qakbot | 2cfd061b305b2a84dc3cb0be6efc34bf745ac17b3eebec5d7261ccff5826a471

Analysis

max time kernel
1753s
max time network
1803s
platform
windows7_x64
resource
win7v20210408
submitted
22-09-2021 20:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Payment-717642397-09222021.xls
Size

410KB
MD5

6914ea6d7958fff64c588be284e972a5
SHA1

4c8e33fcd0c9418817a984486368c1c92e6198ec
SHA256

7342103dcccaef9a164f7effea9b0c48e76409bfa163fc137803b03f3d539b3b
SHA512

e7dc8c20609456c95406f53811a788763d33647ca4b4880bea4188a08b485495c44b1db071402c311cefcb4df266866f59c756aa32b8487a0aafc7adacfb962f

Score

10^/10

qakbot obama102 1632302707 banker stealer trojan

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper

http://188.165.62.10/44461.9575523148.dat

xlm40.dropper

http://185.82.202.248/44461.9575523148.dat

xlm40.dropper

http://84.246.85.241/44461.9575523148.dat

Extracted

Family

qakbot

Version

402.318

Botnet

obama102

Campaign

1632302707

120.150.218.241:995

47.22.148.6:443

105.198.236.99:443

95.77.223.148:443

140.82.49.12:443

27.223.92.142:995

73.151.236.31:443

136.232.34.70:443

144.139.47.206:443

45.46.53.140:2222

76.25.142.196:443

173.21.10.71:2222

75.188.35.168:443

71.74.12.34:443

96.37.113.36:993

67.165.206.193:993

189.210.115.207:443

72.252.201.69:443

24.139.72.117:443

24.229.150.54:995

Signatures

Process spawned unexpected child process 3 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

regsvr32.exeregsvr32.exeregsvr32.exe

description	pid	pid_target	process	target process
Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	828	560	regsvr32.exe	EXCEL.EXE
Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	1700	560	regsvr32.exe	EXCEL.EXE
Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	1248	560	regsvr32.exe	EXCEL.EXE

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Downloads MZ/PE file
Loads dropped DLL 5 IoCs

Processes:

regsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exe

pid process

828 regsvr32.exe
1700 regsvr32.exe
1248 regsvr32.exe
1300 regsvr32.exe
1172 regsvr32.exe
Office loads VBA resources, possible macro or embedded object present
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

700 schtasks.exe
Discovers systems in the same network 1 TTPs 1 IoCs
discovery

Remote System Discovery
T1018

Processes:

net.exe

pid process

788 net.exe
Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

EXCEL.EXE

description ioc process

Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command-Line Interface
T1059

Processes:

ipconfig.exenetstat.exe

pid process

1752 ipconfig.exe
1376 netstat.exe

pid	process
828	regsvr32.exe
1700	regsvr32.exe
1248	regsvr32.exe
1300	regsvr32.exe
1172	regsvr32.exe

pid	process
700	schtasks.exe

pid	process
788	net.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

pid	process
1752	ipconfig.exe
1376	netstat.exe

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

EXCEL.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	EXCEL.EXE

Modifies registry class 64 IoCs

Processes:

