qakbot | d8f9490e4319fafb48856d49659dc6fc84eba7652b26c57f77a2d901a3bca7cf

Analysis

Target
5df3d0b558935814fb9d05da6cb86e6c.exe
Size 838KB
Sample201025-jthybl5mhs
SHA256 d8f9490e4319fafb48856d49659dc6fc84eba7652b26c57f77a2d901a3bca7cf
MD5 5df3d0b558935814fb9d05da6cb86e6c
SHA1 557530daac5083452384308412285da622af7602
SHA512 99198c6cdf3a5ecc9ec5709de289f26ebb718e0faf0d6f4d1865393694f95fb37e68c21b1bf7c3954a12c84881b223f990f26a4cf3854605a647258a678c96f0
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
1948	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1456 wrote to memory of 1604	1456	5df3d0b558935814fb9d05da6cb86e6c.exe	28
PID 1456 wrote to memory of 1604	1456	5df3d0b558935814fb9d05da6cb86e6c.exe	28
PID 1456 wrote to memory of 1604	1456	5df3d0b558935814fb9d05da6cb86e6c.exe	28
PID 1456 wrote to memory of 1604	1456	5df3d0b558935814fb9d05da6cb86e6c.exe	28
PID 1456 wrote to memory of 1980	1456	5df3d0b558935814fb9d05da6cb86e6c.exe	29
PID 1456 wrote to memory of 1980	1456	5df3d0b558935814fb9d05da6cb86e6c.exe	29
PID 1456 wrote to memory of 1980	1456	5df3d0b558935814fb9d05da6cb86e6c.exe	29
PID 1456 wrote to memory of 1980	1456	5df3d0b558935814fb9d05da6cb86e6c.exe	29
PID 1980 wrote to memory of 1948	1980	cmd.exe	31
PID 1980 wrote to memory of 1948	1980	cmd.exe	31
PID 1980 wrote to memory of 1948	1980	cmd.exe	31
PID 1980 wrote to memory of 1948	1980	cmd.exe	31

C:\Users\Admin\AppData\Local\Temp\5df3d0b558935814fb9d05da6cb86e6c.exe
"C:\Users\Admin\AppData\Local\Temp\5df3d0b558935814fb9d05da6cb86e6c.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1456
- C:\Users\Admin\AppData\Local\Temp\5df3d0b558935814fb9d05da6cb86e6c.exe
  C:\Users\Admin\AppData\Local\Temp\5df3d0b558935814fb9d05da6cb86e6c.exe /C
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1604
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\5df3d0b558935814fb9d05da6cb86e6c.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1980
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1948

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1604-1-0x00000000027E0000-0x00000000027F1000-memory.dmp

Download