Analysis
-
max time kernel
151s -
max time network
16s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
02-02-2021 00:15
General
-
Target
deed contract-02.01.2021.doc
-
Size
75KB
-
MD5
05eaf3d398f1a3266d4c2dfce98701f7
-
SHA1
8f00ebdacde833f7521252c8870c9e6ecefedee7
-
SHA256
eb757faa0f6c3f2850e9b41180ed7074d2c16e06e90903e9d42ed84a9f4a2936
-
SHA512
1909dae408b01637cb59988aa8dccdbc559fd2d7cb1bcdc118259b990da049a8e145045f247fb2e49f0dc4a6cfb3f247817d8de5e24d7a9e096c21c1bd7b7e77
Malware Config
Extracted
qakbot
krk01
1611569149
31.5.21.66:995
89.3.198.238:443
202.188.138.162:443
188.24.128.253:443
175.141.219.71:443
151.60.15.183:443
184.189.122.72:443
80.227.5.70:443
140.82.49.12:443
89.211.241.100:995
81.97.154.100:443
77.27.174.49:995
92.154.83.96:2078
42.3.8.54:443
71.187.170.235:443
46.153.36.53:995
71.182.142.63:443
105.186.102.16:443
50.244.112.106:443
78.63.226.32:443
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
-
Blocklisted process makes network request 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Drops file in Windows directory 1 IoCs
-
Office loads VBA resources, possible macro or embedded object present
-
Modifies Internet Explorer settings 1 TTPs 10 IoCs
-
Modifies registry class 280 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of SetWindowsHookEx 16 IoCs
-
Suspicious use of WriteProcessMemory 25 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\deed contract-02.01.2021.doc"1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeexplorer c:\programdata\aGdS0r.hta2⤵
- Process spawned unexpected child process
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\ProgramData\aGdS0r.hta"2⤵
- Blocklisted process makes network request
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" c:\programdata\aGdS0r.tmp3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\aGdS0r.htaMD5
138ed2bf6195afdbcbd1ff418204d7b7
SHA14c956fef23903d5ff2bd162e5aa9dcb1c9778565
SHA2568b520adfbeb1349c7a4a32e3389b80d5678887e79821b6f8300953a5015ddee3
SHA512a2e6b21af2e8a1b91ae03bd1d2f4716d78c40dbaacce06185bad277b652041ca78918d3498869b5e16de32317598c85b62f06b7ee25327cf045ed5aa6ff670e1
-
\??\c:\programdata\aGdS0r.tmpMD5
769584aae5d42c2114859695579cd01f
SHA1a2db2628bb08d028b1e27109fd3fc264c379ea17
SHA2569e9dfd20659f10687d7324c87fd5ea8435df6c12c8532ab8e700e19aa4448e5b
SHA512d069a7c1c6294c6911fde4e2a8d46daae0a6b8360ecc5f174d5b16812e99dd4f22801bc37a8823d6ee8f2cfdc18417a4e02b8f00a3497e8466a5d70e76923b78
-
\ProgramData\aGdS0r.tmpMD5
769584aae5d42c2114859695579cd01f
SHA1a2db2628bb08d028b1e27109fd3fc264c379ea17
SHA2569e9dfd20659f10687d7324c87fd5ea8435df6c12c8532ab8e700e19aa4448e5b
SHA512d069a7c1c6294c6911fde4e2a8d46daae0a6b8360ecc5f174d5b16812e99dd4f22801bc37a8823d6ee8f2cfdc18417a4e02b8f00a3497e8466a5d70e76923b78
-
memory/1080-14-0x000007FEF5D50000-0x000007FEF5FCA000-memory.dmpFilesize
2.5MB
-
memory/1332-24-0x00000000000C0000-0x00000000000F5000-memory.dmpFilesize
212KB
-
memory/1332-23-0x000000006A9B1000-0x000000006A9B3000-memory.dmpFilesize
8KB
-
memory/1332-21-0x0000000000000000-mapping.dmp
-
memory/1428-5-0x0000000000000000-mapping.dmp
-
memory/1428-6-0x0000000075DE1000-0x0000000075DE3000-memory.dmpFilesize
8KB
-
memory/1428-7-0x000000006AA81000-0x000000006AA83000-memory.dmpFilesize
8KB
-
memory/1608-12-0x0000000000000000-mapping.dmp
-
memory/1648-11-0x0000000000000000-mapping.dmp
-
memory/1784-8-0x000007FEFB6D1000-0x000007FEFB6D3000-memory.dmpFilesize
8KB
-
memory/1832-2-0x00000000721D1000-0x00000000721D4000-memory.dmpFilesize
12KB
-
memory/1832-9-0x0000000006160000-0x0000000006162000-memory.dmpFilesize
8KB
-
memory/1832-4-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1832-3-0x000000006FC51000-0x000000006FC53000-memory.dmpFilesize
8KB
-
memory/1964-15-0x0000000000000000-mapping.dmp
-
memory/1964-19-0x0000000010000000-0x0000000010035000-memory.dmpFilesize
212KB
-
memory/1964-20-0x0000000000190000-0x0000000000191000-memory.dmpFilesize
4KB
-
memory/1964-25-0x0000000000370000-0x0000000000371000-memory.dmpFilesize
4KB