Edit tour
Windows
Analysis Report
042_qbot.dll.dll
Overview
General Information
Sample Name: | 042_qbot.dll.dll (renamed file extension from dat to dll, renamed because original name is a hash value) |
Original Sample Name: | 042_qbot.dll.dat |
Analysis ID: | 882935 |
MD5: | 8c18224b2fcb618bb4305a8687b3bb22 |
SHA1: | c0a9a8cb468d0f9b185fa1112683612c01c60673 |
SHA256: | d93d05a84c4d9579accd5dc839ee9f8f7e7f54c623e37175a59146664530dc3d |
Infos: | |
Detection
Qbot
Score: | 100 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 100% |
Signatures
Found malware configuration
Yara detected Qbot
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Writes to foreign memory regions
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Allocates memory in foreign processes
Injects a PE file into a foreign processes
C2 URLs / IPs found in malware configuration
Sample uses string decryption to hide its real strings
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
One or more processes crash
May sleep (evasive loops) to hinder dynamic analysis
Found evasive API chain (date check)
PE file contains sections with non-standard names
Internet Provider seen in connection with other malware
Detected potential crypto function
Contains functionality to query CPU information (cpuid)
Sample execution stops while process was sleeping (likely an evasion)
Contains functionality to call native functions
Contains functionality to dynamically determine API calls
IP address seen in connection with other malware
Creates a DirectInput object (often for capturing keystrokes)
AV process strings found (often used to terminate AV products)
PE file contains an invalid checksum
Tries to load missing DLLs
Contains functionality to read the PEB
Found evasive API chain checking for process token information
Detected TCP or UDP traffic on non-standard ports
Checks if the current process is being debugged
Connects to several IPs in different countries
PE file contains more sections than normal
Creates a process in suspended mode (likely to inject code)
Classification
- System is w10x64
- loaddll32.exe (PID: 6868 cmdline:
loaddll32. exe "C:\Us ers\user\D esktop\042 _qbot.dll. dll" MD5: 3B4636AE519868037940CA5C4272091B) - conhost.exe (PID: 7160 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496) - cmd.exe (PID: 3680 cmdline:
cmd.exe /C rundll32. exe "C:\Us ers\user\D esktop\042 _qbot.dll. dll",#1 MD5: F3BDBE3BB6F734E357235F4D5898582D) - rundll32.exe (PID: 1108 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\042_ qbot.dll.d ll",#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D) - WerFault.exe (PID: 5804 cmdline:
C:\Windows \SysWOW64\ WerFault.e xe -u -p 1 108 -s 664 MD5: 9E2B8ACAD48ECCA55C0230D63623661B) - rundll32.exe (PID: 5436 cmdline:
rundll32.e xe C:\User s\user\Des ktop\042_q bot.dll.dl l,lcopy_bl ock_row MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D) - WerFault.exe (PID: 5812 cmdline:
C:\Windows \SysWOW64\ WerFault.e xe -u -p 5 436 -s 652 MD5: 9E2B8ACAD48ECCA55C0230D63623661B) - rundll32.exe (PID: 676 cmdline:
rundll32.e xe C:\User s\user\Des ktop\042_q bot.dll.dl l,lcopy_sa mple_rows MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D) - rundll32.exe (PID: 4144 cmdline:
rundll32.e xe C:\User s\user\Des ktop\042_q bot.dll.dl l,ldiv_rou nd_up MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D) - rundll32.exe (PID: 7048 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\042_ qbot.dll.d ll",lcopy_ block_row MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D) - WerFault.exe (PID: 4144 cmdline:
C:\Windows \SysWOW64\ WerFault.e xe -u -p 7 048 -s 652 MD5: 9E2B8ACAD48ECCA55C0230D63623661B) - rundll32.exe (PID: 7076 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\042_ qbot.dll.d ll",lcopy_ sample_row s MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D) - rundll32.exe (PID: 7132 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\042_ qbot.dll.d ll",ldiv_r ound_up MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D) - rundll32.exe (PID: 7140 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\042_ qbot.dll.d ll",next MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D) - wermgr.exe (PID: 7220 cmdline:
C:\Windows \SysWOW64\ wermgr.exe MD5: CCF15E662ED5CE77B5FF1A7AAE305233) - rundll32.exe (PID: 2240 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\042_ qbot.dll.d ll",lround _up MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D) - rundll32.exe (PID: 5796 cmdline:
