Analysis
-
max time kernel
145s -
max time network
150s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
29-09-2021 11:34
Static task
static1
Behavioral task
behavioral1
Sample
recital-1267320846.xls
Resource
win7-en-20210920
General
-
Target
recital-1267320846.xls
-
Size
244KB
-
MD5
fa6369788a5f5490d4c506e65b82a166
-
SHA1
f12d615a708cd6e83c669e3a16c1bebbf2510718
-
SHA256
3f3f21189390158abe6d01848ce995c762f3b0e908ea27192778effb160a6014
-
SHA512
a0cf692797d8a9c232de08f15fe251380cdeb54835f5025a5605782d5a55fe4975a0d3fc2174093350b7d533a55ac2bbbea7dbf443a3389abf8c559c1e0f63e9
Malware Config
Extracted
https://gillcart.com/Cdpmoyhr/key.xml
https://geit.in/MeOlE9Xxd/key.xml
https://mercanets.com/9DPZqAfZdq5z/key.xml
Extracted
qakbot
402.363
tr
1632817399
105.198.236.99:443
140.82.49.12:443
37.210.152.224:995
89.101.97.139:443
81.241.252.59:2078
27.223.92.142:995
81.250.153.227:2222
73.151.236.31:443
47.22.148.6:443
122.11.220.212:2222
120.151.47.189:443
199.27.127.129:443
216.201.162.158:443
136.232.34.70:443
76.25.142.196:443
181.118.183.94:443
120.150.218.241:995
185.250.148.74:443
95.77.223.148:443
75.66.88.33:443
45.46.53.140:2222
173.25.166.81:443
103.148.120.144:443
173.21.10.71:2222
186.18.205.199:995
71.74.12.34:443
67.165.206.193:993
47.40.196.233:2222
68.204.7.158:443
24.229.150.54:995
109.12.111.14:443
177.130.82.197:2222
72.252.201.69:443
24.55.112.61:443
24.139.72.117:443
187.156.138.172:443
71.80.168.245:443
105.157.55.133:995
82.77.137.101:995
173.234.155.233:443
75.188.35.168:443
5.238.149.235:61202
73.77.87.137:443
182.176.112.182:443
96.37.113.36:993
162.244.227.34:443
92.59.35.196:2222
196.218.227.241:995
68.207.102.78:443
2.188.27.77:443
189.210.115.207:443
181.163.96.53:443
75.107.26.196:465
185.250.148.74:2222
68.186.192.69:443
Signatures
-
Process spawned unexpected child process 3 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
regsvr32.exeregsvr32.exeregsvr32.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 4528 4848 regsvr32.exe EXCEL.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 4568 4848 regsvr32.exe EXCEL.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 1660 4848 regsvr32.exe EXCEL.EXE -
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 4580 regsvr32.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 4848 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
regsvr32.exepid process 4580 regsvr32.exe 4580 regsvr32.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
regsvr32.exepid process 4580 regsvr32.exe -
Suspicious use of SetWindowsHookEx 14 IoCs
Processes:
EXCEL.EXEpid process 4848 EXCEL.EXE 4848 EXCEL.EXE 4848 EXCEL.EXE 4848 EXCEL.EXE 4848 EXCEL.EXE 4848 EXCEL.EXE 4848 EXCEL.EXE 4848 EXCEL.EXE 4848 EXCEL.EXE 4848 EXCEL.EXE 4848 EXCEL.EXE 4848 EXCEL.EXE 4848 EXCEL.EXE 4848 EXCEL.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
