Analysis date (UTC): 9 August 2021, 23:56Analysis environment: Windows 7 Pro, build 7601, x86

02600004

MD5:1408275C2E2C8FE5E83227BA371AC6B3

SHA1:DAC3D479CE4AF6D2FFD5314191E768543ACFE32D

SHA256:CC185105946C202D9FD0EF18423B078CD8E064B1E2A87E93ED1B3D4F2CBDB65D

Analysis result

Threat level:Malicious activity

Tags:

trojanbackdoorqbot

Full analysis:Analysis 02600004 (MD5: 1408275C2E2C8FE5E83227BA371AC6B3) Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

Changes the autorun value in the registry

02600004.exe (PID: 2612)

Runs injected code in another process

02600004.exe (PID: 2612)
ebgqylu.exe (PID: 2368)

Application was injected by another process

Explorer.EXE (PID: 1896)
taskeng.exe (PID: 776)
conhost.exe (PID: 2500)
Dwm.exe (PID: 600)
SearchProtocolHost.exe (PID: 908)

Runs PING.EXE for delay simulation

cmd.exe (PID: 2484)

Changes internet zones settings

ebgqylu.exe (PID: 2368)

Loads the Task Scheduler COM API

mmc.exe (PID: 2872)

QBOT was detected

iexplore.exe (PID: 1328)

Connects to CnC server

iexplore.exe (PID: 1328)

SUSPICIOUS

Checks supported languages

02600004.exe (PID: 2612)
ebgqylu.exe (PID: 2368)
conhost.exe (PID: 2500)
cmd.exe (PID: 2484)

Reads the computer name

02600004.exe (PID: 2612)
ebgqylu.exe (PID: 2368)
cmd.exe (PID: 2484)
conhost.exe (PID: 2500)

Reads Windows Product ID

02600004.exe (PID: 2612)
ebgqylu.exe (PID: 2368)

Creates files in the user directory

02600004.exe (PID: 2612)

Executable content was dropped or overwritten

02600004.exe (PID: 2612)

Drops a file that was compiled in debug mode

02600004.exe (PID: 2612)

Starts CMD.EXE for self-deleting

Explorer.EXE (PID: 1896)

Starts CMD.EXE for commands execution

Explorer.EXE (PID: 1896)

Starts Internet Explorer

Explorer.EXE (PID: 1896)

Reads Microsoft Outlook installation path

iexplore.exe (PID: 3612)

INFO

Manual execution by user

ebgqylu.exe (PID: 2368)
cmd.exe (PID: 2484)
mmc.exe (PID: 2872)
iexplore.exe (PID: 1328)
mmc.exe (PID: 2132)

Reads the computer name

PING.EXE (PID: 2792)
mmc.exe (PID: 2872)
iexplore.exe (PID: 1328)
iexplore.exe (PID: 3612)
iexplore.exe (PID: 2624)
SearchProtocolHost.exe (PID: 908)

Checks supported languages

PING.EXE (PID: 2792)
mmc.exe (PID: 2872)
iexplore.exe (PID: 1328)
iexplore.exe (PID: 3612)
iexplore.exe (PID: 2624)
SearchProtocolHost.exe (PID: 908)

Application launched itself

iexplore.exe (PID: 1328)
iexplore.exe (PID: 3612)

Creates files in the user directory

iexplore.exe (PID: 1328)
iexplore.exe (PID: 3612)

Changes internet zones settings

iexplore.exe (PID: 1328)

Reads internet explorer settings

iexplore.exe (PID: 3612)

Changes settings of System certificates

iexplore.exe (PID: 3612)
iexplore.exe (PID: 1328)

Adds / modifies Windows certificates

iexplore.exe (PID: 3612)
iexplore.exe (PID: 1328)

Dropped object may contain Bitcoin addresses

iexplore.exe (PID: 1328)

Checks Windows Trust Settings

iexplore.exe (PID: 3612)
iexplore.exe (PID: 1328)

Reads settings of System Certificates

iexplore.exe (PID: 3612)
iexplore.exe (PID: 1328)

Searches for installed software

iexplore.exe (PID: 1328)

Threats

PID	Process	Class	Message
1328	iexplore.exe	Generic Protocol Command Decode	SURICATA Applayer Detect protocol only one direction
—	—	Potentially Bad Traffic	ET INFO Observed DNS Query to .biz TLD
—	—	Potentially Bad Traffic	ET INFO Observed DNS Query to .biz TLD
—	—	Potentially Bad Traffic	ET INFO Observed DNS Query to .biz TLD
—	—	Potentially Bad Traffic	ET INFO Observed DNS Query to .biz TLD
—	—	Potentially Bad Traffic	ET INFO Observed DNS Query to .biz TLD
—	—	Potentially Bad Traffic	ET INFO Observed DNS Query to .biz TLD
—	—	Potentially Bad Traffic	ET INFO Observed DNS Query to .biz TLD
—	—	Potentially Bad Traffic	ET INFO Observed DNS Query to .biz TLD
—	—	Potentially Bad Traffic	ET INFO Observed DNS Query to .biz TLD

Rows per page