EXCEL.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Wow6432Node\Interface\{5512D11B-5CC6-11CF-8D67-00AA00BDCE1D}	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Wow6432Node\Interface\{79176FB2-B7F2-11CE-97EF-00AA006D2776}\ = "SpinbuttonEvents"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Wow6432Node\Interface\{47FF8FE8-6198-11CF-8CE8-00AA006CB389}	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7A4F6947-8634-4BB9-90BB-BDDCEC105A5A}\2.0\0	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7A4F6947-8634-4BB9-90BB-BDDCEC105A5A}\2.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\VBE\\MSForms.exd"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Wow6432Node\Interface\{8A683C90-BA84-11CF-8110-00A0C9030074}\ = "IReturnSingle"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Wow6432Node\Interface\{8BD21D13-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcText"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Interface\{47FF8FE9-6198-11CF-8CE8-00AA006CB389}	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Interface\{8A683C91-BA84-11CF-8110-00A0C9030074}	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Interface\{A38BFFC3-A5A0-11CE-8107-00AA00611080}	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Wow6432Node\Interface\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D}	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Wow6432Node\Interface\{5512D123-5CC6-11CF-8D67-00AA00BDCE1D}	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Interface\{8BD21D23-EC42-11CE-9E0D-00AA006002F3}	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Interface\{5512D113-5CC6-11CF-8D67-00AA00BDCE1D}	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Wow6432Node\Interface\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D}	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Wow6432Node\Interface\{04598FC9-866C-11CF-AB7C-00AA00C08FCF}	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Interface\{04598FC9-866C-11CF-AB7C-00AA00C08FCF}\ = "IMultiPage"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Wow6432Node\Interface\{82B02370-B5BC-11CF-810F-00A0C9030074}	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Wow6432Node\Interface\{8A683C91-BA84-11CF-8110-00A0C9030074}	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Wow6432Node\Interface\{7B020EC1-AF6C-11CE-9F46-00AA00574A4F}\ = "CommandButtonEvents"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Interface\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F}\ = "TabStripEvents"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Wow6432Node\Interface\{47FF8FE3-6198-11CF-8CE8-00AA006CB389}	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\TypeLib\{7A4F6947-8634-4BB9-90BB-BDDCEC105A5A}\2.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\VBE\\MSForms.exd"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Wow6432Node\Interface\{8A683C90-BA84-11CF-8110-00A0C9030074}	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Interface\{8A683C90-BA84-11CF-8110-00A0C9030074}	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Wow6432Node\Interface\{04598FC2-866C-11CF-AB7C-00AA00C08FCF}\ = "ITabStrip"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Interface\{EC72F590-F375-11CE-B9E8-00AA006B1A69}\ = "IDataAutoWrapper"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Wow6432Node\Interface\{CF3F94A0-F546-11CE-9BCE-00AA00608E01}\ = "OptionFrameEvents"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Interface\{944ACF93-A1E6-11CE-8104-00AA00611080}\ = "Tabs"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Interface\{47FF8FE4-6198-11CF-8CE8-00AA006CB389}	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Wow6432Node\Interface\{47FF8FE5-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents6"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Wow6432Node\Interface\{04598FC7-866C-11CF-AB7C-00AA00C08FCF}\ = "Controls"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Interface\{29B86A70-F52E-11CE-9BCE-00AA00608E01}\ = "IOptionFrame"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Interface\{04598FC1-866C-11CF-AB7C-00AA00C08FCF}\ = "ILabelControl"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Wow6432Node\Interface\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLHidden"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Wow6432Node\Interface\{4C599243-6926-101B-9992-00000B65C6F9}\ = "IImage"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Wow6432Node\Interface\{4C5992A5-6926-101B-9992-00000B65C6F9}	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Interface\{47FF8FE1-6198-11CF-8CE8-00AA006CB389}	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Interface\{7B020EC8-AF6C-11CE-9F46-00AA00574A4F}\ = "MultiPageEvents"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7A4F6947-8634-4BB9-90BB-BDDCEC105A5A}	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Interface\{8A683C91-BA84-11CF-8110-00A0C9030074}\ = "IReturnEffect"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Wow6432Node\Interface\{04598FC6-866C-11CF-AB7C-00AA00C08FCF}\ = "IControl"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Interface\{04598FC2-866C-11CF-AB7C-00AA00C08FCF}	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\TypeLib\{7A4F6947-8634-4BB9-90BB-BDDCEC105A5A}\2.0\0\win32	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Interface\{8BD21D32-EC42-11CE-9E0D-00AA006002F3}	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Wow6432Node\Interface\{92E11A03-7358-11CE-80CB-00AA00611080}	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Wow6432Node\Interface\{5512D11F-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLPassword"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Interface\{5512D11F-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLPassword"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Wow6432Node	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Wow6432Node\Interface\{BEF6E003-A874-101A-8BBA-00AA00300CAB}	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Wow6432Node\Interface\{5B9D8FC8-4A71-101B-97A6-00000B65C08B}	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Wow6432Node\Interface\{8BD21D23-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcList"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Wow6432Node\Interface\{82B02371-B5BC-11CF-810F-00A0C9030074}	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Wow6432Node\Interface\{47FF8FE0-6198-11CF-8CE8-00AA006CB389}	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Interface\{8BD21D42-EC42-11CE-9E0D-00AA006002F3}\ = "MdcCheckBoxEvents"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Wow6432Node\Interface\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0}\ = "LabelControlEvents"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Wow6432Node\Interface\{7B020EC2-AF6C-11CE-9F46-00AA00574A4F}	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Wow6432Node\Interface\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D}\ = "WHTMLControlEvents"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Wow6432Node\Interface\{EC72F590-F375-11CE-B9E8-00AA006B1A69}	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Wow6432Node\Interface\{04598FC3-866C-11CF-AB7C-00AA00C08FCF}	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Interface\{04598FC3-866C-11CF-AB7C-00AA00C08FCF}\ = "IScrollbar"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Interface\{5512D125-5CC6-11CF-8D67-00AA00BDCE1D}	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Interface\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29}	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Wow6432Node\Interface\{944ACF93-A1E6-11CE-8104-00AA00611080}\ = "Tabs"	EXCEL.EXE

