Play interactive tour
Edit tourWindows Analysis Report #Qbot downloader
Overview
General Information
| Sample Name: | #Qbot downloader (renamed file extension from none to xls) |
| Analysis ID: | 491755 |
| MD5: | b4b3a2223765ac84c9b1b05dbf7c6503 |
| SHA1: | 57bc35cb0c7a9ac6e7fcb5dea5c211fe5eda5fe0 |
| SHA256: | 3982ae3e61a6ba86d61bd8f017f6238cc9afeb08b785010d686716e8415b6a36 |
| Tags: | downloaderQbotxlsx |
| Infos: | |
Most interesting Screenshot:  | |
Detection
Hidden Macro 4.0 Qbot
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Yara detected Qbot
Document exploit detected (drops PE files)
Sigma detected: Schedule system process
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Maps a DLL or memory area into another process
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Office process drops PE file
Writes to foreign memory regions
Uses cmd line tools excessively to alter registry or file data
Sigma detected: Microsoft Office Product Spawning Windows Shell
Allocates memory in foreign processes
Injects code into the Windows Explorer (explorer.exe)
PE file has nameless sections
Sigma detected: Regsvr32 Command Line Without DLL
Machine Learning detection for dropped file
Drops PE files to the user root directory
Document exploit detected (process start blacklist hit)
Document exploit detected (UrlDownloadToFile)
Yara detected hidden Macro 4.0 in Excel
Uses schtasks.exe or at.exe to add and modify task schedules
Queries the volume information (name, serial number etc) of a device
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
PE file contains sections with non-standard names
Detected potential crypto function
Document contains an embedded VBA macro which executes code when the document is opened / closed
Sample execution stops while process was sleeping (likely an evasion)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to call native functions
Contains functionality to dynamically determine API calls
Found dropped PE file which has not been started or loaded
Downloads executable code via HTTP
Drops files with a non-matching file extension (content does not match file extension)
PE file does not import any functions
Potential document exploit detected (unknown TCP traffic)
Drops PE files
Contains functionality to read the PEB
Uses a known web browser user agent for HTTP communication
Uses reg.exe to modify the Windows registry
Document contains embedded VBA macros
Drops PE files to the user directory
Dropped file seen in connection with other malware
Potential document exploit detected (performs HTTP gets)
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Creates a process in suspended mode (likely to inject code)
Classification
Process Tree |
|---|
|
Malware Configuration |
|---|
| No configs have been found |
|---|
Yara Overview |
|---|
Initial Sample |
|---|
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_HiddenMacro | Yara detected hidden Macro 4.0 in Excel | Joe Security |
Memory Dumps |
|---|
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_Qbot_1 | Yara detected Qbot | Joe Security | ||
| JoeSecurity_Qbot_1 | Yara detected Qbot | Joe Security | ||
| JoeSecurity_Qbot_1 | Yara detected Qbot | Joe Security | ||
| JoeSecurity_Qbot_1 | Yara detected Qbot | Joe Security | ||
| JoeSecurity_Qbot_1 | Yara detected Qbot | Joe Security | ||
| Click to see the 4 entries | ||||
Unpacked PEs |
|---|
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_Qbot_1 | Yara detected Qbot | Joe Security | ||
| JoeSecurity_Qbot_1 | Yara detected Qbot | Joe Security | ||
| JoeSecurity_Qbot_1 | Yara detected Qbot | Joe Security | ||
| JoeSecurity_Qbot_1 | Yara detected Qbot | Joe Security | ||
| JoeSecurity_Qbot_1 | Yara detected Qbot | Joe Security | ||
| Click to see the 10 entries | ||||
Sigma Overview |
|---|
System Summary: |   |
|---|
| Sigma detected: Microsoft Office Product Spawning Windows Shell | Show sources | ||
| Source: | Author: Michael Haag, Florian Roth, Markus Neis, Elastic, FPT.EagleEye Team: | ||
| Sigma detected: Regsvr32 Command Line Without DLL | Show sources | ||
| Source: | Author: Florian Roth: | ||
Persistence and Installation Behavior: | |
|---|
| Sigma detected: Schedule system process | Show sources | ||
| Source: | Author: Joe Security: | ||
Jbx Signature Overview |
|---|
Click to jump to signature section
Show All Signature Results
AV Detection: | |
|---|
| Machine Learning detection for dropped file | Show sources | ||
| Source: | Joe Sandbox ML: | ||
| Source: | Joe Sandbox ML: | ||
| Source: | File opened: | ||
| Source: | Binary string: | ||
| Source: | Code function: | ||
| Source: | Code function: | ||
| Source: | Code function: | ||
| Source: | Code function: | ||
| Source: | Code function: | ||
Software Vulnerabilities: | |
|---|
| Document exploit detected (drops PE files) | Show sources | ||
| Source: | File created: | Jump to dropped file | ||
| Document exploit detected (process start blacklist hit) | Show sources | ||
| Source: | Process created: | ||
| Document exploit detected (UrlDownloadToFile) | Show sources | ||
| Source: | Section loaded: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | HTTP traffic detected: | ||