Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
09-05-2022 21:29
Behavioral task
behavioral1
Sample
Cancellation-1209065499$-May5.xlsb
Resource
win7-20220414-en
General
-
Target
Cancellation-1209065499$-May5.xlsb
-
Size
65KB
-
MD5
35c57b549478f7ab03f9d212069d8566
-
SHA1
e2f79848af012270c33a686ed4fb16a906e3cd66
-
SHA256
068c3649694a07a03ecb131b889b98d5ecc2f1f35bfd11456a7a0f9e635c6182
-
SHA512
2ec2a6c2c080f45f141d91688f3d4af0aa08af4c2dcff2845bbb405f8a0e47c6cf01856eef9f0d411d7dc12bbc00e386fa4c005504904d42ca786ed36cf3b7a4
Malware Config
Extracted
Extracted
qakbot
403.683
obama182
1651756499
103.107.113.120:443
80.11.74.81:2222
177.102.2.175:32101
24.178.196.158:2222
91.177.173.10:995
181.208.248.227:443
176.67.56.94:443
202.134.152.2:2222
148.0.57.85:443
179.179.162.9:993
40.134.246.185:995
37.186.54.254:995
196.203.37.215:80
120.150.218.241:995
208.107.221.224:443
113.53.151.59:443
70.46.220.114:443
69.14.172.24:443
108.60.213.141:443
24.55.67.176:443
74.14.7.71:2222
103.246.242.202:443
172.115.177.204:2222
24.152.219.253:995
197.83.230.61:443
38.70.253.226:2222
217.165.84.177:993
118.161.34.21:443
194.36.28.102:443
32.221.224.140:995
39.33.170.57:995
81.215.196.174:443
24.139.72.117:443
113.110.253.185:995
187.207.47.198:61202
203.122.46.130:443
79.129.121.68:995
140.82.49.12:443
47.23.89.62:993
86.132.13.91:2078
75.99.168.194:443
41.228.22.180:443
148.64.96.100:443
2.50.4.57:443
67.209.195.198:443
217.128.122.65:2222
5.32.41.45:443
179.158.105.44:443
46.107.48.202:443
183.82.103.213:443
103.139.243.207:990
72.76.94.99:443
76.70.9.169:2222
93.48.80.198:995
82.152.39.39:443
2.34.12.8:443
92.132.172.197:2222
75.99.168.194:61201
89.86.33.217:443
88.228.251.169:443
120.61.3.169:443
85.246.82.244:443
89.211.182.31:2222
103.87.95.133:2222
173.174.216.62:443
86.98.208.214:2222
174.69.215.101:443
89.101.97.139:443
63.143.92.99:995
37.34.253.233:443
86.195.158.178:2222
144.202.3.39:995
144.202.2.175:995
45.63.1.12:443
149.28.238.199:443
140.82.63.183:995
144.202.3.39:443
140.82.63.183:443
45.63.1.12:995
149.28.238.199:995
144.202.2.175:443
45.76.167.26:443
45.76.167.26:995
94.36.195.102:2222
141.237.86.114:995
118.161.34.21:995
105.99.204.185:443
90.120.65.153:2078
2.50.17.128:2222
58.105.167.36:50000
189.146.78.175:443
104.34.212.7:32103
76.25.142.196:443
173.21.10.71:2222
73.151.236.31:443
67.165.206.193:993
45.46.53.140:2222
191.99.191.28:443
180.129.20.164:995
149.135.101.20:443
31.35.28.29:443
187.208.0.99:443
201.142.133.198:443
82.41.63.217:443
201.172.23.68:2222
72.252.157.172:990
190.252.242.69:443
70.51.152.61:2222
217.118.46.41:2222
72.252.157.172:995
5.193.104.246:2222
100.1.108.246:443
187.102.135.141:2222
47.156.191.217:443
2.191.231.178:443
109.12.111.14:443
41.215.151.247:995
103.157.122.130:21
96.37.113.36:993
186.64.67.8:443
67.69.166.79:2222
121.74.167.191:995
190.36.233.41:2222
68.204.7.158:443
197.94.84.67:443
106.51.48.170:50001
72.66.116.235:995
72.12.115.78:22
103.139.243.207:993
89.137.52.44:443
191.34.199.46:443
98.50.191.202:443
96.45.66.216:61202
102.182.232.3:995
84.241.8.23:32103
172.114.160.81:995
217.164.117.87:1194
45.9.20.200:443
47.23.89.62:995
187.172.191.97:443
24.43.99.75:443
103.88.226.30:443
182.191.92.203:995
39.44.144.64:995
45.241.254.110:993
39.57.56.19:995
121.7.223.59:2222