Runs net.exe
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

560 EXCEL.EXE
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

regsvr32.exeregsvr32.exeregsvr32.exeexplorer.exe

pid process

828 regsvr32.exe
1700 regsvr32.exe
1248 regsvr32.exe
1544 explorer.exe
Suspicious behavior: MapViewOfSection 3 IoCs

Processes:

regsvr32.exeregsvr32.exeregsvr32.exe

pid process

828 regsvr32.exe
1700 regsvr32.exe
1248 regsvr32.exe

pid	process
560	EXCEL.EXE

pid	process
828	regsvr32.exe
1700	regsvr32.exe
1248	regsvr32.exe
1544	explorer.exe

pid	process
828	regsvr32.exe
1700	regsvr32.exe
1248	regsvr32.exe

Suspicious use of AdjustPrivilegeToken 27 IoCs

Processes:

whoami.exenetstat.exemsiexec.exe

description	pid	process
Token: SeDebugPrivilege	1216	whoami.exe
Token: SeDebugPrivilege	1216	whoami.exe
Token: SeDebugPrivilege	1216	whoami.exe
Token: SeDebugPrivilege	1216	whoami.exe
Token: SeDebugPrivilege	1216	whoami.exe
Token: SeDebugPrivilege	1216	whoami.exe
Token: SeDebugPrivilege	1216	whoami.exe
Token: SeDebugPrivilege	1216	whoami.exe
Token: SeDebugPrivilege	1216	whoami.exe
Token: SeDebugPrivilege	1216	whoami.exe
Token: SeDebugPrivilege	1216	whoami.exe
Token: SeDebugPrivilege	1216	whoami.exe
Token: SeDebugPrivilege	1216	whoami.exe
Token: SeDebugPrivilege	1216	whoami.exe
Token: SeDebugPrivilege	1216	whoami.exe
Token: SeDebugPrivilege	1216	whoami.exe
Token: SeDebugPrivilege	1216	whoami.exe
Token: SeDebugPrivilege	1216	whoami.exe
Token: SeDebugPrivilege	1216	whoami.exe
Token: SeDebugPrivilege	1216	whoami.exe
Token: SeDebugPrivilege	1216	whoami.exe
Token: SeDebugPrivilege	1216	whoami.exe
Token: SeDebugPrivilege	1216	whoami.exe
Token: SeDebugPrivilege	1376	netstat.exe
Token: SeRestorePrivilege	1772	msiexec.exe
Token: SeTakeOwnershipPrivilege	1772	msiexec.exe
Token: SeSecurityPrivilege	1772	msiexec.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

EXCEL.EXE

pid process

560 EXCEL.EXE
560 EXCEL.EXE
560 EXCEL.EXE

pid	process
560	EXCEL.EXE
560	EXCEL.EXE
560	EXCEL.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

