Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
30-09-2021 11:16
Behavioral task
behavioral1
Sample
Compensation-1027110219.xls
Resource
win7-en-20210920
General
-
Target
Compensation-1027110219.xls
-
Size
233KB
-
MD5
76c5b3c16a42fd876d3c8648063ebefd
-
SHA1
17eb233138408ec24ee1d300c7fdec089d534766
-
SHA256
c0a3994bb5140514f73ecfb49ba1f8a74c2cf3c31dde10c79fa5b8f615ce16b4
-
SHA512
e50ac5cff53c6d014b73db0a1de64fd3904fb9b55b65c0278d284fda0b9fa4d6b0a5038f6cfc3618b13103d64dbbcb81ca40b5a27621a00090f6d53a03f0eedc
Malware Config
Extracted
https://safalerp.com/J1wlINw7HtJ/siera.xml
https://godschildrenaf.org/qxwbRMzrqoWK/siera.xml
https://callgirlsandescortkenya.site/hllzvTuU/siera.xml
Extracted
qakbot
402.363
tr
1632817399
105.198.236.99:443
140.82.49.12:443
37.210.152.224:995
89.101.97.139:443
81.241.252.59:2078
27.223.92.142:995
81.250.153.227:2222
73.151.236.31:443
47.22.148.6:443
122.11.220.212:2222
120.151.47.189:443
199.27.127.129:443
216.201.162.158:443
136.232.34.70:443
76.25.142.196:443
181.118.183.94:443
120.150.218.241:995
185.250.148.74:443
95.77.223.148:443
75.66.88.33:443
45.46.53.140:2222
173.25.166.81:443
103.148.120.144:443
173.21.10.71:2222
186.18.205.199:995
71.74.12.34:443
67.165.206.193:993
47.40.196.233:2222
68.204.7.158:443
24.229.150.54:995
109.12.111.14:443
177.130.82.197:2222
72.252.201.69:443
24.55.112.61:443
24.139.72.117:443
187.156.138.172:443
71.80.168.245:443
105.157.55.133:995
82.77.137.101:995
173.234.155.233:443
75.188.35.168:443
5.238.149.235:61202
73.77.87.137:443
182.176.112.182:443
96.37.113.36:993
162.244.227.34:443
92.59.35.196:2222
196.218.227.241:995
68.207.102.78:443
2.188.27.77:443
189.210.115.207:443
181.163.96.53:443
75.107.26.196:465
185.250.148.74:2222
68.186.192.69:443
Signatures
-
Process spawned unexpected child process 3 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
regsvr32.exeregsvr32.exeregsvr32.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 3736 808 regsvr32.exe EXCEL.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 3308 808 regsvr32.exe EXCEL.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 2268 808 regsvr32.exe EXCEL.EXE -
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 2724 regsvr32.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 808 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
regsvr32.exepid process 2724 regsvr32.exe 2724 regsvr32.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
regsvr32.exepid process 2724 regsvr32.exe -
Suspicious use of SetWindowsHookEx 14 IoCs
Processes:
EXCEL.EXEpid process 808 EXCEL.EXE 808 EXCEL.EXE 808 EXCEL.EXE 808 EXCEL.EXE 808 EXCEL.EXE 808 EXCEL.EXE 808 EXCEL.EXE 808 EXCEL.EXE 808 EXCEL.EXE 808 EXCEL.EXE 808 EXCEL.EXE 808 EXCEL.EXE 808 EXCEL.EXE 808 EXCEL.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
