Edit tour
Windows
Analysis Report
batteryacid.dat.dll
Overview
General Information
Detection
Qbot
Score: | 100 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 100% |
Signatures
Found malware configuration
Yara detected Qbot
Multi AV Scanner detection for submitted file
Sigma detected: Execute DLL with spoofed extension
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Writes to foreign memory regions
Allocates memory in foreign processes
Injects a PE file into a foreign processes
C2 URLs / IPs found in malware configuration
Sample uses string decryption to hide its real strings
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
One or more processes crash
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to query locales information (e.g. system language)
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Found evasive API chain (date check)
Internet Provider seen in connection with other malware
Detected potential crypto function
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
Found evasive API chain (may stop execution after checking a module file name)
JA3 SSL client fingerprint seen in connection with other malware
Contains functionality to call native functions
Contains functionality to dynamically determine API calls
Contains functionality which may be used to detect a debugger (GetProcessHeap)
IP address seen in connection with other malware
Creates a DirectInput object (often for capturing keystrokes)
AV process strings found (often used to terminate AV products)
PE file contains an invalid checksum
Tries to load missing DLLs
Contains functionality to read the PEB
Uses a known web browser user agent for HTTP communication
Found evasive API chain checking for process token information
Detected TCP or UDP traffic on non-standard ports
Checks if the current process is being debugged
Connects to several IPs in different countries
Found large amount of non-executed APIs
Creates a process in suspended mode (likely to inject code)
Classification
- System is w10x64
- loaddll32.exe (PID: 676 cmdline:
loaddll32. exe "C:\Us ers\user\D esktop\bat teryacid.d at.dll" MD5: 3B4636AE519868037940CA5C4272091B) - conhost.exe (PID: 5908 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496) - cmd.exe (PID: 5680 cmdline:
cmd.exe /C rundll32. exe "C:\Us ers\user\D esktop\bat teryacid.d at.dll",#1 MD5: F3BDBE3BB6F734E357235F4D5898582D) - rundll32.exe (PID: 6044 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\batt eryacid.da t.dll",#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D) - rundll32.exe (PID: 3112 cmdline:
rundll32.e xe C:\User s\user\Des ktop\batte ryacid.dat .dll,l_cms ComputeInt erpParams@ 24 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D) - rundll32.exe (PID: 6064 cmdline:
rundll32.e xe C:\User s\user\Des ktop\batte ryacid.dat .dll,l_cms Float2Half @4 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D) - rundll32.exe (PID: 3780 cmdline:
rundll32.e xe C:\User s\user\Des ktop\batte ryacid.dat .dll,l_cms FreeInterp Params@4 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D) - WerFault.exe (PID: 128 cmdline:
C:\Windows \SysWOW64\ WerFault.e xe -u -p 3 780 -s 652 MD5: 9E2B8ACAD48ECCA55C0230D63623661B) - rundll32.exe (PID: 812 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\batt eryacid.da t.dll",l_c msComputeI nterpParam s@24 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D) - rundll32.exe (PID: 5640 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\batt eryacid.da t.dll",l_c msFloat2Ha lf@4 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D) - rundll32.exe (PID: 5692 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\batt eryacid.da t.dll",l_c msFreeInte rpParams@4 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D) - WerFault.exe (PID: 7224 cmdline:
C:\Windows \SysWOW64\ WerFault.e xe -u -p 5 692 -s 652 MD5: 9E2B8ACAD48ECCA55C0230D63623661B) - rundll32.exe (PID: 1396 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\batt eryacid.da t.dll",nex t MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D) - wermgr.exe (PID: 7404 cmdline:
C:\Windows \SysWOW64\ wermgr.exe MD5: CCF15E662ED5CE77B5FF1A7AAE305233) - rundll32.exe (PID: 1916 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\batt eryacid.da t.dll",lms strcasecmp MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D) - WerFault.exe (PID: 7236 cmdline:
