Analysis

  • max time kernel
    152s
  • max time network
    26s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    02-02-2021 00:18

General

  • Target

    specifics_02.01.2021.doc

  • Size

    75KB

  • MD5

    68ced19043e3f6f97fb8b4624f02a8e9

  • SHA1

    e2975e9f468ce3158c9f7f90decc680a70ae7234

  • SHA256

    0c9bf697ea913a97283d559bdd59fe83fef51a5038797dbfc9a8a7835f2968d6

  • SHA512

    82dd4fecc9e3245b7c8b7f2db6ee43bbbeccc0eb10b1a108d313bedc4750482de02f3a6bd15f8512b738e2ef02c0a353c8d60c08a1574b53ee350d2d0fae67c9

Malware Config

Extracted

Family

qakbot

Botnet

krk01

Campaign

1611569149

C2

31.5.21.66:995

89.3.198.238:443

202.188.138.162:443

188.24.128.253:443

175.141.219.71:443

151.60.15.183:443

184.189.122.72:443

80.227.5.70:443

140.82.49.12:443

89.211.241.100:995

81.97.154.100:443

77.27.174.49:995

92.154.83.96:2078

42.3.8.54:443

71.187.170.235:443

46.153.36.53:995

71.182.142.63:443

105.186.102.16:443

50.244.112.106:443

78.63.226.32:443

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • Blocklisted process makes network request 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 10 IoCs
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of SetWindowsHookEx 16 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\specifics_02.01.2021.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1852
    • C:\Windows\SysWOW64\explorer.exe
      explorer c:\programdata\aSziC.hta
      2⤵
      • Process spawned unexpected child process
      PID:2012
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1724
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:884
      • C:\Windows\SysWOW64\mshta.exe
        "C:\Windows\SysWOW64\mshta.exe" "C:\ProgramData\aSziC.hta"
        2⤵
        • Blocklisted process makes network request
        • Modifies Internet Explorer settings
        • Suspicious use of WriteProcessMemory
        PID:1288
        • C:\Windows\SysWOW64\regsvr32.exe
          "C:\Windows\System32\regsvr32.exe" c:\programdata\aSziC.tmp
          3⤵
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of WriteProcessMemory
          PID:520
          • C:\Windows\SysWOW64\explorer.exe
            C:\Windows\SysWOW64\explorer.exe
            4⤵
              PID:896

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Defense Evasion

      Modify Registry

      1
      T1112

      Discovery

      System Information Discovery

      1
      T1082

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\ProgramData\aSziC.hta
        MD5

        93de516d42854befc910a63c508aa44f

        SHA1

        96b5bc26f3df6d0e611b8e20641840d3a4fd9b15

        SHA256

        42e11567c6b657683163aac63975452398126236839860979c0abaabbd8b5a10

        SHA512

        df63fda9f6153fa71746c4670bc6469a14a4d649933fa517639da79381385436a305a7d24d78216903a6d81cde18d196b96f984a8aee8ad2f5e64ac73cf8c1d0

      • \??\c:\programdata\aSziC.tmp
        MD5

        b880bcf1f95ddb52f4a7b01380c6a25f

        SHA1

        4f4e61137795a9a5d4a07634b308e6a1e4cbf283

        SHA256

        8b7645e2e852fd129157aa3396d2a3fbc356f059c80b96c3205b01a4100f5687

        SHA512

        da986925ecce25811c796304aba953363566c7bcfdbc5d365cb3da18917fa9dfa1a3ea1771023ba8a0df2698b4ed3e75009263133f0c6b8f9eeee2bf08269798

      • \ProgramData\aSziC.tmp
        MD5

        b880bcf1f95ddb52f4a7b01380c6a25f

        SHA1

        4f4e61137795a9a5d4a07634b308e6a1e4cbf283

        SHA256

        8b7645e2e852fd129157aa3396d2a3fbc356f059c80b96c3205b01a4100f5687

        SHA512

        da986925ecce25811c796304aba953363566c7bcfdbc5d365cb3da18917fa9dfa1a3ea1771023ba8a0df2698b4ed3e75009263133f0c6b8f9eeee2bf08269798

      • memory/520-26-0x00000000001E0000-0x00000000001E1000-memory.dmp
        Filesize

        4KB

      • memory/520-16-0x0000000000000000-mapping.dmp
      • memory/520-21-0x00000000000E0000-0x00000000000E1000-memory.dmp
        Filesize

        4KB

      • memory/520-20-0x0000000010000000-0x0000000010035000-memory.dmp
        Filesize

        212KB

      • memory/884-9-0x000007FEFC1D1000-0x000007FEFC1D3000-memory.dmp
        Filesize

        8KB

      • memory/896-24-0x000000006B171000-0x000000006B173000-memory.dmp
        Filesize

        8KB

      • memory/896-22-0x0000000000000000-mapping.dmp
      • memory/896-25-0x00000000000F0000-0x0000000000125000-memory.dmp
        Filesize

        212KB

      • memory/1288-11-0x0000000000000000-mapping.dmp
      • memory/1616-15-0x000007FEF6850000-0x000007FEF6ACA000-memory.dmp
        Filesize

        2.5MB

      • memory/1724-12-0x0000000000000000-mapping.dmp
      • memory/1852-2-0x0000000072CD1000-0x0000000072CD4000-memory.dmp
        Filesize

        12KB

      • memory/1852-5-0x0000000006040000-0x0000000006042000-memory.dmp
        Filesize

        8KB

      • memory/1852-4-0x000000005FFF0000-0x0000000060000000-memory.dmp
        Filesize

        64KB

      • memory/1852-3-0x0000000070751000-0x0000000070753000-memory.dmp
        Filesize

        8KB

      • memory/2012-8-0x000000006B6A1000-0x000000006B6A3000-memory.dmp
        Filesize

        8KB

      • memory/2012-7-0x00000000760F1000-0x00000000760F3000-memory.dmp
        Filesize

        8KB

      • memory/2012-6-0x0000000000000000-mapping.dmp