EXCEL.EXEregsvr32.exeexplorer.exeregsvr32.exeregsvr32.exetaskeng.exeregsvr32.exe

description	pid	process	target process
PID 560 wrote to memory of 828	560	EXCEL.EXE	regsvr32.exe
PID 560 wrote to memory of 828	560	EXCEL.EXE	regsvr32.exe
PID 560 wrote to memory of 828	560	EXCEL.EXE	regsvr32.exe
PID 560 wrote to memory of 828	560	EXCEL.EXE	regsvr32.exe
PID 560 wrote to memory of 828	560	EXCEL.EXE	regsvr32.exe
PID 560 wrote to memory of 828	560	EXCEL.EXE	regsvr32.exe
PID 560 wrote to memory of 828	560	EXCEL.EXE	regsvr32.exe
PID 828 wrote to memory of 1544	828	regsvr32.exe	explorer.exe
PID 828 wrote to memory of 1544	828	regsvr32.exe	explorer.exe
PID 828 wrote to memory of 1544	828	regsvr32.exe	explorer.exe
PID 828 wrote to memory of 1544	828	regsvr32.exe	explorer.exe
PID 828 wrote to memory of 1544	828	regsvr32.exe	explorer.exe
PID 828 wrote to memory of 1544	828	regsvr32.exe	explorer.exe
PID 560 wrote to memory of 1700	560	EXCEL.EXE	regsvr32.exe
PID 560 wrote to memory of 1700	560	EXCEL.EXE	regsvr32.exe
PID 560 wrote to memory of 1700	560	EXCEL.EXE	regsvr32.exe
PID 560 wrote to memory of 1700	560	EXCEL.EXE	regsvr32.exe
PID 560 wrote to memory of 1700	560	EXCEL.EXE	regsvr32.exe
PID 560 wrote to memory of 1700	560	EXCEL.EXE	regsvr32.exe
PID 560 wrote to memory of 1700	560	EXCEL.EXE	regsvr32.exe
PID 1544 wrote to memory of 700	1544	explorer.exe	schtasks.exe
PID 1544 wrote to memory of 700	1544	explorer.exe	schtasks.exe
PID 1544 wrote to memory of 700	1544	explorer.exe	schtasks.exe
PID 1544 wrote to memory of 700	1544	explorer.exe	schtasks.exe
PID 1700 wrote to memory of 1160	1700	regsvr32.exe	explorer.exe
PID 1700 wrote to memory of 1160	1700	regsvr32.exe	explorer.exe
PID 1700 wrote to memory of 1160	1700	regsvr32.exe	explorer.exe
PID 1700 wrote to memory of 1160	1700	regsvr32.exe	explorer.exe
PID 1700 wrote to memory of 1160	1700	regsvr32.exe	explorer.exe
PID 1700 wrote to memory of 1160	1700	regsvr32.exe	explorer.exe
PID 560 wrote to memory of 1248	560	EXCEL.EXE	regsvr32.exe
PID 560 wrote to memory of 1248	560	EXCEL.EXE	regsvr32.exe
PID 560 wrote to memory of 1248	560	EXCEL.EXE	regsvr32.exe
PID 560 wrote to memory of 1248	560	EXCEL.EXE	regsvr32.exe
PID 560 wrote to memory of 1248	560	EXCEL.EXE	regsvr32.exe
PID 560 wrote to memory of 1248	560	EXCEL.EXE	regsvr32.exe
PID 560 wrote to memory of 1248	560	EXCEL.EXE	regsvr32.exe
PID 1248 wrote to memory of 1368	1248	regsvr32.exe	explorer.exe
PID 1248 wrote to memory of 1368	1248	regsvr32.exe	explorer.exe
PID 1248 wrote to memory of 1368	1248	regsvr32.exe	explorer.exe
PID 1248 wrote to memory of 1368	1248	regsvr32.exe	explorer.exe
PID 1248 wrote to memory of 1368	1248	regsvr32.exe	explorer.exe
PID 1248 wrote to memory of 1368	1248	regsvr32.exe	explorer.exe
PID 916 wrote to memory of 1904	916	taskeng.exe	regsvr32.exe
PID 916 wrote to memory of 1904	916	taskeng.exe	regsvr32.exe
PID 916 wrote to memory of 1904	916	taskeng.exe	regsvr32.exe
PID 916 wrote to memory of 1904	916	taskeng.exe	regsvr32.exe
PID 916 wrote to memory of 1904	916	taskeng.exe	regsvr32.exe
PID 1904 wrote to memory of 1300	1904	regsvr32.exe	regsvr32.exe
PID 1904 wrote to memory of 1300	1904	regsvr32.exe	regsvr32.exe
PID 1904 wrote to memory of 1300	1904	regsvr32.exe	regsvr32.exe
PID 1904 wrote to memory of 1300	1904	regsvr32.exe	regsvr32.exe
PID 1904 wrote to memory of 1300	1904	regsvr32.exe	regsvr32.exe
PID 1904 wrote to memory of 1300	1904	regsvr32.exe	regsvr32.exe
PID 1904 wrote to memory of 1300	1904	regsvr32.exe	regsvr32.exe
PID 1544 wrote to memory of 1216	1544	explorer.exe	whoami.exe
PID 1544 wrote to memory of 1216	1544	explorer.exe	whoami.exe
PID 1544 wrote to memory of 1216	1544	explorer.exe	whoami.exe
PID 1544 wrote to memory of 1216	1544	explorer.exe	whoami.exe
PID 1544 wrote to memory of 1064	1544	explorer.exe	cmd.exe
PID 1544 wrote to memory of 1064	1544	explorer.exe	cmd.exe
PID 1544 wrote to memory of 1064	1544	explorer.exe	cmd.exe
PID 1544 wrote to memory of 1064	1544	explorer.exe	cmd.exe
PID 1544 wrote to memory of 1620	1544	explorer.exe	arp.exe

