Edit tour
Windows
Analysis Report
licking.dll
Overview
General Information
Detection
Qbot
Score: | 80 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 100% |
Signatures
Found malware configuration
Yara detected Qbot
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
C2 URLs / IPs found in malware configuration
Sample uses string decryption to hide its real strings
Potentially malicious time measurement code found
Creates a DirectInput object (often for capturing keystrokes)
Uses 32bit PE files
AV process strings found (often used to terminate AV products)
Queries the volume information (name, serial number etc) of a device
Yara signature match
Sample file is different than original file name gathered from version info
One or more processes crash
PE file contains an invalid checksum
Contains functionality to read the PEB
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Checks if the current process is being debugged
Connects to several IPs in different countries
Internet Provider seen in connection with other malware
Detected potential crypto function
Contains functionality to query CPU information (cpuid)
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
Contains functionality to dynamically determine API calls
Uses Microsoft's Enhanced Cryptographic Provider
Creates a process in suspended mode (likely to inject code)
IP address seen in connection with other malware
Contains functionality for execution timing, often used to detect debuggers
Classification
- System is w10x64
- loaddll32.exe (PID: 5800 cmdline:
loaddll32. exe "C:\Us ers\user\D esktop\lic king.dll" MD5: 3B4636AE519868037940CA5C4272091B) - conhost.exe (PID: 5744 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496) - cmd.exe (PID: 5736 cmdline:
cmd.exe /C rundll32. exe "C:\Us ers\user\D esktop\lic king.dll", #1 MD5: F3BDBE3BB6F734E357235F4D5898582D) - rundll32.exe (PID: 6808 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\lick ing.dll",# 1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D) - WerFault.exe (PID: 5648 cmdline:
C:\Windows \SysWOW64\ WerFault.e xe -u -p 6 808 -s 660 MD5: 9E2B8ACAD48ECCA55C0230D63623661B) - rundll32.exe (PID: 6744 cmdline:
rundll32.e xe C:\User s\user\Des ktop\licki ng.dll,mv_ add_i MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D) - WerFault.exe (PID: 5576 cmdline:
C:\Windows \SysWOW64\ WerFault.e xe -u -p 6 744 -s 652 MD5: 9E2B8ACAD48ECCA55C0230D63623661B) - rundll32.exe (PID: 7144 cmdline:
rundll32.e xe C:\User s\user\Des ktop\licki ng.dll,mv_ add_q MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D) - rundll32.exe (PID: 5676 cmdline:
rundll32.e xe C:\User s\user\Des ktop\licki ng.dll,mv_ add_stable MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D) - WerFault.exe (PID: 3140 cmdline:
C:\Windows \SysWOW64\ WerFault.e xe -u -p 5 676 -s 656 MD5: 9E2B8ACAD48ECCA55C0230D63623661B) - rundll32.exe (PID: 5476 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\lick ing.dll",m v_add_i MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D) - WerFault.exe (PID: 5580 cmdline:
C:\Windows \SysWOW64\ WerFault.e xe -u -p 5 476 -s 652 MD5: 9E2B8ACAD48ECCA55C0230D63623661B) - rundll32.exe (PID: 6732 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\lick ing.dll",m v_add_q MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D) - rundll32.exe (PID: 5680 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\lick ing.dll",m v_add_stab le MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D) - rundll32.exe (PID: 4132 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\lick ing.dll",n ext MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D) - wermgr.exe (PID: 6928 cmdline:
C:\Windows \SysWOW64\ wermgr.exe MD5: CCF15E662ED5CE77B5FF1A7AAE305233) - rundll32.exe (PID: 624 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\lick ing.dll",m vutil_lice nse MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D) - rundll32.exe (PID: 4212 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\lick ing.dll",m vutil_conf iguration MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
