qakbot | 034c86795739f7edeec14f4b982b017ecea1c9476bfa304a05de10ebbbdbe425

Analysis

Target
034c86795739f7edeec14f4b982b017ecea1c9476bfa304a05de10ebbbdbe425.exe
Size 993KB
Sample201007-4dvs1bfw9x
SHA256 034c86795739f7edeec14f4b982b017ecea1c9476bfa304a05de10ebbbdbe425
MD5 412ed1b47532f200ec2e3cba84e5dc14
SHA1 b765dfded734d95e36bc7b0210e7476d36dd0753
SHA512 f7dd0b2fd9473f1325f1877a8240278dff0918da4a72c99d1785e832da4c969b22efe8eb71372d1f10977e1d0cd452822ab75567435881ae64a05cb58776c632
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
1592	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
844	034c86795739f7edeec14f4b982b017ecea1c9476bfa304a05de10ebbbdbe425.exe
564	034c86795739f7edeec14f4b982b017ecea1c9476bfa304a05de10ebbbdbe425.exe
564	034c86795739f7edeec14f4b982b017ecea1c9476bfa304a05de10ebbbdbe425.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 844 wrote to memory of 564	844	034c86795739f7edeec14f4b982b017ecea1c9476bfa304a05de10ebbbdbe425.exe	28
PID 844 wrote to memory of 564	844	034c86795739f7edeec14f4b982b017ecea1c9476bfa304a05de10ebbbdbe425.exe	28
PID 844 wrote to memory of 564	844	034c86795739f7edeec14f4b982b017ecea1c9476bfa304a05de10ebbbdbe425.exe	28
PID 844 wrote to memory of 564	844	034c86795739f7edeec14f4b982b017ecea1c9476bfa304a05de10ebbbdbe425.exe	28
PID 844 wrote to memory of 340	844	034c86795739f7edeec14f4b982b017ecea1c9476bfa304a05de10ebbbdbe425.exe	29
PID 844 wrote to memory of 340	844	034c86795739f7edeec14f4b982b017ecea1c9476bfa304a05de10ebbbdbe425.exe	29
PID 844 wrote to memory of 340	844	034c86795739f7edeec14f4b982b017ecea1c9476bfa304a05de10ebbbdbe425.exe	29
PID 844 wrote to memory of 340	844	034c86795739f7edeec14f4b982b017ecea1c9476bfa304a05de10ebbbdbe425.exe	29
PID 340 wrote to memory of 1592	340	cmd.exe	31
PID 340 wrote to memory of 1592	340	cmd.exe	31
PID 340 wrote to memory of 1592	340	cmd.exe	31
PID 340 wrote to memory of 1592	340	cmd.exe	31

C:\Users\Admin\AppData\Local\Temp\034c86795739f7edeec14f4b982b017ecea1c9476bfa304a05de10ebbbdbe425.exe
"C:\Users\Admin\AppData\Local\Temp\034c86795739f7edeec14f4b982b017ecea1c9476bfa304a05de10ebbbdbe425.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:844
- C:\Users\Admin\AppData\Local\Temp\034c86795739f7edeec14f4b982b017ecea1c9476bfa304a05de10ebbbdbe425.exe
  C:\Users\Admin\AppData\Local\Temp\034c86795739f7edeec14f4b982b017ecea1c9476bfa304a05de10ebbbdbe425.exe /C
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:564
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\034c86795739f7edeec14f4b982b017ecea1c9476bfa304a05de10ebbbdbe425.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:340
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1592

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/564-1-0x00000000028A0000-0x00000000028B1000-memory.dmp

Download