Analysis
-
max time kernel
3s -
max time network
110s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
08-05-2022 22:05
Static task
static1
Behavioral task
behavioral1
Sample
ApplicationReject-1892714497.xlsb
Resource
win7-20220414-en
General
-
Target
ApplicationReject-1892714497.xlsb
-
Size
1.1MB
-
MD5
c794fd47792d403b39b380bcb2cf3e73
-
SHA1
b930706641ef2bf78fd5d86e1b014efb24398258
-
SHA256
3bd06b8d943a32fc42410049648d349bfb959cbe7d7ecda94da24d92f69292b0
-
SHA512
7a912d258b28080c8d7c0ce8598e5c312c1c1b845045ac38aa1f76ce6620bdea927b64a98a6b9aef75d7149ea9ec806efd4779f64980dacc08beef647e1ae544
Malware Config
Extracted
qakbot
403.573
obama180
1650959141
2.50.4.57:443
85.246.82.244:443
121.7.223.59:2222
197.161.137.67:993
38.70.253.226:2222
47.23.89.62:993
172.114.160.81:443
75.99.168.194:443
82.152.39.39:443
108.60.213.141:443
148.64.96.100:443
167.86.191.84:443
187.207.47.198:61202
103.107.113.120:443
203.122.46.130:443
106.51.48.170:50001
47.23.89.62:995
140.82.49.12:443
102.65.38.74:443
103.246.242.202:443
67.209.195.198:443
75.99.168.194:61201
89.86.33.217:443
80.11.74.81:2222
172.115.177.204:2222
31.215.184.145:2222
174.95.174.163:2222
190.252.242.69:443
32.221.224.140:995
208.107.221.224:443
173.174.216.62:443
71.13.93.154:2222
149.28.238.199:995
45.9.20.200:443
149.28.238.199:443
144.202.3.39:443
140.82.63.183:443
45.63.1.12:995
45.63.1.12:443
140.82.63.183:995
45.76.167.26:443
45.76.167.26:995
144.202.2.175:443
144.202.2.175:995
144.202.3.39:995
70.46.220.114:443
103.87.95.133:2222
187.58.79.229:993
39.44.144.64:995
79.167.206.144:995
31.215.71.174:443
85.96.46.255:443
92.132.172.197:2222
172.114.160.81:995
37.186.54.254:995
174.69.215.101:443
91.177.173.10:995
197.89.17.104:443
24.139.72.117:443
120.150.218.241:995
217.128.122.65:2222
79.129.121.68:995
31.215.184.145:1194
24.178.196.158:2222
217.164.76.203:2078
148.0.57.85:443
83.110.93.205:443
37.210.160.58:2222
86.98.208.214:2222
118.161.9.45:995
202.134.152.2:2222
104.34.212.7:32103
24.152.219.253:995
176.67.56.94:443
183.88.61.229:2222
76.25.142.196:443
175.145.235.37:443
74.14.7.71:2222
103.88.226.30:443
197.94.84.67:443
182.191.92.203:995
118.161.9.45:443
86.98.78.42:993
117.248.109.38:21
191.99.191.28:443
173.21.10.71:2222
190.74.239.37:2222
121.74.167.191:995
39.41.217.75:995
101.51.79.185:443
180.129.20.164:995
47.156.191.217:443
73.151.236.31:443
67.165.206.193:993
41.38.167.179:995
187.250.114.15:443
189.146.73.62:443
187.208.137.144:443
72.76.94.99:443
72.252.157.172:995
37.34.253.233:443
187.251.132.144:22
72.252.157.172:990
100.1.108.246:443
72.12.115.71:22
101.50.120.166:995
201.172.23.68:2222
179.99.49.37:32101
40.134.246.185:995
24.55.67.176:443
179.158.105.44:443
187.52.231.156:443
109.12.111.14:443
89.101.97.139:443
102.140.71.74:443
187.102.135.142:2222
70.51.153.227:2222
45.46.53.140:2222
31.51.7.55:2078
41.84.246.159:995
41.107.165.110:443
120.61.3.50:443
86.195.158.178:2222
84.241.8.23:32103
5.32.41.45:443
196.203.37.215:80
39.52.93.195:995
181.208.248.227:443
39.49.42.164:995
177.27.225.16:32101
87.70.74.86:443
210.246.4.69:995
89.137.52.44:443
