Analysis

  • max time kernel
    152s
  • max time network
    60s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    02-02-2021 00:16

General

  • Target

    files 02.21.doc

  • Size

    75KB

  • MD5

    f0a301d7833a7264f7659f9f9bd79727

  • SHA1

    31f6b9bf54a31a52ab0a9e4d2d67c4b1f660f9ea

  • SHA256

    8b554ed79aef862f7073f93b6f67a8dea8368098c1d951365317de3803acae66

  • SHA512

    f188cf7420b8ff5d21503888f6dab69223e0aa061564fa3d30d9195c37c6f5e79a97a7d29abbba03c641afe2b624b60d3acea7c63ea98a4571a476d58b035d50

Malware Config

Extracted

Family

qakbot

Botnet

krk01

Campaign

1611569149

C2

31.5.21.66:995

89.3.198.238:443

202.188.138.162:443

188.24.128.253:443

175.141.219.71:443

151.60.15.183:443

184.189.122.72:443

80.227.5.70:443

140.82.49.12:443

89.211.241.100:995

81.97.154.100:443

77.27.174.49:995

92.154.83.96:2078

42.3.8.54:443

71.187.170.235:443

46.153.36.53:995

71.182.142.63:443

105.186.102.16:443

50.244.112.106:443

78.63.226.32:443

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • Blocklisted process makes network request 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 10 IoCs
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of SetWindowsHookEx 16 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\files 02.21.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1188
    • C:\Windows\SysWOW64\explorer.exe
      explorer c:\programdata\a2t7KN.hta
      2⤵
      • Process spawned unexpected child process
      PID:2012
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1624
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:1748
      • C:\Windows\SysWOW64\mshta.exe
        "C:\Windows\SysWOW64\mshta.exe" "C:\ProgramData\a2t7KN.hta"
        2⤵
        • Blocklisted process makes network request
        • Modifies Internet Explorer settings
        • Suspicious use of WriteProcessMemory
        PID:1384
        • C:\Windows\SysWOW64\regsvr32.exe
          "C:\Windows\System32\regsvr32.exe" c:\programdata\a2t7KN.tmp
          3⤵
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of WriteProcessMemory
          PID:1976
          • C:\Windows\SysWOW64\explorer.exe
            C:\Windows\SysWOW64\explorer.exe
            4⤵
              PID:1028

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Defense Evasion

      Modify Registry

      1
      T1112

      Discovery

      System Information Discovery

      1
      T1082

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\ProgramData\a2t7KN.hta
        MD5

        39b30d4f9a8695a9d53449aceb962def

        SHA1

        fcfb39e6615f39da3075615b50134e02720d111d

        SHA256

        50f69e4043a22e346e21b11be9f92ab3697b7aea671110c196408995ae157717

        SHA512

        ea358319d9725039806148decd995481e92eb9ea99363bcbf6158d4e38359c7c9c5e983dcca19a122fa66061ae8cb67fb556ec1a35e275c546cb88fb911f1b34

      • \??\c:\programdata\a2t7KN.tmp
        MD5

        11804c56c3223c04fc1cd51f4ac1e128

        SHA1

        de7a6b165f79c27b36539ac7c3e980a3b8c691e8

        SHA256

        28e2cdc51b553cd2cc1ba3028fe5ce588504a76c3a8c83d784e5318a83be22d1

        SHA512

        52485cb2f2a1b494e1d8a6eebbd1f2b81f519ab7d18456f51c5882fa27820edca0ce8b3a1bdd6428e0bb0c6da827d5c7db5198d977654f78396d6f7c441f74b6

      • \ProgramData\a2t7KN.tmp
        MD5

        11804c56c3223c04fc1cd51f4ac1e128

        SHA1

        de7a6b165f79c27b36539ac7c3e980a3b8c691e8

        SHA256

        28e2cdc51b553cd2cc1ba3028fe5ce588504a76c3a8c83d784e5318a83be22d1

        SHA512

        52485cb2f2a1b494e1d8a6eebbd1f2b81f519ab7d18456f51c5882fa27820edca0ce8b3a1bdd6428e0bb0c6da827d5c7db5198d977654f78396d6f7c441f74b6

      • memory/1028-24-0x0000000000080000-0x00000000000B5000-memory.dmp
        Filesize

        212KB

      • memory/1028-23-0x000000006B671000-0x000000006B673000-memory.dmp
        Filesize

        8KB

      • memory/1028-21-0x0000000000000000-mapping.dmp
      • memory/1188-2-0x00000000730B1000-0x00000000730B4000-memory.dmp
        Filesize

        12KB

      • memory/1188-3-0x0000000070B31000-0x0000000070B33000-memory.dmp
        Filesize

        8KB

      • memory/1188-4-0x000000005FFF0000-0x0000000060000000-memory.dmp
        Filesize

        64KB

      • memory/1188-9-0x0000000005F90000-0x0000000005F92000-memory.dmp
        Filesize

        8KB

      • memory/1384-11-0x0000000000000000-mapping.dmp
      • memory/1508-14-0x000007FEF7E30000-0x000007FEF80AA000-memory.dmp
        Filesize

        2.5MB

      • memory/1624-12-0x0000000000000000-mapping.dmp
      • memory/1748-8-0x000007FEFC4D1000-0x000007FEFC4D3000-memory.dmp
        Filesize

        8KB

      • memory/1976-19-0x0000000010000000-0x0000000010035000-memory.dmp
        Filesize

        212KB

      • memory/1976-15-0x0000000000000000-mapping.dmp
      • memory/1976-20-0x0000000000190000-0x0000000000191000-memory.dmp
        Filesize

        4KB

      • memory/1976-25-0x00000000001E0000-0x00000000001E1000-memory.dmp
        Filesize

        4KB

      • memory/2012-7-0x000000006B9D1000-0x000000006B9D3000-memory.dmp
        Filesize

        8KB

      • memory/2012-6-0x00000000759F1000-0x00000000759F3000-memory.dmp
        Filesize

        8KB

      • memory/2012-5-0x0000000000000000-mapping.dmp