qakbot | 77156ec82469bc688ff6fc4c82ceb4e725347dcdc1ea0282d44de212b53d564e

General

Target
77156ec82469bc688ff6fc4c82ceb4e725347dcdc1ea0282d44de212b53d564e.exe
Size 3.5MB
Sample201014-r4nb5k8vpn
SHA256 77156ec82469bc688ff6fc4c82ceb4e725347dcdc1ea0282d44de212b53d564e
MD5 0d6aa6db3991334896506667079d457b
SHA1 46895948e28dcb5b12a2ecfba6596e9c9393f409
SHA512 8d1f4872c5c964b2e98b6485dfb16d4bfa56242c5213be3be6a0929e889b2446c8599eb04d9a4eef961419e591443270dcea4f3a0be557dfb71dfea94a3b2cbd
MD5 SHA1 SHA512

Score

10^/10

trojan banker stealer qakbot

Malware Config

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1988	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1316	77156ec82469bc688ff6fc4c82ceb4e725347dcdc1ea0282d44de212b53d564e.exe
1536	77156ec82469bc688ff6fc4c82ceb4e725347dcdc1ea0282d44de212b53d564e.exe
1536	77156ec82469bc688ff6fc4c82ceb4e725347dcdc1ea0282d44de212b53d564e.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1316 wrote to memory of 1536	1316	77156ec82469bc688ff6fc4c82ceb4e725347dcdc1ea0282d44de212b53d564e.exe	28
PID 1316 wrote to memory of 1536	1316	77156ec82469bc688ff6fc4c82ceb4e725347dcdc1ea0282d44de212b53d564e.exe	28
PID 1316 wrote to memory of 1536	1316	77156ec82469bc688ff6fc4c82ceb4e725347dcdc1ea0282d44de212b53d564e.exe	28
PID 1316 wrote to memory of 1536	1316	77156ec82469bc688ff6fc4c82ceb4e725347dcdc1ea0282d44de212b53d564e.exe	28
PID 1316 wrote to memory of 1896	1316	77156ec82469bc688ff6fc4c82ceb4e725347dcdc1ea0282d44de212b53d564e.exe	29
PID 1316 wrote to memory of 1896	1316	77156ec82469bc688ff6fc4c82ceb4e725347dcdc1ea0282d44de212b53d564e.exe	29
PID 1316 wrote to memory of 1896	1316	77156ec82469bc688ff6fc4c82ceb4e725347dcdc1ea0282d44de212b53d564e.exe	29
PID 1316 wrote to memory of 1896	1316	77156ec82469bc688ff6fc4c82ceb4e725347dcdc1ea0282d44de212b53d564e.exe	29
PID 1896 wrote to memory of 1988	1896	cmd.exe	31
PID 1896 wrote to memory of 1988	1896	cmd.exe	31
PID 1896 wrote to memory of 1988	1896	cmd.exe	31
PID 1896 wrote to memory of 1988	1896	cmd.exe	31

C:\Users\Admin\AppData\Local\Temp\77156ec82469bc688ff6fc4c82ceb4e725347dcdc1ea0282d44de212b53d564e.exe
"C:\Users\Admin\AppData\Local\Temp\77156ec82469bc688ff6fc4c82ceb4e725347dcdc1ea0282d44de212b53d564e.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1316
- C:\Users\Admin\AppData\Local\Temp\77156ec82469bc688ff6fc4c82ceb4e725347dcdc1ea0282d44de212b53d564e.exe
  C:\Users\Admin\AppData\Local\Temp\77156ec82469bc688ff6fc4c82ceb4e725347dcdc1ea0282d44de212b53d564e.exe /C
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1536
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\77156ec82469bc688ff6fc4c82ceb4e725347dcdc1ea0282d44de212b53d564e.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1896
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1988

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

1

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1536-1-0x00000000028A0000-0x00000000028B1000-memory.dmp

Download

Analysis

Sharing