Overview

overview

10

Static

static

8

commerce _02.21.doc

windows7_x64

10

commerce _02.21.doc

windows10_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    133s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    08-02-2021 15:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    commerce _02.21.doc

  • Size

    95KB

  • MD5

    722794fe9f968337d7e5169e8e27fccf

  • SHA1

    dfa1c56a856f306887ffb98a827bb284a810f81b

  • SHA256

    208db84f6584f0feea7ad5098a17862e1ad87eac413e1c8a9e402f773b1fd615

  • SHA512

    03a3f20759cdcdeda185e07d5cdc9ca8549ecc24214752c12c70b25eb63cbfbb4a328cc25f2bdbb4d38deb022afc5d41c7dfa706238617b51c78b27e8f2e4e3a

Score
10/10
qakbotkrk011611569149bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Botnet

krk01

Campaign

1611569149

C2

31.5.21.66:995

89.3.198.238:443

202.188.138.162:443

188.24.128.253:443

175.141.219.71:443

151.60.15.183:443

184.189.122.72:443

80.227.5.70:443

140.82.49.12:443

89.211.241.100:995

81.97.154.100:443

77.27.174.49:995

92.154.83.96:2078

42.3.8.54:443

71.187.170.235:443

46.153.36.53:995

71.182.142.63:443

105.186.102.16:443

50.244.112.106:443

78.63.226.32:443

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

    trojanbankerstealerqakbot
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 42 IoCs
  • Suspicious use of SetWindowsHookEx 18 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\commerce _02.21.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:652
    • C:\programdata\xml.com
      "C:\programdata\xml.com" process list /format : "c:\programdata\i.xsl"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3268
      • C:\Windows\SYSTEM32\regsvr32.exe
        regsvr32 c:\programdata\27759.jpg
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1004
        • C:\Windows\SysWOW64\regsvr32.exe
          c:\programdata\27759.jpg
          4⤵
          • Loads dropped DLL
          • Checks SCSI registry key(s)
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of WriteProcessMemory
          PID:2588
          • C:\Windows\SysWOW64\explorer.exe
            C:\Windows\SysWOW64\explorer.exe
            5⤵
              PID:856

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Credential Access

    Discovery

    Query Registry

    3
    T1012

    Peripheral Device Discovery

    1
    T1120

    System Information Discovery

    3
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\xml.com
      MD5

      4191f61f2449ccc2bc2f2ac6d8898ce7

      SHA1

      d49936fc8a03561214ce4bf9791ca59e94ab8fe9

      SHA256

      74d21e1349aab027cd02d15f2428028c028592f265d1830c8dfc407f9bf76173

      SHA512

      fe67059bc374cc2d39dd01c22c2183ca44a8e04050d633f78d4eac415ae4528c378c7504ea3cc4b6923675256ae3af199b3a498243a4ca1a4d0f61f2e086821f

      Download Submit
    • C:\programdata\xml.com
      MD5

      4191f61f2449ccc2bc2f2ac6d8898ce7

      SHA1

      d49936fc8a03561214ce4bf9791ca59e94ab8fe9

      SHA256

      74d21e1349aab027cd02d15f2428028c028592f265d1830c8dfc407f9bf76173

      SHA512

      fe67059bc374cc2d39dd01c22c2183ca44a8e04050d633f78d4eac415ae4528c378c7504ea3cc4b6923675256ae3af199b3a498243a4ca1a4d0f61f2e086821f

      Download Submit
    • \??\c:\programdata\27759.jpg
      MD5

      9159385b8c97c71345927b333aeda23e

      SHA1

      a8327bba8d0bedc0423aeb2d57727d7b12f68377

      SHA256

      908054b1ffb1cddae6520a4ad86ddca31d8882f3d4c5a0c3ea2a253e6c55f264

      SHA512

      700fadaa2d1406b2705a8409411bd832df7c56ff195c487c9d83ee16fc9ea60d72cfc4df6dfc81e54ca124e71aefa8931d25fa18cac5b952b8c53aaa36c607e5

      Download Submit
    • \??\c:\programdata\i.xsl
      MD5

      87189b779e944d94f1f3e0a8720cfde3

      SHA1

      b8e7bb364f5909ace5447d707e24a1d4757904ec

      SHA256

      be41f4f3b31aae82f634ba1a853ca993900dcd4b13607e1546cbe959ae03b7b7

      SHA512

      c5daffdf9cf3e423dc34bb2ff29cc51341859a8c301d2e694f98f0df8ebd775dfc9bfdc3e5460ff3cde0f93832fcd38dbe2d96e1ec4db4a1556f40868ec1aaf3

      Download Submit
    • \ProgramData\27759.jpg
      MD5

      9159385b8c97c71345927b333aeda23e

      SHA1

      a8327bba8d0bedc0423aeb2d57727d7b12f68377

      SHA256

      908054b1ffb1cddae6520a4ad86ddca31d8882f3d4c5a0c3ea2a253e6c55f264

      SHA512

      700fadaa2d1406b2705a8409411bd832df7c56ff195c487c9d83ee16fc9ea60d72cfc4df6dfc81e54ca124e71aefa8931d25fa18cac5b952b8c53aaa36c607e5

      Download Submit
    • memory/652-6-0x00007FFC2FA60000-0x00007FFC30097000-memory.dmp
      Filesize

      6.2MB

      Download
    • memory/652-7-0x000001EAA4100000-0x000001EAA4104000-memory.dmp
      Filesize

      16KB

      Download
    • memory/652-2-0x00007FFC10600000-0x00007FFC10610000-memory.dmp
      Filesize

      64KB

      Download
    • memory/652-5-0x00007FFC10600000-0x00007FFC10610000-memory.dmp
      Filesize

      64KB

      Download
    • memory/652-4-0x00007FFC10600000-0x00007FFC10610000-memory.dmp
      Filesize

      64KB

      Download
    • memory/652-3-0x00007FFC10600000-0x00007FFC10610000-memory.dmp
      Filesize

      64KB

      Download
    • memory/856-18-0x0000000000000000-mapping.dmp
      Download
    • memory/856-19-0x0000000000970000-0x00000000009A5000-memory.dmp
      Filesize

      212KB

      Download
    • memory/1004-12-0x0000000000000000-mapping.dmp
      Download
    • memory/2588-14-0x0000000000000000-mapping.dmp
      Download
    • memory/2588-16-0x0000000074140000-0x0000000074175000-memory.dmp
      Filesize

      212KB

      Download
    • memory/2588-17-0x0000000002D90000-0x0000000002D91000-memory.dmp
      Filesize

      4KB

      Download
    • memory/3268-8-0x0000000000000000-mapping.dmp
      Download