Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
30-09-2021 13:08
Behavioral task
behavioral1
Sample
Compensation-1093400938.xls
Resource
win7-en-20210920
General
-
Target
Compensation-1093400938.xls
-
Size
233KB
-
MD5
9952a72e006111e4a9613c5bdbd7982f
-
SHA1
a642c5d809d3b2cad15f1ca0fb56a8bce54ca086
-
SHA256
62d8610935ea360961511fa6361d82248dfdaae459bb6fab4bbc2f924627172c
-
SHA512
febd4bc0154ad140e9dcb9f5ba0464b9253b5e9df8a2c652252dba63f226d09c68f4b19d587476805591c1cb7f7041dc56d78908e03154a81ec2039b8016d6c2
Malware Config
Extracted
https://safalerp.com/J1wlINw7HtJ/siera.xml
https://godschildrenaf.org/qxwbRMzrqoWK/siera.xml
https://callgirlsandescortkenya.site/hllzvTuU/siera.xml
Extracted
qakbot
402.363
tr
1632817399
105.198.236.99:443
140.82.49.12:443
37.210.152.224:995
89.101.97.139:443
81.241.252.59:2078
27.223.92.142:995
81.250.153.227:2222
73.151.236.31:443
47.22.148.6:443
122.11.220.212:2222
120.151.47.189:443
199.27.127.129:443
216.201.162.158:443
136.232.34.70:443
76.25.142.196:443
181.118.183.94:443
120.150.218.241:995
185.250.148.74:443
95.77.223.148:443
75.66.88.33:443
45.46.53.140:2222
173.25.166.81:443
103.148.120.144:443
173.21.10.71:2222
186.18.205.199:995
71.74.12.34:443
67.165.206.193:993
47.40.196.233:2222
68.204.7.158:443
24.229.150.54:995
109.12.111.14:443
177.130.82.197:2222
72.252.201.69:443
24.55.112.61:443
24.139.72.117:443
187.156.138.172:443
71.80.168.245:443
105.157.55.133:995
82.77.137.101:995
173.234.155.233:443
75.188.35.168:443
5.238.149.235:61202
73.77.87.137:443
182.176.112.182:443
96.37.113.36:993
162.244.227.34:443
92.59.35.196:2222
196.218.227.241:995
68.207.102.78:443
2.188.27.77:443
189.210.115.207:443
181.163.96.53:443
75.107.26.196:465
185.250.148.74:2222
68.186.192.69:443
Signatures
-
Process spawned unexpected child process 3 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
regsvr32.exeregsvr32.exeregsvr32.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 3008 2428 regsvr32.exe EXCEL.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 2464 2428 regsvr32.exe EXCEL.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 1176 2428 regsvr32.exe EXCEL.EXE -
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 2044 regsvr32.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 2428 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
regsvr32.exepid process 2044 regsvr32.exe 2044 regsvr32.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
regsvr32.exepid process 2044 regsvr32.exe -
Suspicious use of SetWindowsHookEx 14 IoCs
Processes:
EXCEL.EXEpid process 2428 EXCEL.EXE 2428 EXCEL.EXE 2428 EXCEL.EXE 2428 EXCEL.EXE 2428 EXCEL.EXE 2428 EXCEL.EXE 2428 EXCEL.EXE 2428 EXCEL.EXE 2428 EXCEL.EXE 2428 EXCEL.EXE 2428 EXCEL.EXE 2428 EXCEL.EXE 2428 EXCEL.EXE 2428 EXCEL.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