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\Payment-717642397-09222021.xls
1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:560

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 -silent ..\Xertis.dll
2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:828

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1544

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn uogavqp /tr "regsvr32.exe -s \"C:\Users\Admin\Xertis.dll\"" /SC ONCE /Z /ST 23:01 /ET 23:13
4⤵
- Creates scheduled task(s)
PID:700

C:\Windows\SysWOW64\whoami.exe
whoami /all
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1216

C:\Windows\SysWOW64\cmd.exe
cmd /c set
4⤵
PID:1064

C:\Windows\SysWOW64\arp.exe
arp -a
4⤵
PID:1620

C:\Windows\SysWOW64\ipconfig.exe
ipconfig /all
4⤵
- Gathers network information
PID:1752

C:\Windows\SysWOW64\net.exe
net view /all
4⤵
- Discovers systems in the same network
PID:788

C:\Windows\SysWOW64\nslookup.exe
nslookup -querytype=ALL -timeout=10 _ldap._tcp.dc._msdcs.WORKGROUP
4⤵
PID:1212

C:\Windows\SysWOW64\net.exe
net share
4⤵
PID:2008

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 share
5⤵
PID:1188

C:\Windows\SysWOW64\route.exe
route print
4⤵
PID:804

C:\Windows\SysWOW64\netstat.exe
netstat -nao
4⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:1376

C:\Windows\SysWOW64\net.exe
net localgroup
4⤵
PID:2036

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup
5⤵
PID:932

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 -silent ..\Xertis1.dll
2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1700

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
PID:1160

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 -silent ..\Xertis2.dll
2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1248

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
PID:1368

C:\Windows\system32\taskeng.exe
taskeng.exe {DBB6681A-CC88-4F36-93B8-ED5461DB5363} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:916

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\Xertis.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:1904

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\Xertis.dll"
3⤵
- Loads dropped DLL
PID:1300

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1772

C:\Windows\system32\taskeng.exe
taskeng.exe {97DC5B37-A0C4-468A-9FC1-73663A968B5B} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:1592

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\Xertis.dll"
2⤵
PID:1624

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\Xertis.dll"
3⤵
- Loads dropped DLL
PID:1172

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Command-Line Interface

T1059

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Xertis.dll
MD5
81c4ffe02a85dcc9abae6f8b015aa5e0

