Analysis
-
max time kernel
74s -
max time network
117s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
04-02-2021 17:49
General
-
Target
information (93).xls
-
Size
320KB
-
MD5
3cc237fd87987968d9830a125b9f8ded
-
SHA1
3c57c67646bfcf338b04192d7043357ddb4d72b1
-
SHA256
2f50dc749600c23ef5faa7c5a4598047575cc6d3bd379afa49ba7b1272be8561
-
SHA512
32747880798621c71cb146047ceb971623bbc13267aae38a158c7548b80c9ec61cdeadbc3c9ddfbfd888011f2b973b2bbec45037251bfd67c0f4a8b7c3e866a2
Malware Config
Extracted
qakbot
tr
1612175155
89.3.198.238:443
172.78.30.215:443
85.52.72.32:2222
76.110.113.71:995
106.51.52.111:443
75.67.192.125:443
172.115.177.204:2222
197.45.110.165:995
82.76.47.211:443
45.77.115.208:443
45.32.211.207:443
144.202.38.185:443
207.246.116.237:995
149.28.101.90:995
149.28.101.90:8443
207.246.116.237:8443
144.202.38.185:2222
45.32.211.207:8443
149.28.101.90:443
149.28.101.90:2222
207.246.116.237:443
207.246.77.75:995
149.28.98.196:2222
149.28.99.97:443
149.28.99.97:995
149.28.99.97:2222
45.63.107.192:2222
45.63.107.192:443
144.202.38.185:995
45.32.211.207:2222
207.246.116.237:2222
207.246.77.75:2222
207.246.77.75:443
45.77.115.208:2222
207.246.77.75:8443
149.28.98.196:995
149.28.98.196:443
45.63.107.192:995
45.32.211.207:995
184.189.122.72:443
80.227.5.69:443
175.141.219.71:443
202.188.138.162:443
77.27.174.49:995
92.59.35.196:2222
81.97.154.100:443
45.77.115.208:995
45.77.115.208:8443
85.58.200.50:2222
86.97.8.63:443
50.240.77.238:22
203.198.96.37:443
24.50.118.93:443
190.85.91.154:443
176.181.247.197:443
41.205.16.1:443
78.63.226.32:443
184.179.14.130:22
193.248.221.184:2222
82.12.157.95:995
172.87.157.235:3389
51.9.198.164:2222
151.242.62.59:32103
70.126.76.75:443
160.3.187.114:443
69.58.147.82:2078
64.121.114.87:443
50.244.112.106:443
76.25.142.196:443
188.25.63.105:443
2.50.2.216:443
80.11.173.82:8443
83.110.103.152:443
140.82.49.12:443
84.72.35.226:443
71.88.193.17:443
74.77.162.33:443
68.186.192.69:443
46.153.119.255:995
213.60.147.140:443
216.201.162.158:443
81.88.254.62:443
196.151.252.84:443
105.186.102.16:443
71.187.170.235:443
68.225.60.77:995
95.77.223.148:443
105.198.236.101:443
81.214.126.173:2222
83.110.108.181:2222
202.184.20.119:443
83.110.12.140:2222
75.136.40.155:443
79.129.121.81:995
37.211.90.175:995
80.11.5.65:2222
85.132.36.111:2222
90.101.117.122:2222
105.96.8.96:443
86.236.77.68:2222
151.33.227.106:443
197.161.154.132:443
115.133.243.6:443
86.98.93.124:2078
156.223.24.221:443
50.29.166.232:995
2.232.253.79:995
2.7.69.217:2222
106.250.150.98:443
47.22.148.6:443
68.131.107.37:443
173.21.10.71:2222
31.5.21.66:995
78.182.229.147:443
69.123.179.70:443
75.118.1.141:443
144.139.47.206:443
45.46.53.140:2222
70.54.25.76:2222
75.136.26.147:443
144.139.166.18:443
67.6.12.4:443
76.111.128.194:443
98.240.24.57:443
216.150.207.100:2222
71.74.12.34:443
71.197.126.250:443
98.121.187.78:443
47.196.192.184:443
74.222.204.82:995
74.68.144.202:443
67.165.206.193:993
71.182.142.63:443
109.12.111.14:443
68.129.194.130:443
31.57.48.136:443
94.53.92.42:443
65.27.228.247:443
71.14.110.199:443
84.247.55.190:8443
67.8.103.21:443
105.198.236.99:443
78.97.207.104:443
27.223.92.142:995
24.152.219.253:995
161.199.180.159:443
77.211.30.202:995
199.19.117.131:443
86.220.60.133:2222
96.37.113.36:993
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
rundll32.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 64 744 rundll32.exe EXCEL.EXE -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 8 rundll32.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 rundll32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc rundll32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 rundll32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc rundll32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service rundll32.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 744 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