EXCEL.EXEregsvr32.exeregsvr32.exeexplorer.exedescription pid process target process PID 808 wrote to memory of 3736 808 EXCEL.EXE regsvr32.exe PID 808 wrote to memory of 3736 808 EXCEL.EXE regsvr32.exe PID 808 wrote to memory of 3308 808 EXCEL.EXE regsvr32.exe PID 808 wrote to memory of 3308 808 EXCEL.EXE regsvr32.exe PID 808 wrote to memory of 2268 808 EXCEL.EXE regsvr32.exe PID 808 wrote to memory of 2268 808 EXCEL.EXE regsvr32.exe PID 2268 wrote to memory of 2724 2268 regsvr32.exe regsvr32.exe PID 2268 wrote to memory of 2724 2268 regsvr32.exe regsvr32.exe PID 2268 wrote to memory of 2724 2268 regsvr32.exe regsvr32.exe PID 2724 wrote to memory of 640 2724 regsvr32.exe explorer.exe PID 2724 wrote to memory of 640 2724 regsvr32.exe explorer.exe PID 2724 wrote to memory of 640 2724 regsvr32.exe explorer.exe PID 2724 wrote to memory of 640 2724 regsvr32.exe explorer.exe PID 2724 wrote to memory of 640 2724 regsvr32.exe explorer.exe PID 640 wrote to memory of 1000 640 explorer.exe schtasks.exe PID 640 wrote to memory of 1000 640 explorer.exe schtasks.exe PID 640 wrote to memory of 1000 640 explorer.exe schtasks.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Compensation-1027110219.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" C:\Datop\test.test2⤵
- Process spawned unexpected child process
-
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" C:\Datop\test1.test2⤵
- Process spawned unexpected child process
-
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" C:\Datop\test2.test2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeC:\Datop\test2.test3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn verqylg /tr "regsvr32.exe -s \"C:\Datop\test2.test\"" /SC ONCE /Z /ST 13:19 /ET 13:315⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Datop\test2.testMD5
687550f98527483a1c49ab185a2105ea
SHA142d0db4cdc64e1fc2e57025f031f285cf0ba45a3
SHA2566f63742c25fd3a2dae5995f182254c253003066488ef86e754f661e8ba1d76fd
SHA5122b92d4cb037c0a6dd6855819d8e44ec036bc3fac71d7c2ee537bb6dfe907888b69b97958ebaa7b102e473f76ce6d1811ce090fb1e7ab38c18d2b1c6098403fc5
-
\Datop\test2.testMD5
687550f98527483a1c49ab185a2105ea
SHA142d0db4cdc64e1fc2e57025f031f285cf0ba45a3
SHA2566f63742c25fd3a2dae5995f182254c253003066488ef86e754f661e8ba1d76fd
SHA5122b92d4cb037c0a6dd6855819d8e44ec036bc3fac71d7c2ee537bb6dfe907888b69b97958ebaa7b102e473f76ce6d1811ce090fb1e7ab38c18d2b1c6098403fc5
-
memory/640-293-0x0000000000000000-mapping.dmp
-
memory/640-297-0x0000000000B90000-0x0000000000BB1000-memory.dmpFilesize
132KB
-
memory/808-122-0x00007FF9FE780000-0x00007FF9FF86E000-memory.dmpFilesize
16.9MB
-
memory/808-121-0x00007FF9DCDF0000-0x00007FF9DCE00000-memory.dmpFilesize
64KB
-
memory/808-118-0x00007FF9DCDF0000-0x00007FF9DCE00000-memory.dmpFilesize
64KB
-
memory/808-123-0x00007FF9FC880000-0x00007FF9FE775000-memory.dmpFilesize
31.0MB
-
memory/808-117-0x00007FF9DCDF0000-0x00007FF9DCE00000-memory.dmpFilesize
64KB
-
memory/808-114-0x00007FF76A4E0000-0x00007FF76DA96000-memory.dmpFilesize
53.7MB
-
memory/808-116-0x00007FF9DCDF0000-0x00007FF9DCE00000-memory.dmpFilesize
64KB
-
memory/808-115-0x00007FF9DCDF0000-0x00007FF9DCE00000-memory.dmpFilesize
64KB
-
memory/1000-294-0x0000000000000000-mapping.dmp
-
memory/2268-282-0x0000000000000000-mapping.dmp
-
memory/2724-290-0x0000000010000000-0x0000000010021000-memory.dmpFilesize
132KB
-
memory/2724-291-0x0000000010000000-0x0000000010081000-memory.dmpFilesize
516KB
-
memory/2724-292-0x0000000003150000-0x0000000003151000-memory.dmpFilesize
4KB
-
memory/2724-288-0x0000000000000000-mapping.dmp
-
memory/3308-280-0x0000000000000000-mapping.dmp
-
memory/3736-278-0x0000000000000000-mapping.dmp