Edit tour
Windows
Analysis Report
qbot1.dll
Overview
General Information
Detection
Qbot
Score: | 100 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 100% |
Signatures
Found malware configuration
Yara detected Qbot
Multi AV Scanner detection for submitted file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Writes to foreign memory regions
Queries memory information (via WMI often done to detect virtual machines)
Allocates memory in foreign processes
Injects a PE file into a foreign processes
Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
C2 URLs / IPs found in malware configuration
Uses whoami command line tool to query computer and username
Uses ipconfig to lookup or modify the Windows network settings
Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
One or more processes crash
Contains functionality to check if a debugger is running (IsDebuggerPresent)
May sleep (evasive loops) to hinder dynamic analysis
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Uses code obfuscation techniques (call, push, ret)
Found evasive API chain (date check)
Creates files inside the system directory
Detected potential crypto function
Sample execution stops while process was sleeping (likely an evasion)
Contains functionality to call native functions
Contains functionality to dynamically determine API calls
Enables debug privileges
Creates a DirectInput object (often for capturing keystrokes)
AV process strings found (often used to terminate AV products)
Sample file is different than original file name gathered from version info
PE file contains an invalid checksum
Tries to load missing DLLs
Contains functionality to read the PEB
Uses a known web browser user agent for HTTP communication
Found evasive API chain checking for process token information
Detected TCP or UDP traffic on non-standard ports
Checks if the current process is being debugged
Connects to several IPs in different countries
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Creates a process in suspended mode (likely to inject code)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Classification
- System is w10x64
- loaddll32.exe (PID: 5568 cmdline:
loaddll32. exe "C:\Us ers\user\D esktop\qbo t1.dll" MD5: 3B4636AE519868037940CA5C4272091B) - conhost.exe (PID: 6356 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496) - cmd.exe (PID: 6348 cmdline:
cmd.exe /C rundll32. exe "C:\Us ers\user\D esktop\qbo t1.dll",#1 MD5: F3BDBE3BB6F734E357235F4D5898582D) - rundll32.exe (PID: 6268 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\qbot 1.dll",#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D) - WerFault.exe (PID: 6644 cmdline:
C:\Windows \SysWOW64\ WerFault.e xe -u -p 6 268 -s 660 MD5: 9E2B8ACAD48ECCA55C0230D63623661B) - rundll32.exe (PID: 6336 cmdline:
rundll32.e xe C:\User s\user\Des ktop\qbot1 .dll,m?0AP I@ScScript @@IAE@AAVE ngine@1@H@ Z MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D) - WerFault.exe (PID: 6648 cmdline:
C:\Windows \SysWOW64\ WerFault.e xe -u -p 6 336 -s 656 MD5: 9E2B8ACAD48ECCA55C0230D63623661B) - rundll32.exe (PID: 5044 cmdline:
rundll32.e xe C:\User s\user\Des ktop\qbot1 .dll,m?0Bi naryNode@S cScript@@Q AE@ABUScan Info@1@PAV Node@1@1@Z MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D) - WerFault.exe (PID: 7044 cmdline:
C:\Windows \SysWOW64\ WerFault.e xe -u -p 5 044 -s 672 MD5: 9E2B8ACAD48ECCA55C0230D63623661B) - rundll32.exe (PID: 5772 cmdline:
rundll32.e xe C:\User s\user\Des ktop\qbot1 .dll,m?0Br eakpointIn fo@ScScrip t@@QAE@ABV 01@@Z MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D) - WerFault.exe (PID: 7072 cmdline:
C:\Windows \SysWOW64\ WerFault.e xe -u -p 5 772 -s 648 MD5: 9E2B8ACAD48ECCA55C0230D63623661B) - rundll32.exe (PID: 7156 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\qbot 1.dll",m?0 API@ScScri pt@@IAE@AA VEngine@1@ H@Z MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D) - WerFault.exe (PID: 6612 cmdline:
C:\Windows \SysWOW64\ WerFault.e xe -u -p 7 156 -s 652 MD5: 9E2B8ACAD48ECCA55C0230D63623661B) - rundll32.exe (PID: 5444 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\qbot 1.dll",m?0 BinaryNode @ScScript@ @QAE@ABUSc anInfo@1@P AVNode@1@1 @Z MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D) - WerFault.exe (PID: 6868 cmdline:
C:\Windows \SysWOW64\ WerFault.e xe -u -p 5 444 -s 648 MD5: 9E2B8ACAD48ECCA55C0230D63623661B) - rundll32.exe (PID: 5428 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\qbot 1.dll",m?0 Breakpoint Info@ScScr ipt@@QAE@A BV01@@Z MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D) - WerFault.exe (PID: 6504 cmdline:
C:\Windows \SysWOW64\ WerFault.e xe -u -p 5 428 -s 652 MD5: 9E2B8ACAD48ECCA55C0230D63623661B) - rundll32.exe (PID: 7020 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\qbot 1.dll",nex t MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D) - wermgr.exe (PID: 7148 cmdline:
