Edit tour
Windows
Analysis Report
qDKTsL1y44.exe
Overview
General Information
| Sample name: | qDKTsL1y44.exerenamed because original name is a hash value |
| Original sample name: | 60e73c48b9559b07ba1aee9fe48e0185a2686e5b88407c590f60535ff36f85db.exe |
| Analysis ID: | 1389143 |
| MD5: | 42f93ef4ac4943f328a1518bde3c333a |
| SHA1: | 7bca2b97fe0136a6787a1f08903e723a7b2a17c1 |
| SHA256: | 60e73c48b9559b07ba1aee9fe48e0185a2686e5b88407c590f60535ff36f85db |
| Tags: | exe |
| Infos: |   |
 | |
Detection
DBatLoader
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Antivirus detection for URL or domain
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected DBatLoader
Allocates memory in foreign processes
Drops PE files with a suspicious file extension
Found Tor onion address
Machine Learning detection for dropped file
Machine Learning detection for sample
Sample is not signed and drops a device driver
Sample uses process hollowing technique
Sigma detected: Execution from Suspicious Folder
Sigma detected: New RUN Key Pointing to Suspicious Folder
Sigma detected: Suspicious Program Location with Network Connections
Writes to foreign memory regions
AV process strings found (often used to terminate AV products)
Binary contains a suspicious time stamp
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Checks if the current process is being debugged
Contains functionality to call native functions
Contains functionality to check if a connection to the internet is available
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to detect sandboxes (mouse cursor move detection)
Contains functionality to dynamically determine API calls
Contains functionality to launch a process as a different user
Contains functionality to query locales information (e.g. system language)
Contains functionality to record screenshots
Contains functionality to retrieve information about pressed keystrokes
Creates a process in suspended mode (likely to inject code)
Creates driver files
Creates files inside the system directory
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Entry point lies outside standard sections
Extensive use of GetProcAddress (often used to hide API calls)
Found dropped PE file which has not been started or loaded
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
PE file contains an invalid checksum
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Execution of Suspicious File Type Extension
Tries to load missing DLLs
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Yara detected Keylogger Generic
Classification
- System is w10x64
qDKTsL1y44.exe (PID: 7304 cmdline: C:\Users\u ser\Deskto p\qDKTsL1y 44.exe MD5: 42F93EF4AC4943F328A1518BDE3C333A) 
cmd.exe (PID: 7508 cmdline: C:\Windows \system32\ cmd.exe /c ""C:\User s\Public\L ibraries\F inqiaevO.b at" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - conhost.exe (PID: 7516 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - cmd.exe (PID: 7560 cmdline:
cmd /c mkd ir "\\?\C: \Windows " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - conhost.exe (PID: 7568 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) 
veaiqniF.pif (PID: 7604 cmdline: C:\Users\P ublic\Libr aries\veai qniF.pif MD5: 22331ABCC9472CC9DC6F37FAF333AA2C)
- Finqiaev.PIF (PID: 7860 cmdline:
"C:\Users\ Public\Lib raries\Fin qiaev.PIF" MD5: 42F93EF4AC4943F328A1518BDE3C333A) - veaiqniF.pif (PID: 7952 cmdline:
C:\Users\P ublic\Libr aries\veai qniF.pif MD5: 22331ABCC9472CC9DC6F37FAF333AA2C)
- Finqiaev.PIF (PID: 8020 cmdline:
"C:\Users\ Public\Lib raries\Fin qiaev.PIF" MD5: 42F93EF4AC4943F328A1518BDE3C333A) - veaiqniF.pif (PID: 5264 cmdline:
C:\Users\P ublic\Libr aries\veai qniF.pif MD5: 22331ABCC9472CC9DC6F37FAF333AA2C)
- cleanup
| Name | Description | Attribution | Blogpost URLs | Link |
|---|---|---|---|---|
| DBatLoader | This Delphi loader misuses Cloud storage services, such as Google Drive to download the Delphi stager component. The Delphi stager has the actual payload embedded as a resource and starts it. | No Attribution |
⊘No configs have been found
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_DBatLoader | Yara detected DBatLoader | Joe Security | ||
| JoeSecurity_DBatLoader | Yara detected DBatLoader | Joe Security | ||
| JoeSecurity_DBatLoader | Yara detected DBatLoader | Joe Security | ||
| JoeSecurity_DBatLoader | Yara detected DBatLoader | Joe Security | ||
| JoeSecurity_Keylogger_Generic | Yara detected Keylogger Generic | Joe Security |
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_DBatLoader | Yara detected DBatLoader | Joe Security |
System Summary |   |
|---|
| Source: | Author: Florian Roth (Nextron Systems), Tim Shelton: | ||
| Source: | Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: | ||
| Source: | Author: Florian Roth (Nextron Systems), Tim Shelton: | ||
| Source: | Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): | ||
| Source: | Author: Max Altgelt (Nextron Systems): | ||
⊘No Snort rule has matched
Click to jump to signature section
Show All Signature Results
AV Detection | |
|---|
| Source: | Avira URL Cloud: | ||
| Source: | ReversingLabs: | ||
| Source: | ReversingLabs: | ||
| Source: | ReversingLabs: | ||
| Source: | Joe Sandbox ML: | ||
| Source: | Joe Sandbox ML: | ||
| Source: | Joe Sandbox ML: | ||
Compliance | |
|---|
| Source: | Unpacked PE file: | ||
| Source: | Unpacked PE file: | ||
| Source: | Unpacked PE file: | ||
| Source: | Static PE information: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Code function: | 0_2_041E5C18 | |
Networking | |
|---|
| Source: | String found in binary or memory: | ||