94.140.8.55:2222
172.114.160.81:443
39.49.69.112:995
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Signatures
-
Process spawned unexpected child process 4 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
regsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 3964 4640 regsvr32.exe EXCEL.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 2136 4640 regsvr32.exe EXCEL.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 4844 4640 regsvr32.exe EXCEL.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 2496 4640 regsvr32.exe EXCEL.EXE -
Downloads MZ/PE file
-
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 464 regsvr32.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 4640 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
regsvr32.exeexplorer.exepid process 464 regsvr32.exe 464 regsvr32.exe 2660 explorer.exe 2660 explorer.exe 2660 explorer.exe 2660 explorer.exe 2660 explorer.exe 2660 explorer.exe 2660 explorer.exe 2660 explorer.exe 2660 explorer.exe 2660 explorer.exe 2660 explorer.exe 2660 explorer.exe 2660 explorer.exe 2660 explorer.exe 2660 explorer.exe 2660 explorer.exe 2660 explorer.exe 2660 explorer.exe 2660 explorer.exe 2660 explorer.exe 2660 explorer.exe 2660 explorer.exe 2660 explorer.exe 2660 explorer.exe 2660 explorer.exe 2660 explorer.exe 2660 explorer.exe 2660 explorer.exe 2660 explorer.exe 2660 explorer.exe 2660 explorer.exe 2660 explorer.exe 2660 explorer.exe 2660 explorer.exe 2660 explorer.exe 2660 explorer.exe 2660 explorer.exe 2660 explorer.exe 2660 explorer.exe 2660 explorer.exe 2660 explorer.exe 2660 explorer.exe 2660 explorer.exe 2660 explorer.exe 2660 explorer.exe 2660 explorer.exe 2660 explorer.exe 2660 explorer.exe 2660 explorer.exe 2660 explorer.exe 2660 explorer.exe 2660 explorer.exe 2660 explorer.exe 2660 explorer.exe 2660 explorer.exe 2660 explorer.exe 2660 explorer.exe 2660 explorer.exe 2660 explorer.exe 2660 explorer.exe 2660 explorer.exe 2660 explorer.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
regsvr32.exepid process 464 regsvr32.exe -
Suspicious use of SetWindowsHookEx 18 IoCs
Processes:
EXCEL.EXEpid process 4640 EXCEL.EXE 4640 EXCEL.EXE 4640 EXCEL.EXE 4640 EXCEL.EXE 4640 EXCEL.EXE 4640 EXCEL.EXE 4640 EXCEL.EXE 4640 EXCEL.EXE 4640 EXCEL.EXE 4640 EXCEL.EXE 4640 EXCEL.EXE 4640 EXCEL.EXE 4640 EXCEL.EXE 4640 EXCEL.EXE 4640 EXCEL.EXE 4640 EXCEL.EXE 4640 EXCEL.EXE 4640 EXCEL.EXE -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
EXCEL.EXEregsvr32.exeregsvr32.exeexplorer.exedescription pid process target process PID 4640 wrote to memory of 3964 4640 EXCEL.EXE regsvr32.exe PID 4640 wrote to memory of 3964 4640 EXCEL.EXE regsvr32.exe PID 4640 wrote to memory of 2136 4640 EXCEL.EXE regsvr32.exe PID 4640 wrote to memory of 2136 4640 EXCEL.EXE regsvr32.exe PID 2136 wrote to memory of 464 2136 regsvr32.exe regsvr32.exe PID 2136 wrote to memory of 464 2136 regsvr32.exe regsvr32.exe PID 2136 wrote to memory of 464 2136 regsvr32.exe regsvr32.exe PID 464 wrote to memory of 2660 464 regsvr32.exe explorer.exe PID 464 wrote to memory of 2660 464 regsvr32.exe explorer.exe PID 464 wrote to memory of 2660 464 regsvr32.exe explorer.exe PID 464 wrote to memory of 2660 464 regsvr32.exe explorer.exe PID 464 wrote to memory of 2660 464 regsvr32.exe explorer.exe PID 4640 wrote to memory of 4844 4640 EXCEL.EXE regsvr32.exe PID 4640 wrote to memory of 4844 4640 EXCEL.EXE regsvr32.exe PID 4640 wrote to memory of 2496 4640 EXCEL.EXE regsvr32.exe PID 4640 wrote to memory of 2496 4640 EXCEL.EXE regsvr32.exe PID 2660 wrote to memory of 2928 2660 explorer.exe schtasks.exe PID 2660 wrote to memory of 2928 2660 explorer.exe schtasks.exe PID 2660 wrote to memory of 2928 2660 explorer.exe schtasks.