qakbot | 6335194fe6aff4a5aee7f31cb566f019fb7e8e9b1c4e567fb39f64d048b9fb82

Analysis

Target
e6374658a027a8727ca6b0134d790a41.exe
Size 212KB
Sample201025-xxyllapy3n
SHA256 6335194fe6aff4a5aee7f31cb566f019fb7e8e9b1c4e567fb39f64d048b9fb82
MD5 e6374658a027a8727ca6b0134d790a41
SHA1 08a17e13ae11b69fe8a979943c9bd0cb1a16eef2
SHA512 2f992db3b469c9069c74da3203bba5c115e9427e88be49b2f7eecc65d44559af62a1da9479c4bcecc914b935ec2da29245fef45b89788095d3b1570dca64f074
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
1932	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1400 wrote to memory of 1692	1400	e6374658a027a8727ca6b0134d790a41.exe	28
PID 1400 wrote to memory of 1692	1400	e6374658a027a8727ca6b0134d790a41.exe	28
PID 1400 wrote to memory of 1692	1400	e6374658a027a8727ca6b0134d790a41.exe	28
PID 1400 wrote to memory of 1692	1400	e6374658a027a8727ca6b0134d790a41.exe	28
PID 1400 wrote to memory of 1968	1400	e6374658a027a8727ca6b0134d790a41.exe	29
PID 1400 wrote to memory of 1968	1400	e6374658a027a8727ca6b0134d790a41.exe	29
PID 1400 wrote to memory of 1968	1400	e6374658a027a8727ca6b0134d790a41.exe	29
PID 1400 wrote to memory of 1968	1400	e6374658a027a8727ca6b0134d790a41.exe	29
PID 1968 wrote to memory of 1932	1968	cmd.exe	31
PID 1968 wrote to memory of 1932	1968	cmd.exe	31
PID 1968 wrote to memory of 1932	1968	cmd.exe	31
PID 1968 wrote to memory of 1932	1968	cmd.exe	31

C:\Users\Admin\AppData\Local\Temp\e6374658a027a8727ca6b0134d790a41.exe
"C:\Users\Admin\AppData\Local\Temp\e6374658a027a8727ca6b0134d790a41.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1400
- C:\Users\Admin\AppData\Local\Temp\e6374658a027a8727ca6b0134d790a41.exe
  C:\Users\Admin\AppData\Local\Temp\e6374658a027a8727ca6b0134d790a41.exe /C
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1692
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\e6374658a027a8727ca6b0134d790a41.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1968
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1932

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1692-1-0x00000000025F0000-0x0000000002601000-memory.dmp

Download