C:\Windows \SysWOW64\ wermgr.exe MD5: CCF15E662ED5CE77B5FF1A7AAE305233) - ipconfig.exe (PID: 2244 cmdline:
ipconfig / all MD5: B0C7423D02A007461C850CD0DFE09318) - conhost.exe (PID: 4332 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496) - whoami.exe (PID: 5324 cmdline:
whoami /al l MD5: 2E498B32E15CD7C0177A254E2410559C) - conhost.exe (PID: 5500 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496) - rundll32.exe (PID: 4604 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\qbot 1.dll",mun lockRef@En gine@ScScr ipt@@QAEXA BVVariant@ ScCore@@@Z MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D) - rundll32.exe (PID: 5668 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\qbot 1.dll",mun definedErr or@Callbac k@ScScript @@UAE_NAAV Engine@2@A BVVariant@ ScCore@@1A AV45@@Z MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
- msiexec.exe (PID: 5520 cmdline:
C:\Windows \system32\ msiexec.ex e /V MD5: 4767B71A318E201188A0D0A420C8B608)
- cleanup
Name | Description | Attribution | Blogpost URLs | Link |
---|---|---|---|---|
QakBot, qbotQbot | QBot is a modular information stealer also known as Qakbot or Pinkslipbot. It has been active for years since 2007. It has historically been known as a banking Trojan, meaning that it steals financial data from infected systems, and a loader using C2 servers for payload targeting and download. |
{"Bot id": "BB30", "Campaign": "1685604052", "Version": "404.1346", "C2 list": ["47.199.241.39:443", "93.147.235.8:443", "75.141.227.169:443", "45.243.142.31:995", "79.92.15.6:443", "85.104.105.67:443", "89.129.109.27:2222", "86.176.83.44:2222", "24.234.220.88:993", "89.32.156.5:995", "12.172.173.82:22", "103.101.203.177:443", "70.28.50.223:2083", "98.187.21.2:443", "70.49.205.198:2222", "96.56.197.26:2222", "92.9.45.20:2222", "86.195.14.72:2222", "172.115.17.50:443", "100.4.163.158:2222", "80.12.88.148:2222", "213.64.33.92:2222", "113.11.92.30:443", "78.192.109.105:2222", "47.34.30.133:443", "122.184.143.86:443", "198.2.51.242:993", "165.120.169.171:2222", "88.126.94.4:50000", "82.125.44.236:2222", "117.195.16.105:993", "147.219.4.194:443", "80.167.196.79:443", "92.154.17.149:2222", "184.181.75.148:443", "95.45.50.93:2222", "84.35.26.14:995", "201.143.215.69:443", "12.172.173.82:2087", "50.68.204.71:443", "64.121.161.102:443", "2.82.8.80:443", "79.77.142.22:2222", "12.172.173.82:995", "223.166.13.95:995", "72.134.124.16:443", "213.55.33.103:443", "183.87.163.165:443", "174.4.89.3:443", "27.253.11.10:2222", "2.49.63.160:2222", "92.186.69.229:2222", "69.133.162.35:443", "81.111.108.123:443", "12.172.173.82:20", "188.28.19.84:443", "90.29.86.138:2222", "70.160.67.203:443", "186.64.67.30:443", "5.107.153.132:2222", "125.63.125.205:2078", "2.36.64.159:2078", "71.38.155.217:443", "205.237.67.69:995", "70.64.77.115:443", "24.234.220.88:990", "96.56.197.26:2083", "70.28.50.223:2078", "103.123.223.133:443", "199.27.66.213:443", "83.249.198.100:2222", "94.204.202.106:443", "77.126.99.230:443", "72.205.104.134:443", "65.95.141.84:2222", "70.28.50.223:2078", "173.88.135.179:443", "220.240.164.182:443", "96.87.28.170:2222", "176.142.207.63:443", "12.172.173.82:32101", "70.50.83.216:2222", "161.142.103.187:995", "45.62.70.33:443", "24.234.220.88:465", "103.141.50.43:995", "90.7.72.46:2222", "76.178.148.107:2222", "116.74.163.130:443", "46.246.254.242:995", "70.28.50.223:2087", "12.172.173.82:465", "178.175.187.254:443", "27.0.48.233:443", "83.110.223.61:443", "184.182.66.109:443", "70.28.50.223:32100", "50.68.204.71:993", "70.28.50.223:3389", "50.68.186.195:443", "47.205.25.170:443", "12.172.173.82:993", "76.170.252.153:995", "69.242.31.249:443", "79.168.224.165:2222", "75.143.236.149:443", "14.192.241.76:995", "81.229.117.95:2222", "98.145.23.67:443", "98.37.25.99:443", "69.160.121.6:61201", "12.172.173.82:21", "75.109.111.89:443", "76.86.31.59:443", "80.6.50.34:443", "116.120.145.170:995", "201.244.108.183:995", "58.186.75.42:443", "68.203.69.96:443", "47.149.134.231:443"]}
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_Qbot_1 | Yara detected Qbot | Joe Security | ||
JoeSecurity_Qbot_1 | Yara detected Qbot | Joe Security | ||
JoeSecurity_Qbot | Yara detected Qbot | Joe Security |
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
MAL_QakBot_ConfigExtraction_Feb23 | QakBot Config Extraction | kevoreilly |
| |
JoeSecurity_Qbot_1 | Yara detected Qbot | Joe Security | ||
MAL_QakBot_ConfigExtraction_Feb23 | QakBot Config Extraction | kevoreilly |
| |
JoeSecurity_Qbot_1 | Yara detected Qbot | Joe Security | ||
MAL_QakBot_ConfigExtraction_Feb23 | QakBot Config Extraction | kevoreilly |
| |
Click to see the 1 entries |
⊘No Sigma rule has matched
⊘No Snort rule has matched
Click to jump to signature section
Show All Signature Results
AV Detection |
---|
Source: | Malware Configuration Extractor: |