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Cancellation-1209065499$-May5.xlsb"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Windows\SYSTEM32\regsvr32.exeregsvr32 /s calc2⤵
- Process spawned unexpected child process
PID:3964 -
C:\Windows\SYSTEM32\regsvr32.exeregsvr32 C:\Merto\Byrost\Veonse.OOOCCCXXX2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Windows\SysWOW64\regsvr32.exeC:\Merto\Byrost\Veonse.OOOCCCXXX3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn spjnogxbbq /tr "regsvr32.exe -s \"C:\Merto\Byrost\Veonse.OOOCCCXXX\"" /SC ONCE /Z /ST 23:32 /ET 23:445⤵
- Creates scheduled task(s)
PID:2928 -
C:\Windows\SYSTEM32\regsvr32.exeregsvr32 C:\Merto\Byrost\Veonsea.OOOCCCXXX2⤵
- Process spawned unexpected child process
PID:4844 -
C:\Windows\SYSTEM32\regsvr32.exeregsvr32 C:\Merto\Byrost\Veonseb.OOOCCCXXX2⤵
- Process spawned unexpected child process
PID:2496
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Merto\Byrost\Veonse.OOOCCCXXXFilesize
855KB
MD5bbe5b27486fb966ad23374a5b60a0c9f
SHA15392401866d1f4d06e55fa1b3afca4e4c9f03e39
SHA2565285c1daefd96960aaacbd377ec52edf419104e672ce6ef12258ce092a04e8b5
SHA5122495d503bbc36dc25f1437b64316f4b8edd580ec672af3d76e7a66b10c13910688b4d3a59dcab18ee50242b104835995c2aa93ce5d9cc6985d0ba60031be39e6
-
C:\Merto\Byrost\Veonse.OOOCCCXXXFilesize
855KB
MD5bbe5b27486fb966ad23374a5b60a0c9f
SHA15392401866d1f4d06e55fa1b3afca4e4c9f03e39
SHA2565285c1daefd96960aaacbd377ec52edf419104e672ce6ef12258ce092a04e8b5
SHA5122495d503bbc36dc25f1437b64316f4b8edd580ec672af3d76e7a66b10c13910688b4d3a59dcab18ee50242b104835995c2aa93ce5d9cc6985d0ba60031be39e6
-
memory/464-144-0x0000000002D00000-0x0000000002D22000-memory.dmpFilesize
136KB
-
memory/464-143-0x0000000000ED0000-0x0000000000EF2000-memory.dmpFilesize
136KB
-
memory/464-142-0x0000000002D00000-0x0000000002D22000-memory.dmpFilesize
136KB
-
memory/464-140-0x0000000000000000-mapping.dmp
-
memory/2136-138-0x0000000000000000-mapping.dmp
-
memory/2496-148-0x0000000000000000-mapping.dmp
-
memory/2660-145-0x0000000000000000-mapping.dmp
-
memory/2660-147-0x0000000000D20000-0x0000000000D42000-memory.dmpFilesize
136KB
-
memory/2928-149-0x0000000000000000-mapping.dmp
-
memory/3964-137-0x0000000000000000-mapping.dmp
-
memory/4640-136-0x00007FFABCEA0000-0x00007FFABCEB0000-memory.dmpFilesize
64KB
-
memory/4640-135-0x00007FFABCEA0000-0x00007FFABCEB0000-memory.dmpFilesize
64KB
-
memory/4640-134-0x00007FFABF110000-0x00007FFABF120000-memory.dmpFilesize
64KB
-
memory/4640-133-0x00007FFABF110000-0x00007FFABF120000-memory.dmpFilesize
64KB
-
memory/4640-132-0x00007FFABF110000-0x00007FFABF120000-memory.dmpFilesize
64KB
-
memory/4640-130-0x00007FFABF110000-0x00007FFABF120000-memory.dmpFilesize
64KB
-
memory/4640-131-0x00007FFABF110000-0x00007FFABF120000-memory.dmpFilesize
64KB
-
memory/4844-146-0x0000000000000000-mapping.dmp