Edit tour
Windows
Analysis Report
A649.dll
Overview
General Information
Detection
Qbot
Score: | 88 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 100% |
Signatures
Found malware configuration
Yara detected Qbot
Antivirus / Scanner detection for submitted sample
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
C2 URLs / IPs found in malware configuration
Sample uses string decryption to hide its real strings
Potentially malicious time measurement code found
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
One or more processes crash
May sleep (evasive loops) to hinder dynamic analysis
Creates files inside the system directory
Internet Provider seen in connection with other malware
Detected potential crypto function
Contains functionality to query CPU information (cpuid)
Sample execution stops while process was sleeping (likely an evasion)
JA3 SSL client fingerprint seen in connection with other malware
Contains functionality to dynamically determine API calls
IP address seen in connection with other malware
Contains functionality for execution timing, often used to detect debuggers
Creates a DirectInput object (often for capturing keystrokes)
AV process strings found (often used to terminate AV products)
Sample file is different than original file name gathered from version info
PE file contains an invalid checksum
Tries to load missing DLLs
Contains functionality to read the PEB
Uses a known web browser user agent for HTTP communication
Checks if the current process is being debugged
Connects to several IPs in different countries
Uses Microsoft's Enhanced Cryptographic Provider
Creates a process in suspended mode (likely to inject code)
Classification
- System is w10x64
- loaddll32.exe (PID: 7028 cmdline:
loaddll32. exe "C:\Us ers\user\D esktop\A64 9.dll" MD5: 3B4636AE519868037940CA5C4272091B) - conhost.exe (PID: 2872 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496) - cmd.exe (PID: 3220 cmdline:
cmd.exe /C rundll32. exe "C:\Us ers\user\D esktop\A64 9.dll",#1 MD5: F3BDBE3BB6F734E357235F4D5898582D) - rundll32.exe (PID: 2756 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\A649 .dll",#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D) - WerFault.exe (PID: 5732 cmdline:
C:\Windows \SysWOW64\ WerFault.e xe -u -p 2 756 -s 664 MD5: 9E2B8ACAD48ECCA55C0230D63623661B) - rundll32.exe (PID: 3828 cmdline:
rundll32.e xe C:\User s\user\Des ktop\A649. dll,mv_add _i MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D) - WerFault.exe (PID: 4008 cmdline:
C:\Windows \SysWOW64\ WerFault.e xe -u -p 3 828 -s 656 MD5: 9E2B8ACAD48ECCA55C0230D63623661B) - rundll32.exe (PID: 1196 cmdline:
rundll32.e xe C:\User s\user\Des ktop\A649. dll,mv_add _q MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D) - rundll32.exe (PID: 3980 cmdline:
rundll32.e xe C:\User s\user\Des ktop\A649. dll,mv_add _stable MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D) - WerFault.exe (PID: 5920 cmdline:
C:\Windows \SysWOW64\ WerFault.e xe -u -p 3 980 -s 652 MD5: 9E2B8ACAD48ECCA55C0230D63623661B) - rundll32.exe (PID: 2252 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\A649 .dll",mv_a dd_i MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D) - WerFault.exe (PID: 7224 cmdline:
C:\Windows \SysWOW64\ WerFault.e xe -u -p 2 252 -s 652 MD5: 9E2B8ACAD48ECCA55C0230D63623661B) - rundll32.exe (PID: 3628 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\A649 .dll",mv_a dd_q MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D) - rundll32.exe (PID: 6000 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\A649 .dll",mv_a dd_stable MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D) - rundll32.exe (PID: 5088 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\A649 .dll",next MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D) - wermgr.exe (PID: 7340 cmdline:
C:\Windows \SysWOW64\ wermgr.exe MD5: CCF15E662ED5CE77B5FF1A7AAE305233) - rundll32.exe (PID: 2704 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\A649 .dll",mvut il_license MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D) - rundll32.exe (PID: 7180 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\A649 .dll",mvut il_configu ration MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