SHA1
8e11e5bf2a468efaad5b1acf03782307064ff430

SHA256
3d08a779418ab9b22e24c236b97246033c919abc885c813551fe409b63421541

SHA512
d1b1f39587ed75e177443ac5e3009b522627b8388d1dd3ec7cf16fdca33da253ebd9514b6bdce5c34131fa71f77c0d7d6ced3d0972325204cc0bd642c98ff6eb

Download Submit
C:\Users\Admin\Xertis.dll
MD5
a77ee18833f79b86262d4f4876a252a9

SHA1
efcb36e4b40493ccc361541495d3084b4275f30b

SHA256
68806e100eb54e0f0a02fc1e97f205eb72b768f2b8b238433b169749c3dec688

SHA512
89aca20e7cf76b2292e144b3c66a23c52d30701baa3a0e57f1b6338c9e0ef0376eac6902ed1f0c6b01c27afb60ce2ceabf8bbf4d855389c2626c50544b06a08f

Download Submit
C:\Users\Admin\Xertis1.dll
MD5
a77ee18833f79b86262d4f4876a252a9

SHA1
efcb36e4b40493ccc361541495d3084b4275f30b

SHA256
68806e100eb54e0f0a02fc1e97f205eb72b768f2b8b238433b169749c3dec688

SHA512
89aca20e7cf76b2292e144b3c66a23c52d30701baa3a0e57f1b6338c9e0ef0376eac6902ed1f0c6b01c27afb60ce2ceabf8bbf4d855389c2626c50544b06a08f

Download Submit
C:\Users\Admin\Xertis2.dll
MD5
a77ee18833f79b86262d4f4876a252a9

SHA1
efcb36e4b40493ccc361541495d3084b4275f30b

SHA256
68806e100eb54e0f0a02fc1e97f205eb72b768f2b8b238433b169749c3dec688

SHA512
89aca20e7cf76b2292e144b3c66a23c52d30701baa3a0e57f1b6338c9e0ef0376eac6902ed1f0c6b01c27afb60ce2ceabf8bbf4d855389c2626c50544b06a08f

Download Submit
\Users\Admin\Xertis.dll
MD5
81c4ffe02a85dcc9abae6f8b015aa5e0

SHA1
8e11e5bf2a468efaad5b1acf03782307064ff430

SHA256
3d08a779418ab9b22e24c236b97246033c919abc885c813551fe409b63421541

SHA512
d1b1f39587ed75e177443ac5e3009b522627b8388d1dd3ec7cf16fdca33da253ebd9514b6bdce5c34131fa71f77c0d7d6ced3d0972325204cc0bd642c98ff6eb

Download Submit
\Users\Admin\Xertis.dll
MD5
81c4ffe02a85dcc9abae6f8b015aa5e0

SHA1
8e11e5bf2a468efaad5b1acf03782307064ff430

SHA256
3d08a779418ab9b22e24c236b97246033c919abc885c813551fe409b63421541

SHA512
d1b1f39587ed75e177443ac5e3009b522627b8388d1dd3ec7cf16fdca33da253ebd9514b6bdce5c34131fa71f77c0d7d6ced3d0972325204cc0bd642c98ff6eb

Download Submit
\Users\Admin\Xertis.dll
MD5
a77ee18833f79b86262d4f4876a252a9

SHA1
efcb36e4b40493ccc361541495d3084b4275f30b

SHA256
68806e100eb54e0f0a02fc1e97f205eb72b768f2b8b238433b169749c3dec688

SHA512
89aca20e7cf76b2292e144b3c66a23c52d30701baa3a0e57f1b6338c9e0ef0376eac6902ed1f0c6b01c27afb60ce2ceabf8bbf4d855389c2626c50544b06a08f

Download Submit
\Users\Admin\Xertis1.dll
MD5
a77ee18833f79b86262d4f4876a252a9

SHA1
efcb36e4b40493ccc361541495d3084b4275f30b

SHA256
68806e100eb54e0f0a02fc1e97f205eb72b768f2b8b238433b169749c3dec688

SHA512
89aca20e7cf76b2292e144b3c66a23c52d30701baa3a0e57f1b6338c9e0ef0376eac6902ed1f0c6b01c27afb60ce2ceabf8bbf4d855389c2626c50544b06a08f