rundll32.e xe "C:\Use rs\user\De sktop\042_ qbot.dll.d ll",lpeg_w rite_table s MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D) - WerFault.exe (PID: 7076 cmdline:
C:\Windows \SysWOW64\ WerFault.e xe -u -p 5 796 -s 660 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)
- cleanup
Name | Description | Attribution | Blogpost URLs | Link |
---|---|---|---|---|
QakBot, qbotQbot | QBot is a modular information stealer also known as Qakbot or Pinkslipbot. It has been active for years since 2007. It has historically been known as a banking Trojan, meaning that it steals financial data from infected systems, and a loader using C2 servers for payload targeting and download. |
{"Bot id": "BB30", "Campaign": "1685686808", "Version": "404.1346", "C2 list": ["86.173.2.12:2222", "92.9.45.20:2222", "100.4.163.158:2222", "213.64.33.92:2222", "75.98.154.19:443", "78.192.109.105:2222", "88.126.94.4:50000", "70.28.50.223:2083", "92.154.17.149:2222", "24.234.220.88:993", "87.252.106.39:995", "174.4.89.3:443", "12.172.173.82:20", "90.29.86.138:2222", "70.160.67.203:443", "223.166.13.95:995", "184.181.75.148:443", "95.45.50.93:2222", "201.143.215.69:443", "64.121.161.102:443", "2.82.8.80:443", "188.28.19.84:443", "81.101.185.146:443", "79.77.142.22:2222", "84.215.202.8:443", "183.87.163.165:443", "74.12.147.139:2078", "74.12.147.139:2222", "74.12.147.139:2222", "74.12.147.139:2083", "70.28.50.223:2078", "94.204.202.106:443", "87.221.153.182:2222", "70.28.50.223:2087", "24.234.220.88:990", "2.49.63.160:2222", "72.205.104.134:443", "199.27.66.213:443", "83.249.198.100:2222", "90.104.151.37:2222", "116.75.63.183:443", "70.28.50.223:2078", "117.195.17.148:993", "77.126.99.230:443", "45.62.70.33:443", "24.234.220.88:465", "203.109.44.236:995", "75.109.111.89:443", "161.142.103.187:995", "77.86.98.236:443", "147.147.30.126:2222", "124.246.122.199:2222", "103.123.223.133:443", "180.151.19.13:2078", "176.142.207.63:443", "12.172.173.82:32101", "103.140.174.20:2222", "70.50.83.216:2222", "12.172.173.82:465", "38.2.18.164:443", "93.187.148.45:995", "70.64.77.115:443", "12.172.173.82:21", "70.49.205.198:2222", "27.0.48.233:443", "12.172.173.82:50001", "83.110.223.61:443", "103.141.50.43:995", "85.101.239.116:443", "103.42.86.42:995", "92.1.170.110:995", "81.229.117.95:2222", "124.122.47.148:443", "103.212.19.254:995", "103.139.242.6:443", "125.99.76.102:443", "50.68.186.195:443", "47.205.25.170:443", "12.172.173.82:993", "12.172.173.82:22", "70.28.50.223:32100", "79.168.224.165:2222", "121.121.108.120:995", "69.160.121.6:61201", "200.84.211.255:2222", "201.244.108.183:995", "93.187.148.45:443", "85.61.165.153:2222", "184.182.66.109:443", "175.156.217.7:2222", "70.28.50.223:3389", "114.143.176.236:443", "65.95.141.84:2222", "80.6.50.34:443", "12.172.173.82:2087", "47.199.241.39:443", "66.241.183.99:443", "113.11.92.30:443", "186.75.95.6:443", "125.99.69.178:443", "109.130.247.84:2222", "96.56.197.26:2222", "70.50.1.252:2222", "91.160.70.68:32100", "67.70.120.249:2222", "209.171.160.69:995", "98.163.227.79:443", "176.133.4.230:995", "24.234.220.88:995", "45.62.75.250:443", "200.44.198.47:2222", "173.17.45.60:443", "5.192.141.228:2222", "184.63.133.131:995", "70.28.50.223:2083", "78.82.143.154:2222", "73.88.173.113:443", "181.4.225.225:443", "24.234.220.88:443", "174.58.146.57:443"]}
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_Qbot_1 | Yara detected Qbot | Joe Security | ||
JoeSecurity_Qbot_1 | Yara detected Qbot | Joe Security | ||
JoeSecurity_Qbot | Yara detected Qbot | Joe Security |
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
MAL_QakBot_ConfigExtraction_Feb23 | QakBot Config Extraction | kevoreilly |
| |
JoeSecurity_Qbot_1 | Yara detected Qbot | Joe Security | ||
MAL_QakBot_ConfigExtraction_Feb23 | QakBot Config Extraction | kevoreilly |
| |
JoeSecurity_Qbot_1 | Yara detected Qbot | Joe Security | ||
MAL_QakBot_ConfigExtraction_Feb23 | QakBot Config Extraction | kevoreilly |
| |
Click to see the 1 entries |
⊘No Sigma rule has matched
Timestamp: | 192.168.2.3109.130.247.844971422222404302 06/07/23-01:07:51.615603 |
SID: | 2404302 |
Source Port: | 49714 |
Destination Port: | 2222 |
Protocol: | TCP |
Classtype: | A Network Trojan was detected |
Click to jump to signature section
Show All Signature Results
AV Detection |
---|
Source: | Malware Configuration Extractor: |