Analysis

  • max time kernel
    138s
  • max time network
    150s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    19-02-2021 11:59

General

  • Target

    document-1220302043.xls

  • Size

    89KB

  • MD5

    f5ab73fce5791889d025ffe96cb7da34

  • SHA1

    01e9b0107095b88a73d66bd1eccb7ad318fe7b75

  • SHA256

    095dd24006435241df2f18e24e7227a6285f0f2c935e97712fbea0c5af22f61d

  • SHA512

    8a42795a726b855dd280da10b5b38a480f7ec8b29875880d95aada5f02a67af4034efaebb574c2427baeb86028e9202b6f491ff9927868051c7eb17f55f90818

Malware Config

Extracted

Family

qakbot

Botnet

tr

Campaign

1613385567

C2

78.63.226.32:443

197.51.82.72:443

193.248.221.184:2222

95.77.223.148:443

71.199.192.62:443

77.211.30.202:995

80.227.5.69:443

77.27.204.204:995

81.97.154.100:443

173.184.119.153:995

38.92.225.121:443

81.150.181.168:2222

90.65.236.181:2222

83.110.103.152:443

73.153.211.227:443

188.25.63.105:443

89.137.211.239:995

202.188.138.162:443

98.173.34.212:995

87.202.87.210:2222

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • Loads dropped DLL 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\document-1220302043.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:732
    • C:\Windows\SYSTEM32\rundll32.exe
      rundll32 ..\iopjvdf.vock,DllRegisterServer
      2⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:1300
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32 ..\iopjvdf.vock,DllRegisterServer
        3⤵
        • Loads dropped DLL
        • Checks SCSI registry key(s)
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:3892
        • C:\Windows\SysWOW64\explorer.exe
          C:\Windows\SysWOW64\explorer.exe
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3692
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn zfzlmpw /tr "regsvr32.exe -s \"\"" /SC ONCE /Z /ST 13:05 /ET 13:17
            5⤵
            • Creates scheduled task(s)
            PID:1848
  • \??\c:\windows\system32\regsvr32.exe
    regsvr32.exe -s ""
    1⤵
      PID:1956

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Execution

    Scheduled Task

    1
    T1053

    Persistence

    Scheduled Task

    1
    T1053

    Privilege Escalation

    Scheduled Task

    1
    T1053

    Discovery

    Query Registry

    3
    T1012

    Peripheral Device Discovery

    1
    T1120

    System Information Discovery

    3
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\iopjvdf.vock
      MD5

      a8e2e77d6e1159face67ee36e5d4f199

      SHA1

      e3494981cfbc8c9a2c7a053c3ca4ab662b7f529c

      SHA256

      307dcd0bd76ec40e3297813e65542bc6480262578d6623825340a5add4fb6bf8

      SHA512

      c5e1f248a90e3406e690b1a7c3f6e09f4c1b3db5be40786669ba3aa1d48f0e6f2b0060dc3ee098fb76dfb59f2aec14aac5300556c69e214eef542561bc7df273

    • \Users\Admin\iopjvdf.vock
      MD5

      a8e2e77d6e1159face67ee36e5d4f199

      SHA1

      e3494981cfbc8c9a2c7a053c3ca4ab662b7f529c

      SHA256

      307dcd0bd76ec40e3297813e65542bc6480262578d6623825340a5add4fb6bf8

      SHA512

      c5e1f248a90e3406e690b1a7c3f6e09f4c1b3db5be40786669ba3aa1d48f0e6f2b0060dc3ee098fb76dfb59f2aec14aac5300556c69e214eef542561bc7df273

    • memory/732-5-0x00007FF99EBA0000-0x00007FF99F1D7000-memory.dmp
      Filesize

      6.2MB

    • memory/732-6-0x00007FF97B640000-0x00007FF97B650000-memory.dmp
      Filesize

      64KB

    • memory/732-2-0x00007FF97B640000-0x00007FF97B650000-memory.dmp
      Filesize

      64KB

    • memory/732-4-0x00007FF97B640000-0x00007FF97B650000-memory.dmp
      Filesize

      64KB

    • memory/732-3-0x00007FF97B640000-0x00007FF97B650000-memory.dmp
      Filesize

      64KB

    • memory/1300-7-0x0000000000000000-mapping.dmp
    • memory/1848-16-0x0000000000000000-mapping.dmp
    • memory/3692-14-0x0000000000000000-mapping.dmp
    • memory/3692-15-0x0000000000110000-0x0000000000145000-memory.dmp
      Filesize

      212KB

    • memory/3692-17-0x0000000000110000-0x0000000000145000-memory.dmp
      Filesize

      212KB

    • memory/3892-12-0x0000000004580000-0x00000000045B3000-memory.dmp
      Filesize

      204KB

    • memory/3892-13-0x0000000004A50000-0x0000000004A85000-memory.dmp
      Filesize

      212KB

    • memory/3892-11-0x0000000002CF0000-0x0000000002CF1000-memory.dmp
      Filesize

      4KB

    • memory/3892-9-0x0000000000000000-mapping.dmp