qakbot | 37a322fd6c3979ed6fcfb330913d06216407f21013832804a42e2b0d74dc24d5

General

Target
37a322fd6c3979ed6fcfb330913d06216407f21013832804a42e2b0d74dc24d5.exe
Size 4.1MB
Sample201014-a6qhvt6lca
SHA256 37a322fd6c3979ed6fcfb330913d06216407f21013832804a42e2b0d74dc24d5
MD5 712ec855bddc2010c0b6033e414ec229
SHA1 d5c4bb7cd41ca4a99998af7db3e340dd41a05be9
SHA512 b044335f5e44ba96254b2989643b47a79bfbe49ba03159b3644195d952ebe1602d72fd6f3e7583d370b5473bf31cc8151d10123b0bdff29a140c1b755227cea9
MD5 SHA1 SHA512

Score

10^/10

trojan banker stealer qakbot

Malware Config

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1936	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1440	37a322fd6c3979ed6fcfb330913d06216407f21013832804a42e2b0d74dc24d5.exe
1576	37a322fd6c3979ed6fcfb330913d06216407f21013832804a42e2b0d74dc24d5.exe
1576	37a322fd6c3979ed6fcfb330913d06216407f21013832804a42e2b0d74dc24d5.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1440 wrote to memory of 1576	1440	37a322fd6c3979ed6fcfb330913d06216407f21013832804a42e2b0d74dc24d5.exe	28
PID 1440 wrote to memory of 1576	1440	37a322fd6c3979ed6fcfb330913d06216407f21013832804a42e2b0d74dc24d5.exe	28
PID 1440 wrote to memory of 1576	1440	37a322fd6c3979ed6fcfb330913d06216407f21013832804a42e2b0d74dc24d5.exe	28
PID 1440 wrote to memory of 1576	1440	37a322fd6c3979ed6fcfb330913d06216407f21013832804a42e2b0d74dc24d5.exe	28
PID 1440 wrote to memory of 1628	1440	37a322fd6c3979ed6fcfb330913d06216407f21013832804a42e2b0d74dc24d5.exe	29
PID 1440 wrote to memory of 1628	1440	37a322fd6c3979ed6fcfb330913d06216407f21013832804a42e2b0d74dc24d5.exe	29
PID 1440 wrote to memory of 1628	1440	37a322fd6c3979ed6fcfb330913d06216407f21013832804a42e2b0d74dc24d5.exe	29
PID 1440 wrote to memory of 1628	1440	37a322fd6c3979ed6fcfb330913d06216407f21013832804a42e2b0d74dc24d5.exe	29
PID 1628 wrote to memory of 1936	1628	cmd.exe	31
PID 1628 wrote to memory of 1936	1628	cmd.exe	31
PID 1628 wrote to memory of 1936	1628	cmd.exe	31
PID 1628 wrote to memory of 1936	1628	cmd.exe	31

C:\Users\Admin\AppData\Local\Temp\37a322fd6c3979ed6fcfb330913d06216407f21013832804a42e2b0d74dc24d5.exe
"C:\Users\Admin\AppData\Local\Temp\37a322fd6c3979ed6fcfb330913d06216407f21013832804a42e2b0d74dc24d5.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1440
- C:\Users\Admin\AppData\Local\Temp\37a322fd6c3979ed6fcfb330913d06216407f21013832804a42e2b0d74dc24d5.exe
  C:\Users\Admin\AppData\Local\Temp\37a322fd6c3979ed6fcfb330913d06216407f21013832804a42e2b0d74dc24d5.exe /C
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1576
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\37a322fd6c3979ed6fcfb330913d06216407f21013832804a42e2b0d74dc24d5.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1628
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1936

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

1

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1576-1-0x00000000028A0000-0x00000000028B1000-memory.dmp

Download

Analysis

Sharing