Analysis
-
max time kernel
150s -
max time network
30s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
16-03-2023 15:36
Static task
static1
Behavioral task
behavioral1
Sample
5fa99dca32f66c0edd6d5f86da8be806a3217606ba0bf0ec0c559cb1f0632b69.xll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
5fa99dca32f66c0edd6d5f86da8be806a3217606ba0bf0ec0c559cb1f0632b69.xll
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
e7c5a14367c05db6df9a4804137125064a7d6699940f1544586c1d036c350598.xll
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
e7c5a14367c05db6df9a4804137125064a7d6699940f1544586c1d036c350598.xll
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
2020a8611379d8236343da65155aab32ec37f597317560762625f9536c579474.xll
Resource
win7-20230220-en
General
-
Target
5fa99dca32f66c0edd6d5f86da8be806a3217606ba0bf0ec0c559cb1f0632b69.xll
-
Size
589KB
-
MD5
aa6102c10a685f388d5ae16c5f146ecf
-
SHA1
b5943232258b93f8ff31846d62606ae4add162ce
-
SHA256
5fa99dca32f66c0edd6d5f86da8be806a3217606ba0bf0ec0c559cb1f0632b69
-
SHA512
c138ff44f7461c53f7d5b932a017b35bf8c13c4752ef5e5648f968070e2b510ca6607a1efa9b5696a31a2a736e3148904a32d4ea91eb34a8d47314c2fe0839bd
-
SSDEEP
6144:8cTaT6oGCNIamrNSYVnttpONtX7EmG2dOdQRG8l/dmMF7VndLmmmmmmm644tkw95:fVpSIm3OdQwgvpVndf42HXDiuJTMw4
Malware Config
Extracted
qakbot
404.266
obama242
1678805546
92.239.81.124:443
176.202.46.81:443
2.49.58.47:2222
86.225.214.138:2222
74.66.134.24:443
213.31.90.183:2222
12.172.173.82:50001
202.187.87.178:995
70.53.96.223:995
92.154.45.81:2222
186.64.67.54:443
81.158.112.20:2222
190.191.35.122:443
68.173.170.110:8443
12.172.173.82:993
98.145.23.67:443
12.172.173.82:22
37.186.55.60:2222
84.216.198.124:6881
73.161.176.218:443
94.30.98.134:32100
78.196.246.32:443
12.172.173.82:995
88.122.133.88:32100
173.18.126.3:443
201.244.108.183:995
24.178.201.230:2222
76.27.40.189:443
151.65.134.135:443
197.14.148.149:443
197.244.108.123:443
201.137.185.109:443
86.130.9.213:2222
190.75.139.66:2222
213.67.255.57:2222
90.104.22.28:2222
189.222.53.217:443
122.184.143.84:443
92.159.173.52:2222
70.121.198.103:2078
91.68.227.219:443
86.236.114.212:2222
80.12.88.148:2222
178.175.187.254:443
73.36.196.11:443
47.196.225.236:443
65.95.49.237:2222
12.172.173.82:2087
184.176.35.223:2222
186.48.181.17:995
2.14.105.160:2222
208.180.17.32:2222
190.218.125.145:443
109.11.175.42:2222
23.251.92.171:2222
196.70.212.80:443
75.156.125.215:995
184.189.41.80:443
31.48.18.52:443
103.12.133.134:2222
70.51.152.61:2222
47.203.229.168:443
104.35.24.154:443
190.28.116.106:443
92.154.17.149:2222
103.169.83.89:443
86.169.103.3:443
92.27.86.48:2222
92.1.170.110:995
183.87.163.165:443
85.241.180.94:443
76.170.252.153:995
92.20.204.198:2222
103.141.50.102:995
81.229.117.95:2222
50.68.204.71:995
47.34.30.133:443
173.178.151.233:443
47.16.77.194:2222
83.92.85.93:443
76.80.180.154:995
67.70.23.222:2222
24.117.237.157:443
35.143.97.145:995
87.202.101.164:50000
64.237.245.195:443
103.231.216.238:443
74.93.148.97:995
103.71.21.107:443
71.65.145.108:443
12.172.173.82:465
72.80.7.6:50003
184.153.132.82:443
86.178.33.20:2222
94.200.183.66:2222
70.55.187.152:2222
98.159.33.25:443
136.35.241.159:443
24.187.145.201:2222
72.88.245.71:443
65.94.87.200:2222
184.176.110.61:61202
49.245.82.178:2222
12.172.173.82:32101
46.10.198.134:443
84.35.26.14:995
103.252.7.231:443
187.199.103.21:32103
139.5.239.14:443
202.142.98.62:443
27.109.19.90:2078
86.190.223.11:2222
75.143.236.149:443
50.68.204.71:993
91.169.12.198:32100
88.126.94.4:50000
24.239.69.244:443
12.172.173.82:21
174.104.184.149:443
116.72.250.18:443
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
wermgr.exedescription pid pid_target process target process Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 1868 1136 wermgr.exe EXCEL.EXE -
Loads dropped DLL 2 IoCs
Processes:
EXCEL.EXEpid process 1136 EXCEL.EXE 1136 EXCEL.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Processes:
