qakbot | f15bd8720743aaab39cee3ba28dfd53fdb63bbf987db5aebb4e1fd59f0098e9b

Analysis

Target
f15bd8720743aaab39cee3ba28dfd53fdb63bbf987db5aebb4e1fd59f0098e9b.exe
Size 4.1MB
Sample201014-d549wnbn1a
SHA256 f15bd8720743aaab39cee3ba28dfd53fdb63bbf987db5aebb4e1fd59f0098e9b
MD5 b60f1bea92f67a84cf0cf6b8030204f9
SHA1 1c856f5378f5c0a40e42349a9a71eb57eacb6678
SHA512 c9c8a50c2bf39cc948c1fbf03021cf639a3a23a0614b577e2aa903897dedd2ddbcab3b17b1d15b68a9920d3677b075c9b029726ea9abce999d7a7c8586659142
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
1344	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
336	f15bd8720743aaab39cee3ba28dfd53fdb63bbf987db5aebb4e1fd59f0098e9b.exe
1936	f15bd8720743aaab39cee3ba28dfd53fdb63bbf987db5aebb4e1fd59f0098e9b.exe
1936	f15bd8720743aaab39cee3ba28dfd53fdb63bbf987db5aebb4e1fd59f0098e9b.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 336 wrote to memory of 1936	336	f15bd8720743aaab39cee3ba28dfd53fdb63bbf987db5aebb4e1fd59f0098e9b.exe	28
PID 336 wrote to memory of 1936	336	f15bd8720743aaab39cee3ba28dfd53fdb63bbf987db5aebb4e1fd59f0098e9b.exe	28
PID 336 wrote to memory of 1936	336	f15bd8720743aaab39cee3ba28dfd53fdb63bbf987db5aebb4e1fd59f0098e9b.exe	28
PID 336 wrote to memory of 1936	336	f15bd8720743aaab39cee3ba28dfd53fdb63bbf987db5aebb4e1fd59f0098e9b.exe	28
PID 336 wrote to memory of 1704	336	f15bd8720743aaab39cee3ba28dfd53fdb63bbf987db5aebb4e1fd59f0098e9b.exe	29
PID 336 wrote to memory of 1704	336	f15bd8720743aaab39cee3ba28dfd53fdb63bbf987db5aebb4e1fd59f0098e9b.exe	29
PID 336 wrote to memory of 1704	336	f15bd8720743aaab39cee3ba28dfd53fdb63bbf987db5aebb4e1fd59f0098e9b.exe	29
PID 336 wrote to memory of 1704	336	f15bd8720743aaab39cee3ba28dfd53fdb63bbf987db5aebb4e1fd59f0098e9b.exe	29
PID 1704 wrote to memory of 1344	1704	cmd.exe	31
PID 1704 wrote to memory of 1344	1704	cmd.exe	31
PID 1704 wrote to memory of 1344	1704	cmd.exe	31
PID 1704 wrote to memory of 1344	1704	cmd.exe	31

C:\Users\Admin\AppData\Local\Temp\f15bd8720743aaab39cee3ba28dfd53fdb63bbf987db5aebb4e1fd59f0098e9b.exe
"C:\Users\Admin\AppData\Local\Temp\f15bd8720743aaab39cee3ba28dfd53fdb63bbf987db5aebb4e1fd59f0098e9b.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:336
- C:\Users\Admin\AppData\Local\Temp\f15bd8720743aaab39cee3ba28dfd53fdb63bbf987db5aebb4e1fd59f0098e9b.exe
  C:\Users\Admin\AppData\Local\Temp\f15bd8720743aaab39cee3ba28dfd53fdb63bbf987db5aebb4e1fd59f0098e9b.exe /C
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1936
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\f15bd8720743aaab39cee3ba28dfd53fdb63bbf987db5aebb4e1fd59f0098e9b.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1704
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1344

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1936-1-0x0000000002890000-0x00000000028A1000-memory.dmp

Download