C:\Windows \SysWOW64\ WerFault.e xe -u -p 1 916 -s 652 MD5: 9E2B8ACAD48ECCA55C0230D63623661B) - rundll32.exe (PID: 4364 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\batt eryacid.da t.dll",lms filelength MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D) - WerFault.exe (PID: 7244 cmdline:
C:\Windows \SysWOW64\ WerFault.e xe -u -p 4 364 -s 652 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)
- cleanup
Name | Description | Attribution | Blogpost URLs | Link |
---|---|---|---|---|
QakBot, qbotQbot | QBot is a modular information stealer also known as Qakbot or Pinkslipbot. It has been active for years since 2007. It has historically been known as a banking Trojan, meaning that it steals financial data from infected systems, and a loader using C2 servers for payload targeting and download. |
{"Bot id": "BB31", "Campaign": "1685959443", "Version": "404.1346", "C2 list": ["77.126.99.230:443", "24.234.220.88:465", "151.62.238.176:443", "85.57.212.13:3389", "199.27.66.213:443", "12.172.173.82:21", "12.172.173.82:50001", "12.172.173.82:465", "105.184.209.117:995", "193.80.73.200:995", "86.208.35.220:2222", "93.187.148.45:995", "37.189.89.196:443", "182.75.189.42:995", "65.95.141.84:2222", "84.216.198.201:6881", "105.102.10.220:443", "124.246.122.199:2222", "83.249.198.100:2222", "1.221.179.74:443", "114.143.176.236:443", "174.58.146.57:443", "12.172.173.82:2087", "73.207.160.219:443", "82.36.36.76:443", "86.173.2.12:2222", "92.98.55.221:2222", "223.166.13.95:995", "103.42.86.42:995", "176.133.4.230:995", "70.49.205.198:2222", "81.229.117.95:2222", "92.20.204.198:2222", "183.87.163.165:443", "147.147.30.126:2222", "184.181.75.148:443", "201.244.108.183:995", "94.59.123.30:2222", "184.182.66.109:443", "64.121.161.102:443", "103.140.174.20:2222", "70.28.50.223:3389", "125.63.121.38:2078", "66.241.183.99:443", "50.68.186.195:443", "89.115.200.234:443", "47.205.25.170:443", "12.172.173.82:993", "2.82.8.80:443", "12.172.173.82:22", "93.187.148.45:443", "70.28.50.223:32100", "79.168.224.165:2222", "121.121.108.120:995", "74.12.146.221:2222", "78.159.146.65:995", "116.74.164.17:443", "59.88.174.146:993", "92.184.102.115:2078", "31.53.29.216:2222", "72.205.104.134:443", "116.120.145.170:995", "217.165.233.122:443", "193.253.100.236:2222", "27.0.48.233:443", "103.123.223.133:443", "37.14.229.220:2222", "75.109.111.89:443", "24.234.220.88:995", "92.239.81.124:443", "12.172.173.82:20", "90.29.86.138:2222", "70.160.67.203:443", "92.9.45.20:2222", "95.45.50.93:2222", "100.4.163.158:2222", "201.143.215.69:443", "213.64.33.92:2222", "75.98.154.19:443", "103.139.242.6:443", "103.141.50.43:995", "178.175.187.254:443", "88.126.94.4:50000", "79.77.142.22:2222", "197.2.173.77:443", "74.14.39.7:2222", "70.28.50.223:2083", "174.4.89.3:443", "213.91.235.146:443", "78.130.215.67:443", "24.234.220.88:993", "188.28.19.84:443", "74.12.146.221:2222", "74.12.146.221:2083", "82.131.141.209:443", "70.28.50.223:2087", "24.234.220.88:990", "12.172.173.82:995", "41.227.190.59:443", "192.143.255.159:443", "82.127.153.75:2222", "122.184.143.86:443", "59.28.84.65:443", "103.144.201.48:2078", "103.87.128.228:443", "125.99.69.178:443", "122.186.210.254:443", "74.12.146.221:2083", "190.75.72.44:2222", "123.3.240.16:6881", "176.142.207.63:443", "12.172.173.82:32101", "94.207.125.252:443", "45.62.70.33:443", "81.111.108.123:443", "68.227.249.138:443", "41.186.88.38:443", "86.195.14.72:2222", "165.120.169.171:2222", "49.175.72.188:443"]}
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_Qbot_1 | Yara detected Qbot | Joe Security | ||
JoeSecurity_Qbot_1 | Yara detected Qbot | Joe Security | ||
JoeSecurity_Qbot | Yara detected Qbot | Joe Security |
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
MAL_QakBot_ConfigExtraction_Feb23 | QakBot Config Extraction | kevoreilly |
| |
JoeSecurity_Qbot_1 | Yara detected Qbot | Joe Security | ||
MAL_QakBot_ConfigExtraction_Feb23 | QakBot Config Extraction | kevoreilly |
| |
JoeSecurity_Qbot_1 | Yara detected Qbot | Joe Security | ||
MAL_QakBot_ConfigExtraction_Feb23 | QakBot Config Extraction | kevoreilly |
| |
Click to see the 1 entries |
Data Obfuscation |
---|
Source: | Author: Joe Security: |
⊘No Snort rule has matched
Click to jump to signature section
Show All Signature Results
AV Detection |
---|
Source: | Malware Configuration Extractor: |