- cleanup
Name | Description | Attribution | Blogpost URLs | Link |
---|---|---|---|---|
QakBot, qbotQbot | QBot is a modular information stealer also known as Qakbot or Pinkslipbot. It has been active for years since 2007. It has historically been known as a banking Trojan, meaning that it steals financial data from infected systems, and a loader using C2 servers for payload targeting and download. |
{"Bot id": "BB30", "Campaign": "1685433861", "Version": "404.1320", "C2 list": ["12.172.173.82:50001", "178.175.187.254:443", "65.95.141.84:2222", "205.237.67.69:995", "83.110.223.61:443", "193.253.100.236:2222", "27.0.48.233:443", "102.159.188.125:443", "71.38.155.217:443", "58.186.75.42:443", "76.178.148.107:2222", "70.28.50.223:2087", "114.143.176.236:443", "51.14.29.227:2222", "59.28.84.65:443", "173.88.135.179:443", "103.144.201.56:2078", "96.87.28.170:2222", "105.186.128.181:995", "176.142.207.63:443", "151.62.238.176:443", "12.172.173.82:32101", "122.186.210.254:443", "82.125.44.236:2222", "84.108.200.161:443", "76.16.49.134:443", "70.28.50.223:32100", "12.172.173.82:465", "76.170.252.153:995", "184.182.66.109:443", "78.92.133.215:443", "50.68.204.71:993", "186.75.95.6:443", "113.11.92.30:443", "70.28.50.223:3389", "98.145.23.67:443", "85.57.212.13:3389", "50.68.186.195:443", "47.205.25.170:443", "12.172.173.82:993", "12.172.173.82:22", "69.242.31.249:443", "81.101.185.146:443", "79.168.224.165:2222", "75.143.236.149:443", "14.192.241.76:995", "86.195.14.72:2222", "81.229.117.95:2222", "220.240.164.182:443", "73.29.92.128:443", "12.172.173.82:21", "96.56.197.26:2222", "75.109.111.89:443", "76.86.31.59:443", "201.244.108.183:995", "68.203.69.96:443", "124.122.47.148:443", "122.184.143.86:443", "92.186.69.229:2222", "70.28.50.223:2083", "89.129.109.27:2222", "147.147.30.126:2222", "125.99.76.102:443", "88.126.94.4:50000", "151.65.167.77:443", "86.132.236.117:443", "92.154.17.149:2222", "223.166.13.95:995", "89.36.206.69:995", "96.56.197.26:2083", "78.18.105.11:443", "82.127.153.75:2222", "90.78.147.141:2222", "82.131.141.209:443", "183.87.163.165:443", "92.9.45.20:2222", "80.6.50.34:443", "80.12.88.148:2222", "69.133.162.35:443", "172.115.17.50:443", "95.45.50.93:2222", "12.172.173.82:2087", "103.140.174.20:2222", "24.198.114.130:995", "50.68.204.71:443", "69.119.123.159:2222", "64.121.161.102:443", "2.82.8.80:443", "184.181.75.148:443", "70.112.206.5:443", "198.2.51.242:993", "2.36.64.159:2078", "79.77.142.22:2222", "84.215.202.8:443", "147.219.4.194:443", "116.74.164.81:443", "70.28.50.223:2078", "12.172.173.82:995", "77.86.98.236:443", "104.35.24.154:443", "213.64.33.61:2222", "47.149.134.231:443", "72.134.124.16:443", "47.34.30.133:443", "103.42.86.42:995", "174.4.89.3:443", "161.142.103.187:995", "78.160.146.127:443", "84.35.26.14:995", "12.172.173.82:20", "70.28.50.223:2078", "124.149.143.189:2222", "70.160.67.203:443", "186.64.67.30:443", "103.123.223.133:443", "188.28.19.84:443", "174.58.146.57:443", "94.207.104.225:443", "86.97.55.89:2222", "69.123.4.221:2222"]}
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_Qbot_1 | Yara detected Qbot | Joe Security | ||
JoeSecurity_Qbot_1 | Yara detected Qbot | Joe Security | ||
JoeSecurity_Qbot | Yara detected Qbot | Joe Security |
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
MAL_QakBot_ConfigExtraction_Feb23 | QakBot Config Extraction | kevoreilly |
| |
JoeSecurity_Qbot_1 | Yara detected Qbot | Joe Security | ||
MAL_QakBot_ConfigExtraction_Feb23 | QakBot Config Extraction | kevoreilly |
| |
JoeSecurity_Qbot_1 | Yara detected Qbot | Joe Security | ||
MAL_QakBot_ConfigExtraction_Feb23 | QakBot Config Extraction | kevoreilly |
| |
Click to see the 1 entries |
⊘No Sigma rule has matched
⊘No Snort rule has matched
Click to jump to signature section
Show All Signature Results
AV Detection |
---|
Source: | Malware Configuration Extractor: |