EXCEL.EXEregsvr32.exeregsvr32.exeexplorer.exedescription pid process target process PID 2428 wrote to memory of 3008 2428 EXCEL.EXE regsvr32.exe PID 2428 wrote to memory of 3008 2428 EXCEL.EXE regsvr32.exe PID 2428 wrote to memory of 2464 2428 EXCEL.EXE regsvr32.exe PID 2428 wrote to memory of 2464 2428 EXCEL.EXE regsvr32.exe PID 2428 wrote to memory of 1176 2428 EXCEL.EXE regsvr32.exe PID 2428 wrote to memory of 1176 2428 EXCEL.EXE regsvr32.exe PID 1176 wrote to memory of 2044 1176 regsvr32.exe regsvr32.exe PID 1176 wrote to memory of 2044 1176 regsvr32.exe regsvr32.exe PID 1176 wrote to memory of 2044 1176 regsvr32.exe regsvr32.exe PID 2044 wrote to memory of 1804 2044 regsvr32.exe explorer.exe PID 2044 wrote to memory of 1804 2044 regsvr32.exe explorer.exe PID 2044 wrote to memory of 1804 2044 regsvr32.exe explorer.exe PID 2044 wrote to memory of 1804 2044 regsvr32.exe explorer.exe PID 2044 wrote to memory of 1804 2044 regsvr32.exe explorer.exe PID 1804 wrote to memory of 3856 1804 explorer.exe schtasks.exe PID 1804 wrote to memory of 3856 1804 explorer.exe schtasks.exe PID 1804 wrote to memory of 3856 1804 explorer.exe schtasks.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Compensation-1093400938.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" C:\Datop\test.test2⤵
- Process spawned unexpected child process
-
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" C:\Datop\test1.test2⤵
- Process spawned unexpected child process
-
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" C:\Datop\test2.test2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeC:\Datop\test2.test3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn gtzfbfdc /tr "regsvr32.exe -s \"C:\Datop\test2.test\"" /SC ONCE /Z /ST 13:11 /ET 13:235⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Datop\test2.testMD5
2827b5836bd6d608b09e676ab834e5fd
SHA1bb30b4959b886447a7558853c42a8c00080d28eb
SHA25617394b97a421b4ab7486925a3378dfc010723b1f51a993817983bcbde10872f1
SHA512962670844b0a49edd55bf583ba7a2ab7b2da2e1482659a343860b1031cae34b456116140e7031ca994eba272c69ba0bac44ebc15afe4365360eed775014f4ef0
-
\Datop\test2.testMD5
2827b5836bd6d608b09e676ab834e5fd
SHA1bb30b4959b886447a7558853c42a8c00080d28eb
SHA25617394b97a421b4ab7486925a3378dfc010723b1f51a993817983bcbde10872f1
SHA512962670844b0a49edd55bf583ba7a2ab7b2da2e1482659a343860b1031cae34b456116140e7031ca994eba272c69ba0bac44ebc15afe4365360eed775014f4ef0
-
memory/1176-281-0x0000000000000000-mapping.dmp
-
memory/1804-297-0x0000000001080000-0x00000000010A1000-memory.dmpFilesize
132KB
-
memory/1804-293-0x0000000000000000-mapping.dmp
-
memory/2044-292-0x0000000002B00000-0x0000000002B01000-memory.dmpFilesize
4KB
-
memory/2044-291-0x0000000010000000-0x0000000010082000-memory.dmpFilesize
520KB
-
memory/2044-290-0x0000000010000000-0x0000000010021000-memory.dmpFilesize
132KB
-
memory/2044-286-0x0000000000000000-mapping.dmp
-
memory/2428-123-0x00007FF978D00000-0x00007FF978D10000-memory.dmpFilesize
64KB
-
memory/2428-124-0x0000023097550000-0x0000023099445000-memory.dmpFilesize
31.0MB
-
memory/2428-122-0x00007FF999200000-0x00007FF99A2EE000-memory.dmpFilesize
16.9MB
-
memory/2428-115-0x00007FF7603E0000-0x00007FF763996000-memory.dmpFilesize
53.7MB
-
memory/2428-119-0x00007FF978D00000-0x00007FF978D10000-memory.dmpFilesize
64KB
-
memory/2428-118-0x00007FF978D00000-0x00007FF978D10000-memory.dmpFilesize
64KB
-
memory/2428-117-0x00007FF978D00000-0x00007FF978D10000-memory.dmpFilesize
64KB
-
memory/2428-116-0x00007FF978D00000-0x00007FF978D10000-memory.dmpFilesize
64KB
-
memory/2464-279-0x0000000000000000-mapping.dmp
-
memory/3008-277-0x0000000000000000-mapping.dmp
-
memory/3856-294-0x0000000000000000-mapping.dmp