qakbot | 69281bd01eb8fc99140659657fb0e3c834ea70bf2609dc4b7bd1484e90d5d5b7

Analysis

Target
c2b2872a4583b30d08f2650cea2d3822.exe
Size 1.0MB
Sample201025-1fpffdva3j
SHA256 69281bd01eb8fc99140659657fb0e3c834ea70bf2609dc4b7bd1484e90d5d5b7
MD5 c2b2872a4583b30d08f2650cea2d3822
SHA1 4604cc69b06626349c7227de88e6f014aff25339
SHA512 d6454545d7983a3096f0ae668b7352360830228fdc3bdc8917c02dfad612587ead7cc0202b246af94f764b81948e929088c8fcb697c176f5e4486dba64f2265c
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
1600	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1596 wrote to memory of 1784	1596	c2b2872a4583b30d08f2650cea2d3822.exe	28
PID 1596 wrote to memory of 1784	1596	c2b2872a4583b30d08f2650cea2d3822.exe	28
PID 1596 wrote to memory of 1784	1596	c2b2872a4583b30d08f2650cea2d3822.exe	28
PID 1596 wrote to memory of 1784	1596	c2b2872a4583b30d08f2650cea2d3822.exe	28
PID 1596 wrote to memory of 1668	1596	c2b2872a4583b30d08f2650cea2d3822.exe	29
PID 1596 wrote to memory of 1668	1596	c2b2872a4583b30d08f2650cea2d3822.exe	29
PID 1596 wrote to memory of 1668	1596	c2b2872a4583b30d08f2650cea2d3822.exe	29
PID 1596 wrote to memory of 1668	1596	c2b2872a4583b30d08f2650cea2d3822.exe	29
PID 1668 wrote to memory of 1600	1668	cmd.exe	31
PID 1668 wrote to memory of 1600	1668	cmd.exe	31
PID 1668 wrote to memory of 1600	1668	cmd.exe	31
PID 1668 wrote to memory of 1600	1668	cmd.exe	31

C:\Users\Admin\AppData\Local\Temp\c2b2872a4583b30d08f2650cea2d3822.exe
"C:\Users\Admin\AppData\Local\Temp\c2b2872a4583b30d08f2650cea2d3822.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1596
- C:\Users\Admin\AppData\Local\Temp\c2b2872a4583b30d08f2650cea2d3822.exe
  C:\Users\Admin\AppData\Local\Temp\c2b2872a4583b30d08f2650cea2d3822.exe /C
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1784
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\c2b2872a4583b30d08f2650cea2d3822.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1668
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1600

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1784-1-0x00000000027C0000-0x00000000027D1000-memory.dmp

Download