Download Submit
\Users\Admin\Xertis2.dll
MD5
a77ee18833f79b86262d4f4876a252a9

SHA1
efcb36e4b40493ccc361541495d3084b4275f30b

SHA256
68806e100eb54e0f0a02fc1e97f205eb72b768f2b8b238433b169749c3dec688

SHA512
89aca20e7cf76b2292e144b3c66a23c52d30701baa3a0e57f1b6338c9e0ef0376eac6902ed1f0c6b01c27afb60ce2ceabf8bbf4d855389c2626c50544b06a08f

Download Submit
memory/560-97-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/560-62-0x00000000061C0000-0x00000000061C2000-memory.dmp

Filesize
8KB

Download
memory/560-61-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/560-59-0x000000002F671000-0x000000002F674000-memory.dmp

Filesize
12KB

Download
memory/560-60-0x0000000071A51000-0x0000000071A53000-memory.dmp

Filesize
8KB

Download
memory/700-76-0x0000000000000000-mapping.dmp

Download
memory/788-109-0x0000000000000000-mapping.dmp

Download
memory/804-113-0x0000000000000000-mapping.dmp

Download
memory/828-77-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download
memory/828-67-0x000000006C840000-0x000000006C861000-memory.dmp

Filesize
132KB

Download
memory/828-68-0x000000006C840000-0x000000006C8E1000-memory.dmp

Filesize
644KB

Download
memory/828-64-0x0000000075D11000-0x0000000075D13000-memory.dmp

Filesize
8KB

Download
memory/828-63-0x0000000000000000-mapping.dmp

Download
memory/932-116-0x0000000000000000-mapping.dmp

Download
memory/1064-105-0x0000000000000000-mapping.dmp

Download
memory/1160-82-0x0000000000000000-mapping.dmp

Download
memory/1160-89-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1172-120-0x0000000000000000-mapping.dmp

Download
memory/1188-112-0x0000000000000000-mapping.dmp

Download
memory/1212-110-0x0000000000000000-mapping.dmp

Download
memory/1216-104-0x0000000000000000-mapping.dmp

Download
memory/1248-91-0x000000006CA60000-0x000000006CB01000-memory.dmp

Filesize
644KB

Download
memory/1248-95-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/1248-85-0x0000000000000000-mapping.dmp

Download
memory/1300-101-0x0000000000000000-mapping.dmp

Download
memory/1368-96-0x0000000000080000-0x00000000000A1000-memory.dmp

Filesize
132KB

Download
memory/1368-92-0x0000000000000000-mapping.dmp

Download
memory/1376-114-0x0000000000000000-mapping.dmp

Download
memory/1544-78-0x00000000000D0000-0x00000000000F1000-memory.dmp

Filesize
132KB

Download
memory/1544-71-0x000000006C5D1000-0x000000006C5D3000-memory.dmp

Filesize
8KB

Download
memory/1544-69-0x0000000000000000-mapping.dmp

Download
memory/1620-106-0x0000000000000000-mapping.dmp

Download
memory/1624-118-0x0000000000000000-mapping.dmp

Download
memory/1700-79-0x000000006CA60000-0x000000006CA81000-memory.dmp

Filesize
132KB

Download
memory/1700-81-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/1700-72-0x0000000000000000-mapping.dmp

Download
memory/1700-80-0x000000006CA60000-0x000000006CB01000-memory.dmp

Filesize
644KB

Download
memory/1752-107-0x0000000000000000-mapping.dmp

Download
memory/1904-99-0x000007FEFC251000-0x000007FEFC253000-memory.dmp

Filesize
8KB

Download
memory/1904-98-0x0000000000000000-mapping.dmp

Download
memory/2008-111-0x0000000000000000-mapping.dmp

Download
memory/2036-115-0x0000000000000000-mapping.dmp

Download