- cleanup
Name | Description | Attribution | Blogpost URLs | Link |
---|---|---|---|---|
QakBot, qbotQbot | QBot is a modular information stealer also known as Qakbot or Pinkslipbot. It has been active for years since 2007. It has historically been known as a banking Trojan, meaning that it steals financial data from infected systems, and a loader using C2 servers for payload targeting and download. |
{"Bot id": "BB30", "Campaign": "1685433861", "Version": "404.1320", "C2 list": ["12.172.173.82:50001", "178.175.187.254:443", "65.95.141.84:2222", "205.237.67.69:995", "83.110.223.61:443", "193.253.100.236:2222", "27.0.48.233:443", "102.159.188.125:443", "71.38.155.217:443", "58.186.75.42:443", "76.178.148.107:2222", "70.28.50.223:2087", "114.143.176.236:443", "51.14.29.227:2222", "59.28.84.65:443", "173.88.135.179:443", "103.144.201.56:2078", "96.87.28.170:2222", "105.186.128.181:995", "176.142.207.63:443", "151.62.238.176:443", "12.172.173.82:32101", "122.186.210.254:443", "82.125.44.236:2222", "84.108.200.161:443", "76.16.49.134:443", "70.28.50.223:32100", "12.172.173.82:465", "76.170.252.153:995", "184.182.66.109:443", "78.92.133.215:443", "50.68.204.71:993", "186.75.95.6:443", "113.11.92.30:443", "70.28.50.223:3389", "98.145.23.67:443", "85.57.212.13:3389", "50.68.186.195:443", "47.205.25.170:443", "12.172.173.82:993", "12.172.173.82:22", "69.242.31.249:443", "81.101.185.146:443", "79.168.224.165:2222", "75.143.236.149:443", "14.192.241.76:995", "86.195.14.72:2222", "81.229.117.95:2222", "220.240.164.182:443", "73.29.92.128:443", "12.172.173.82:21", "96.56.197.26:2222", "75.109.111.89:443", "76.86.31.59:443", "201.244.108.183:995", "68.203.69.96:443", "124.122.47.148:443", "122.184.143.86:443", "92.186.69.229:2222", "70.28.50.223:2083", "89.129.109.27:2222", "147.147.30.126:2222", "125.99.76.102:443", "88.126.94.4:50000", "151.65.167.77:443", "86.132.236.117:443", "92.154.17.149:2222", "223.166.13.95:995", "89.36.206.69:995", "96.56.197.26:2083", "78.18.105.11:443", "82.127.153.75:2222", "90.78.147.141:2222", "82.131.141.209:443", "183.87.163.165:443", "92.9.45.20:2222", "80.6.50.34:443", "80.12.88.148:2222", "69.133.162.35:443", "172.115.17.50:443", "95.45.50.93:2222", "12.172.173.82:2087", "103.140.174.20:2222", "24.198.114.130:995", "50.68.204.71:443", "69.119.123.159:2222", "64.121.161.102:443", "2.82.8.80:443", "184.181.75.148:443", "70.112.206.5:443", "198.2.51.242:993", "2.36.64.159:2078", "79.77.142.22:2222", "84.215.202.8:443", "147.219.4.194:443", "116.74.164.81:443", "70.28.50.223:2078", "12.172.173.82:995", "77.86.98.236:443", "104.35.24.154:443", "213.64.33.61:2222", "47.149.134.231:443", "72.134.124.16:443", "47.34.30.133:443", "103.42.86.42:995", "174.4.89.3:443", "161.142.103.187:995", "78.160.146.127:443", "84.35.26.14:995", "12.172.173.82:20", "70.28.50.223:2078", "124.149.143.189:2222", "70.160.67.203:443", "186.64.67.30:443", "103.123.223.133:443", "188.28.19.84:443", "174.58.146.57:443", "94.207.104.225:443", "86.97.55.89:2222", "69.123.4.221:2222"]}
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_Qbot_1 | Yara detected Qbot | Joe Security | ||
JoeSecurity_Qbot_1 | Yara detected Qbot | Joe Security | ||
JoeSecurity_Qbot | Yara detected Qbot | Joe Security |
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
MAL_QakBot_ConfigExtraction_Feb23 | QakBot Config Extraction | kevoreilly |
| |
JoeSecurity_Qbot_1 | Yara detected Qbot | Joe Security | ||
MAL_QakBot_ConfigExtraction_Feb23 | QakBot Config Extraction | kevoreilly |
| |
JoeSecurity_Qbot_1 | Yara detected Qbot | Joe Security | ||
MAL_QakBot_ConfigExtraction_Feb23 | QakBot Config Extraction | kevoreilly |
| |
Click to see the 1 entries |
⊘No Sigma rule has matched
⊘No Snort rule has matched
Click to jump to signature section
Show All Signature Results
AV Detection |
---|
Source: | Malware Configuration Extractor: |