rundll32.exepid process 8 rundll32.exe 8 rundll32.exe 8 rundll32.exe 8 rundll32.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
rundll32.exepid process 8 rundll32.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
EXCEL.EXEpid process 744 EXCEL.EXE 744 EXCEL.EXE 744 EXCEL.EXE 744 EXCEL.EXE 744 EXCEL.EXE 744 EXCEL.EXE 744 EXCEL.EXE 744 EXCEL.EXE 744 EXCEL.EXE 744 EXCEL.EXE 744 EXCEL.EXE 744 EXCEL.EXE -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
EXCEL.EXErundll32.exerundll32.exeexplorer.exedescription pid process target process PID 744 wrote to memory of 64 744 EXCEL.EXE rundll32.exe PID 744 wrote to memory of 64 744 EXCEL.EXE rundll32.exe PID 64 wrote to memory of 8 64 rundll32.exe rundll32.exe PID 64 wrote to memory of 8 64 rundll32.exe rundll32.exe PID 64 wrote to memory of 8 64 rundll32.exe rundll32.exe PID 8 wrote to memory of 3816 8 rundll32.exe explorer.exe PID 8 wrote to memory of 3816 8 rundll32.exe explorer.exe PID 8 wrote to memory of 3816 8 rundll32.exe explorer.exe PID 8 wrote to memory of 3816 8 rundll32.exe explorer.exe PID 8 wrote to memory of 3816 8 rundll32.exe explorer.exe PID 3816 wrote to memory of 2536 3816 explorer.exe schtasks.exe PID 3816 wrote to memory of 2536 3816 explorer.exe schtasks.exe PID 3816 wrote to memory of 2536 3816 explorer.exe schtasks.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\information (93).xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\rundll32.exerundll32 C:\sdios\dswgc\dqlqv.doq,DllRegisterServer2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32 C:\sdios\dswgc\dqlqv.doq,DllRegisterServer3⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn etaxgpukt /tr "regsvr32.exe -s \"\"" /SC ONCE /Z /ST 17:54 /ET 18:065⤵
- Creates scheduled task(s)
-
\??\c:\windows\system32\regsvr32.exeregsvr32.exe -s ""1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\sdios\dswgc\dqlqv.doqMD5
873e74b88e18c15365f236ac1f98e2e0
SHA1aa43ad94aeb7800931206e733494148abfe39d3f
SHA2567c16cd83d2c94fd23635df1e30d20f88a9a0359870a7d8e7cae03269f980f023
SHA5120bd59ab2bd699f7120ca32faacd72119f956ccb31f65b36a564b64d3503f1f983c5b1c08e8f6dc09e203e2b14e53685cb28b053b374b0b90019b3d4e396fc120
-
\sdios\dswgc\dqlqv.doqMD5
873e74b88e18c15365f236ac1f98e2e0
SHA1aa43ad94aeb7800931206e733494148abfe39d3f
SHA2567c16cd83d2c94fd23635df1e30d20f88a9a0359870a7d8e7cae03269f980f023
SHA5120bd59ab2bd699f7120ca32faacd72119f956ccb31f65b36a564b64d3503f1f983c5b1c08e8f6dc09e203e2b14e53685cb28b053b374b0b90019b3d4e396fc120
-
memory/8-13-0x0000000005E00000-0x0000000005E35000-memory.dmpFilesize
212KB
-
memory/8-12-0x0000000005D70000-0x0000000005DB7000-memory.dmpFilesize
284KB
-
memory/8-11-0x0000000004400000-0x0000000004401000-memory.dmpFilesize
4KB
-
memory/8-9-0x0000000000000000-mapping.dmp
-
memory/64-7-0x0000000000000000-mapping.dmp
-
memory/744-18-0x00007FFF49320000-0x00007FFF49330000-memory.dmpFilesize
64KB
-
memory/744-6-0x00007FFF49320000-0x00007FFF49330000-memory.dmpFilesize
64KB
-
memory/744-5-0x00007FFF6D370000-0x00007FFF6D9A7000-memory.dmpFilesize
6.2MB
-
memory/744-4-0x00007FFF49320000-0x00007FFF49330000-memory.dmpFilesize
64KB
-
memory/744-3-0x00007FFF49320000-0x00007FFF49330000-memory.dmpFilesize
64KB
-
memory/744-2-0x00007FFF49320000-0x00007FFF49330000-memory.dmpFilesize
64KB
-
memory/744-19-0x00007FFF49320000-0x00007FFF49330000-memory.dmpFilesize
64KB
-
memory/744-20-0x00007FFF49320000-0x00007FFF49330000-memory.dmpFilesize
64KB
-
memory/744-21-0x00007FFF49320000-0x00007FFF49330000-memory.dmpFilesize
64KB
-
memory/2536-15-0x0000000000000000-mapping.dmp
-
memory/3816-14-0x0000000000000000-mapping.dmp
-
memory/3816-16-0x0000000000840000-0x0000000000875000-memory.dmpFilesize
212KB
-
memory/3816-17-0x0000000000840000-0x0000000000875000-memory.dmpFilesize
212KB