102.182.232.3:995
187.172.250.117:443
191.112.22.196:443
78.96.235.245:443
189.27.113.73:443
41.230.62.211:993
83.79.122.192:2222
63.143.92.99:995
93.48.80.198:995
94.36.195.250:2222
111.125.245.118:995
85.104.122.231:443
109.228.220.196:443
140.0.79.30:2222
67.69.166.79:2222
116.253.204.85:2222
90.120.65.153:2078
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Signatures
-
Process spawned unexpected child process 4 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
Regsvr32.exeRegsvr32.exeRegsvr32.exeRegsvr32.exedescription pid pid_target process target process Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 1568 1948 Regsvr32.exe EXCEL.EXE Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 1656 1948 Regsvr32.exe EXCEL.EXE Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 684 1948 Regsvr32.exe EXCEL.EXE Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 852 1948 Regsvr32.exe EXCEL.EXE -
Downloads MZ/PE file
-
Processes:
EXCEL.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\ApplicationReject-1892714497.xlsb1⤵
- Modifies Internet Explorer settings
-
C:\Windows\SysWOW64\Regsvr32.exeRegsvr32 /s calc2⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\Regsvr32.exeRegsvr32 C:\Rujiky\Ubada\Vertua.ooccxx2⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\Regsvr32.exeRegsvr32 C:\Rujiky\Ubada\Vertub.ooccxx2⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
-
C:\Windows\SysWOW64\Regsvr32.exeRegsvr32 C:\Rujiky\Ubada\Vertu.ooccxx2⤵
- Process spawned unexpected child process
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Rujiky\Ubada\Vertub.ooccxxFilesize
962KB
MD5e6272be3bd2adad70667461fe40e4850
SHA126cc1e20c2cf9241c47e4ec7af27ea19af0ec386
SHA25660e51e35460c48b66e13bce4991e7ac1400406514bc752aadded0f6bc91806c5
SHA5121a18de08fb9f27465d2cfa47ae30446c11997178e961187e129ee89466b76164a9e02c9abfc2f0f18cc3e82613fdbd3a63fc85168b572ff1869c354a42705056
-
\Rujiky\Ubada\Vertub.ooccxxFilesize
962KB
MD5e6272be3bd2adad70667461fe40e4850
SHA126cc1e20c2cf9241c47e4ec7af27ea19af0ec386
SHA25660e51e35460c48b66e13bce4991e7ac1400406514bc752aadded0f6bc91806c5
SHA5121a18de08fb9f27465d2cfa47ae30446c11997178e961187e129ee89466b76164a9e02c9abfc2f0f18cc3e82613fdbd3a63fc85168b572ff1869c354a42705056
-
memory/684-69-0x0000000010000000-0x000000001008F000-memory.dmpFilesize
572KB
-
memory/684-65-0x0000000000000000-mapping.dmp
-
memory/852-61-0x0000000000000000-mapping.dmp
-
memory/1380-75-0x0000000000000000-mapping.dmp
-
memory/1380-77-0x000000006C441000-0x000000006C443000-memory.dmpFilesize
8KB
-
memory/1380-78-0x0000000000080000-0x000000000010F000-memory.dmpFilesize
572KB
-
memory/1568-59-0x0000000000000000-mapping.dmp
-
memory/1656-63-0x0000000000000000-mapping.dmp
-
memory/1948-54-0x000000002F731000-0x000000002F734000-memory.dmpFilesize
12KB
-
memory/1948-58-0x00000000754A1000-0x00000000754A3000-memory.dmpFilesize
8KB
-
memory/1948-57-0x000000007252D000-0x0000000072538000-memory.dmpFilesize
44KB
-
memory/1948-56-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1948-55-0x0000000071541000-0x0000000071543000-memory.dmpFilesize
8KB