Overview

overview

10

Static

static

8

order.02.21.doc

windows7_x64

10

order.02.21.doc

windows10_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    136s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    02-02-2021 00:17

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    order.02.21.doc

  • Size

    96KB

  • MD5

    482575014b2267902cc89dff4c17134e

  • SHA1

    4dfa4463d055046080393b105f659b6f367e9167

  • SHA256

    a8e05882220ef7e0b55eef3048c1e79ea607e1aba5fafb6431b4e94fc75724e6

  • SHA512

    c7163ef3831be2da9f0c53cc12cae504a57dd6885e3def3e02b458abfc190a68a2da5a2d68d7f01f29de1b44038f9b613eb4d39dd1bb1f493302c6227435d6d4

Score
10/10
qakbotkrk011611569149bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Botnet

krk01

Campaign

1611569149

C2

31.5.21.66:995

89.3.198.238:443

202.188.138.162:443

188.24.128.253:443

175.141.219.71:443

151.60.15.183:443

184.189.122.72:443

80.227.5.70:443

140.82.49.12:443

89.211.241.100:995

81.97.154.100:443

77.27.174.49:995

92.154.83.96:2078

42.3.8.54:443

71.187.170.235:443

46.153.36.53:995

71.182.142.63:443

105.186.102.16:443

50.244.112.106:443

78.63.226.32:443

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

    trojanbankerstealerqakbot
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 42 IoCs
  • Suspicious use of SetWindowsHookEx 18 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\order.02.21.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:644
    • \??\c:\programdata\xml.com
      c:\programdata\xml.com process list /format : ".xsl"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2640
      • C:\Windows\SYSTEM32\regsvr32.exe
        regsvr32 c:\programdata\27867.jpg
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2324
        • C:\Windows\SysWOW64\regsvr32.exe
          c:\programdata\27867.jpg
          4⤵
          • Loads dropped DLL
          • Checks SCSI registry key(s)
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of WriteProcessMemory
          PID:3904
          • C:\Windows\SysWOW64\explorer.exe
            C:\Windows\SysWOW64\explorer.exe
            5⤵
              PID:3920

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Credential Access

    Discovery

    Query Registry

    3
    T1012

    Peripheral Device Discovery

    1
    T1120

    System Information Discovery

    3
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\xml.com
      MD5

      4191f61f2449ccc2bc2f2ac6d8898ce7

      SHA1

      d49936fc8a03561214ce4bf9791ca59e94ab8fe9

      SHA256

      74d21e1349aab027cd02d15f2428028c028592f265d1830c8dfc407f9bf76173

      SHA512

      fe67059bc374cc2d39dd01c22c2183ca44a8e04050d633f78d4eac415ae4528c378c7504ea3cc4b6923675256ae3af199b3a498243a4ca1a4d0f61f2e086821f

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\.xsl
      MD5

      056f1894ed79ab92abb9a1e48f496f92

      SHA1

      672641775009e1573ef40f174169f8ec5742857a

      SHA256

      f677baa2df98c7f9d7339fa8249d8761f4d4451c9cefb5ffad1748e38dead68f

      SHA512

      02debf58536d9810a74b4579b21a956eb86c1e0ae2b23b7c03abac46107cea2a053c21e54680ffb43f10ebd81d921489c9f8d95ee7dd034bc8d48f77ecff9399

      Download Submit
    • \??\c:\programdata\27867.jpg
      MD5

      dd587969560f16f45a7f066182285ee7

      SHA1

      683a279c992d117a23b620d3110447d712d54e4c

      SHA256

      51947a6436c0334a22572c20df3b097bb8dd8f6b6822f2d03619f3e5190db68c

      SHA512

      015c56ac4b69880fc0dbd8b77a59770a84ee0dc6c11c1f538cc39000e7c4066e24a56f5138f2a43461a8a62697f955527289d11db4da4a8f2fcd1ff76bb81c3f

      Download Submit
    • \??\c:\programdata\xml.com
      MD5

      4191f61f2449ccc2bc2f2ac6d8898ce7

      SHA1

      d49936fc8a03561214ce4bf9791ca59e94ab8fe9

      SHA256

      74d21e1349aab027cd02d15f2428028c028592f265d1830c8dfc407f9bf76173

      SHA512

      fe67059bc374cc2d39dd01c22c2183ca44a8e04050d633f78d4eac415ae4528c378c7504ea3cc4b6923675256ae3af199b3a498243a4ca1a4d0f61f2e086821f

      Download Submit
    • \ProgramData\27867.jpg
      MD5

      dd587969560f16f45a7f066182285ee7

      SHA1

      683a279c992d117a23b620d3110447d712d54e4c

      SHA256

      51947a6436c0334a22572c20df3b097bb8dd8f6b6822f2d03619f3e5190db68c

      SHA512

      015c56ac4b69880fc0dbd8b77a59770a84ee0dc6c11c1f538cc39000e7c4066e24a56f5138f2a43461a8a62697f955527289d11db4da4a8f2fcd1ff76bb81c3f

      Download Submit
    • memory/644-6-0x00007FFC10600000-0x00007FFC10610000-memory.dmp
      Filesize

      64KB

      Download
    • memory/644-7-0x00007FFC0D150000-0x00007FFC0D160000-memory.dmp
      Filesize

      64KB

      Download
    • memory/644-8-0x0000029230160000-0x0000029230164000-memory.dmp
      Filesize

      16KB

      Download
    • memory/644-5-0x0000029220900000-0x0000029220F37000-memory.dmp
      Filesize

      6.2MB

      Download
    • memory/644-4-0x00007FFC10600000-0x00007FFC10610000-memory.dmp
      Filesize

      64KB

      Download
    • memory/644-3-0x00007FFC10600000-0x00007FFC10610000-memory.dmp
      Filesize

      64KB

      Download
    • memory/644-2-0x00007FFC10600000-0x00007FFC10610000-memory.dmp
      Filesize

      64KB

      Download
    • memory/2324-13-0x0000000000000000-mapping.dmp
      Download
    • memory/2640-9-0x0000000000000000-mapping.dmp
      Download
    • memory/3904-15-0x0000000000000000-mapping.dmp
      Download
    • memory/3904-17-0x0000000010000000-0x0000000010035000-memory.dmp
      Filesize

      212KB

      Download
    • memory/3904-18-0x0000000004630000-0x0000000004631000-memory.dmp
      Filesize

      4KB

      Download
    • memory/3920-19-0x0000000000000000-mapping.dmp
      Download
    • memory/3920-20-0x0000000002790000-0x00000000027C5000-memory.dmp
      Filesize

      212KB

      Download