qakbot | ff04c2946ed2b1a35e2df86e483046e7789c89d024fb1bfed62aa008ff83801d

Analysis

Target
ff04c2946ed2b1a35e2df86e483046e7789c89d024fb1bfed62aa008ff83801d.exe
Size 1.0MB
Sample201106-79whyhybl2
SHA256 ff04c2946ed2b1a35e2df86e483046e7789c89d024fb1bfed62aa008ff83801d
MD5 6cbf3d646d0f2ec4e38a48530bde6c2c
SHA1 38f0b64f69b74e852daac038cd124eb0923e78f5
SHA512 f78aa4f3a7fed78f37f97c69d9575846a71343401261c7e8d0752e8b8ab71d60bd4a659c5faf7472a2b9cc7946a499f70330fc45288ed3bb6a438ba2384fa28e
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
1904	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2036	ff04c2946ed2b1a35e2df86e483046e7789c89d024fb1bfed62aa008ff83801d.exe
744	ff04c2946ed2b1a35e2df86e483046e7789c89d024fb1bfed62aa008ff83801d.exe
744	ff04c2946ed2b1a35e2df86e483046e7789c89d024fb1bfed62aa008ff83801d.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 744	2036	ff04c2946ed2b1a35e2df86e483046e7789c89d024fb1bfed62aa008ff83801d.exe	29
PID 2036 wrote to memory of 744	2036	ff04c2946ed2b1a35e2df86e483046e7789c89d024fb1bfed62aa008ff83801d.exe	29
PID 2036 wrote to memory of 744	2036	ff04c2946ed2b1a35e2df86e483046e7789c89d024fb1bfed62aa008ff83801d.exe	29
PID 2036 wrote to memory of 744	2036	ff04c2946ed2b1a35e2df86e483046e7789c89d024fb1bfed62aa008ff83801d.exe	29
PID 2036 wrote to memory of 1636	2036	ff04c2946ed2b1a35e2df86e483046e7789c89d024fb1bfed62aa008ff83801d.exe	30
PID 2036 wrote to memory of 1636	2036	ff04c2946ed2b1a35e2df86e483046e7789c89d024fb1bfed62aa008ff83801d.exe	30
PID 2036 wrote to memory of 1636	2036	ff04c2946ed2b1a35e2df86e483046e7789c89d024fb1bfed62aa008ff83801d.exe	30
PID 2036 wrote to memory of 1636	2036	ff04c2946ed2b1a35e2df86e483046e7789c89d024fb1bfed62aa008ff83801d.exe	30
PID 1636 wrote to memory of 1904	1636	cmd.exe	32
PID 1636 wrote to memory of 1904	1636	cmd.exe	32
PID 1636 wrote to memory of 1904	1636	cmd.exe	32
PID 1636 wrote to memory of 1904	1636	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\ff04c2946ed2b1a35e2df86e483046e7789c89d024fb1bfed62aa008ff83801d.exe
"C:\Users\Admin\AppData\Local\Temp\ff04c2946ed2b1a35e2df86e483046e7789c89d024fb1bfed62aa008ff83801d.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Users\Admin\AppData\Local\Temp\ff04c2946ed2b1a35e2df86e483046e7789c89d024fb1bfed62aa008ff83801d.exe
  C:\Users\Admin\AppData\Local\Temp\ff04c2946ed2b1a35e2df86e483046e7789c89d024fb1bfed62aa008ff83801d.exe /C
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:744
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\ff04c2946ed2b1a35e2df86e483046e7789c89d024fb1bfed62aa008ff83801d.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1636
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1904

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/744-1-0x00000000024E0000-0x00000000024F1000-memory.dmp

Download