qakbot | b66b7bfcdc8d6fb55fe600c20302405a22e1e7b60a0bb1e48a0ccf4e5daf8e50

Analysis

Target
b66b7bfcdc8d6fb55fe600c20302405a22e1e7b60a0bb1e48a0ccf4e5daf8e50.exe
Size 1.1MB
Sample200921-ezevfjsfjn
SHA256 b66b7bfcdc8d6fb55fe600c20302405a22e1e7b60a0bb1e48a0ccf4e5daf8e50
MD5 218327da4a1a070de03b9c07cae4abc3
SHA1 b42245b80511b5600df1d5ddea40fce78674fba5
SHA512 dc1f00d8a16eefcdaa896106a01702e9d13a18d532733b4f8edffbe57ebd98a790c1b51c7eefff3e6b5ea8927691649c536a72f1cc0ff1630ae642184049ef5c
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
1344	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
336	b66b7bfcdc8d6fb55fe600c20302405a22e1e7b60a0bb1e48a0ccf4e5daf8e50.exe
340	b66b7bfcdc8d6fb55fe600c20302405a22e1e7b60a0bb1e48a0ccf4e5daf8e50.exe
340	b66b7bfcdc8d6fb55fe600c20302405a22e1e7b60a0bb1e48a0ccf4e5daf8e50.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 336 wrote to memory of 340	336	b66b7bfcdc8d6fb55fe600c20302405a22e1e7b60a0bb1e48a0ccf4e5daf8e50.exe	28
PID 336 wrote to memory of 340	336	b66b7bfcdc8d6fb55fe600c20302405a22e1e7b60a0bb1e48a0ccf4e5daf8e50.exe	28
PID 336 wrote to memory of 340	336	b66b7bfcdc8d6fb55fe600c20302405a22e1e7b60a0bb1e48a0ccf4e5daf8e50.exe	28
PID 336 wrote to memory of 340	336	b66b7bfcdc8d6fb55fe600c20302405a22e1e7b60a0bb1e48a0ccf4e5daf8e50.exe	28
PID 336 wrote to memory of 1704	336	b66b7bfcdc8d6fb55fe600c20302405a22e1e7b60a0bb1e48a0ccf4e5daf8e50.exe	29
PID 336 wrote to memory of 1704	336	b66b7bfcdc8d6fb55fe600c20302405a22e1e7b60a0bb1e48a0ccf4e5daf8e50.exe	29
PID 336 wrote to memory of 1704	336	b66b7bfcdc8d6fb55fe600c20302405a22e1e7b60a0bb1e48a0ccf4e5daf8e50.exe	29
PID 336 wrote to memory of 1704	336	b66b7bfcdc8d6fb55fe600c20302405a22e1e7b60a0bb1e48a0ccf4e5daf8e50.exe	29
PID 1704 wrote to memory of 1344	1704	cmd.exe	31
PID 1704 wrote to memory of 1344	1704	cmd.exe	31
PID 1704 wrote to memory of 1344	1704	cmd.exe	31
PID 1704 wrote to memory of 1344	1704	cmd.exe	31

C:\Users\Admin\AppData\Local\Temp\b66b7bfcdc8d6fb55fe600c20302405a22e1e7b60a0bb1e48a0ccf4e5daf8e50.exe
"C:\Users\Admin\AppData\Local\Temp\b66b7bfcdc8d6fb55fe600c20302405a22e1e7b60a0bb1e48a0ccf4e5daf8e50.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:336
- C:\Users\Admin\AppData\Local\Temp\b66b7bfcdc8d6fb55fe600c20302405a22e1e7b60a0bb1e48a0ccf4e5daf8e50.exe
  C:\Users\Admin\AppData\Local\Temp\b66b7bfcdc8d6fb55fe600c20302405a22e1e7b60a0bb1e48a0ccf4e5daf8e50.exe /C
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:340
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\b66b7bfcdc8d6fb55fe600c20302405a22e1e7b60a0bb1e48a0ccf4e5daf8e50.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1704
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1344

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/340-1-0x0000000002930000-0x0000000002941000-memory.dmp

Download