EXCEL.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1136 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
EXCEL.EXEwermgr.exepid process 1136 EXCEL.EXE 1868 wermgr.exe 1868 wermgr.exe 1868 wermgr.exe 1868 wermgr.exe 1868 wermgr.exe 1868 wermgr.exe 1868 wermgr.exe 1868 wermgr.exe 1868 wermgr.exe 1868 wermgr.exe 1868 wermgr.exe 1868 wermgr.exe 1868 wermgr.exe 1868 wermgr.exe 1868 wermgr.exe 1868 wermgr.exe 1868 wermgr.exe 1868 wermgr.exe 1868 wermgr.exe 1868 wermgr.exe 1868 wermgr.exe 1868 wermgr.exe 1868 wermgr.exe 1868 wermgr.exe 1868 wermgr.exe 1868 wermgr.exe 1868 wermgr.exe 1868 wermgr.exe 1868 wermgr.exe 1868 wermgr.exe 1868 wermgr.exe 1868 wermgr.exe 1868 wermgr.exe 1868 wermgr.exe 1868 wermgr.exe 1868 wermgr.exe 1868 wermgr.exe 1868 wermgr.exe 1868 wermgr.exe 1868 wermgr.exe 1868 wermgr.exe 1868 wermgr.exe 1868 wermgr.exe 1868 wermgr.exe 1868 wermgr.exe 1868 wermgr.exe 1868 wermgr.exe 1868 wermgr.exe 1868 wermgr.exe 1868 wermgr.exe 1868 wermgr.exe 1868 wermgr.exe 1868 wermgr.exe 1868 wermgr.exe 1868 wermgr.exe 1868 wermgr.exe 1868 wermgr.exe 1868 wermgr.exe 1868 wermgr.exe 1868 wermgr.exe 1868 wermgr.exe 1868 wermgr.exe 1868 wermgr.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
EXCEL.EXEpid process 1136 EXCEL.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
EXCEL.EXEpid process 1136 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 1136 EXCEL.EXE 1136 EXCEL.EXE 1136 EXCEL.EXE -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
EXCEL.EXEdescription pid process target process PID 1136 wrote to memory of 1868 1136 EXCEL.EXE wermgr.exe PID 1136 wrote to memory of 1868 1136 EXCEL.EXE wermgr.exe PID 1136 wrote to memory of 1868 1136 EXCEL.EXE wermgr.exe PID 1136 wrote to memory of 1868 1136 EXCEL.EXE wermgr.exe PID 1136 wrote to memory of 1868 1136 EXCEL.EXE wermgr.exe PID 1136 wrote to memory of 1868 1136 EXCEL.EXE wermgr.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\5fa99dca32f66c0edd6d5f86da8be806a3217606ba0bf0ec0c559cb1f0632b69.xll1⤵
- Loads dropped DLL
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe2⤵
- Process spawned unexpected child process
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\5fa99dca32f66c0edd6d5f86da8be806a3217606ba0bf0ec0c559cb1f0632b69.xllFilesize
589KB
MD5aa6102c10a685f388d5ae16c5f146ecf
SHA1b5943232258b93f8ff31846d62606ae4add162ce
SHA2565fa99dca32f66c0edd6d5f86da8be806a3217606ba0bf0ec0c559cb1f0632b69
SHA512c138ff44f7461c53f7d5b932a017b35bf8c13c4752ef5e5648f968070e2b510ca6607a1efa9b5696a31a2a736e3148904a32d4ea91eb34a8d47314c2fe0839bd
-
\Users\Admin\AppData\Local\Temp\5fa99dca32f66c0edd6d5f86da8be806a3217606ba0bf0ec0c559cb1f0632b69.xllFilesize
589KB
MD5aa6102c10a685f388d5ae16c5f146ecf
SHA1b5943232258b93f8ff31846d62606ae4add162ce
SHA2565fa99dca32f66c0edd6d5f86da8be806a3217606ba0bf0ec0c559cb1f0632b69
SHA512c138ff44f7461c53f7d5b932a017b35bf8c13c4752ef5e5648f968070e2b510ca6607a1efa9b5696a31a2a736e3148904a32d4ea91eb34a8d47314c2fe0839bd
-
memory/1136-61-0x0000000002FF0000-0x0000000003013000-memory.dmpFilesize
140KB
-
memory/1136-57-0x0000000002FF0000-0x0000000003013000-memory.dmpFilesize
140KB
-
memory/1136-58-0x0000000002FB0000-0x0000000002FE1000-memory.dmpFilesize
196KB
-
memory/1136-59-0x0000000002FF0000-0x0000000003013000-memory.dmpFilesize
140KB
-
memory/1136-54-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1868-60-0x00000000000B0000-0x00000000000B2000-memory.dmpFilesize
8KB
-
memory/1868-62-0x0000000000080000-0x00000000000A3000-memory.dmpFilesize
140KB
-
memory/1868-63-0x0000000000080000-0x00000000000A3000-memory.dmpFilesize
140KB
-
memory/1868-64-0x0000000000080000-0x00000000000A3000-memory.dmpFilesize
140KB
-
memory/1868-65-0x0000000000080000-0x00000000000A3000-memory.dmpFilesize
140KB
-
memory/1868-66-0x0000000000080000-0x00000000000A3000-memory.dmpFilesize
140KB
-
memory/1868-67-0x0000000000080000-0x00000000000A3000-memory.dmpFilesize
140KB
-
memory/1868-69-0x0000000000080000-0x00000000000A3000-memory.dmpFilesize
140KB