qakbot | 7b5eea1e71648ffa61e8ea5f6a520778633cd270ce36a67509dcce5b121e43ed

Analysis

Target
6502949e89095bebf4fe7e3c55588c12.exe
Size 1.0MB
Sample201025-4f2cflcqb2
SHA256 7b5eea1e71648ffa61e8ea5f6a520778633cd270ce36a67509dcce5b121e43ed
MD5 6502949e89095bebf4fe7e3c55588c12
SHA1 9f9fc7da1b8caff814fc34adfa4ccfd25a16c1a1
SHA512 826148bb90ff1b0419a60b4378d5919b57fca3adae700b2a77c1d1d4794182f36a7e2fd30eeb8dfd6dd279f035903e8b44c62cc2505fced87e4d467f4f1195b3
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
1584	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 480 wrote to memory of 2020	480	6502949e89095bebf4fe7e3c55588c12.exe	28
PID 480 wrote to memory of 2020	480	6502949e89095bebf4fe7e3c55588c12.exe	28
PID 480 wrote to memory of 2020	480	6502949e89095bebf4fe7e3c55588c12.exe	28
PID 480 wrote to memory of 2020	480	6502949e89095bebf4fe7e3c55588c12.exe	28
PID 480 wrote to memory of 1648	480	6502949e89095bebf4fe7e3c55588c12.exe	29
PID 480 wrote to memory of 1648	480	6502949e89095bebf4fe7e3c55588c12.exe	29
PID 480 wrote to memory of 1648	480	6502949e89095bebf4fe7e3c55588c12.exe	29
PID 480 wrote to memory of 1648	480	6502949e89095bebf4fe7e3c55588c12.exe	29
PID 1648 wrote to memory of 1584	1648	cmd.exe	31
PID 1648 wrote to memory of 1584	1648	cmd.exe	31
PID 1648 wrote to memory of 1584	1648	cmd.exe	31
PID 1648 wrote to memory of 1584	1648	cmd.exe	31

C:\Users\Admin\AppData\Local\Temp\6502949e89095bebf4fe7e3c55588c12.exe
"C:\Users\Admin\AppData\Local\Temp\6502949e89095bebf4fe7e3c55588c12.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:480
- C:\Users\Admin\AppData\Local\Temp\6502949e89095bebf4fe7e3c55588c12.exe
  C:\Users\Admin\AppData\Local\Temp\6502949e89095bebf4fe7e3c55588c12.exe /C
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2020
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\6502949e89095bebf4fe7e3c55588c12.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1648
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1584

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2020-1-0x0000000002750000-0x0000000002761000-memory.dmp

Download