EXCEL.EXEregsvr32.exeregsvr32.exeexplorer.exedescription pid process target process PID 4848 wrote to memory of 4528 4848 EXCEL.EXE regsvr32.exe PID 4848 wrote to memory of 4528 4848 EXCEL.EXE regsvr32.exe PID 4848 wrote to memory of 4568 4848 EXCEL.EXE regsvr32.exe PID 4848 wrote to memory of 4568 4848 EXCEL.EXE regsvr32.exe PID 4848 wrote to memory of 1660 4848 EXCEL.EXE regsvr32.exe PID 4848 wrote to memory of 1660 4848 EXCEL.EXE regsvr32.exe PID 4568 wrote to memory of 4580 4568 regsvr32.exe regsvr32.exe PID 4568 wrote to memory of 4580 4568 regsvr32.exe regsvr32.exe PID 4568 wrote to memory of 4580 4568 regsvr32.exe regsvr32.exe PID 4580 wrote to memory of 992 4580 regsvr32.exe explorer.exe PID 4580 wrote to memory of 992 4580 regsvr32.exe explorer.exe PID 4580 wrote to memory of 992 4580 regsvr32.exe explorer.exe PID 4580 wrote to memory of 992 4580 regsvr32.exe explorer.exe PID 4580 wrote to memory of 992 4580 regsvr32.exe explorer.exe PID 992 wrote to memory of 3600 992 explorer.exe schtasks.exe PID 992 wrote to memory of 3600 992 explorer.exe schtasks.exe PID 992 wrote to memory of 3600 992 explorer.exe schtasks.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\recital-1267320846.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" C:\Datop\test.test2⤵
- Process spawned unexpected child process
-
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" C:\Datop\test1.test2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeC:\Datop\test1.test3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn fervblvn /tr "regsvr32.exe -s \"C:\Datop\test1.test\"" /SC ONCE /Z /ST 13:37 /ET 13:495⤵
- Creates scheduled task(s)
-
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" C:\Datop\test2.test2⤵
- Process spawned unexpected child process
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Datop\test1.testMD5
4de7a3ab6bb2309e9fead5dfb1487d6a
SHA112bce853b0b7e5034ea6b5ea4fca60a1598960cc
SHA25627b9ad5c90d4f554bdc71bf20e9863cf47bd54cbc1daf0e67164353d3de1b17e
SHA512999015ca140f12220f84c1bb76c80268cb11cda2f2dde035bc7f9a00cc1299c453d43fa0eb0a7cc51c6518caf1d82801032841bb92fcb7cae4d6dd899556f439
-
\Datop\test1.testMD5
4de7a3ab6bb2309e9fead5dfb1487d6a
SHA112bce853b0b7e5034ea6b5ea4fca60a1598960cc
SHA25627b9ad5c90d4f554bdc71bf20e9863cf47bd54cbc1daf0e67164353d3de1b17e
SHA512999015ca140f12220f84c1bb76c80268cb11cda2f2dde035bc7f9a00cc1299c453d43fa0eb0a7cc51c6518caf1d82801032841bb92fcb7cae4d6dd899556f439
-
memory/992-295-0x0000000000960000-0x0000000000981000-memory.dmpFilesize
132KB
-
memory/992-291-0x0000000000000000-mapping.dmp
-
memory/1660-281-0x0000000000000000-mapping.dmp
-
memory/3600-292-0x0000000000000000-mapping.dmp
-
memory/4528-277-0x0000000000000000-mapping.dmp
-
memory/4568-279-0x0000000000000000-mapping.dmp
-
memory/4580-289-0x0000000010000000-0x000000001007E000-memory.dmpFilesize
504KB
-
memory/4580-286-0x0000000000000000-mapping.dmp
-
memory/4580-288-0x0000000010000000-0x0000000010021000-memory.dmpFilesize
132KB
-
memory/4580-290-0x0000000000AF0000-0x0000000000AF1000-memory.dmpFilesize
4KB
-
memory/4848-123-0x0000018E1C260000-0x0000018E1E155000-memory.dmpFilesize
31.0MB
-
memory/4848-122-0x00007FFD900C0000-0x00007FFD911AE000-memory.dmpFilesize
16.9MB
-
memory/4848-121-0x00007FFD6E7C0000-0x00007FFD6E7D0000-memory.dmpFilesize
64KB
-
memory/4848-118-0x00007FFD6E7C0000-0x00007FFD6E7D0000-memory.dmpFilesize
64KB
-
memory/4848-114-0x00007FF6F16B0000-0x00007FF6F4C66000-memory.dmpFilesize
53.7MB
-
memory/4848-117-0x00007FFD6E7C0000-0x00007FFD6E7D0000-memory.dmpFilesize
64KB
-
memory/4848-116-0x00007FFD6E7C0000-0x00007FFD6E7D0000-memory.dmpFilesize
64KB
-
memory/4848-115-0x00007FFD6E7C0000-0x00007FFD6E7D0000-memory.dmpFilesize
64KB