760D3000-memory.dmp
        Filesize

        8KB

      • memory/1496-5-0x0000000000000000-mapping.dmp
      • memory/1528-9-0x000007FEFBA51000-0x000007FEFBA53000-memory.dmp
        Filesize

        8KB