qakbot | 0a7b23f6d097b50a1e73f3a8957e0ccdbaf9c11d5e589a8c48cb93aad00a57f0

Analysis

Target
0a7b23f6d097b50a1e73f3a8957e0ccdbaf9c11d5e589a8c48cb93aad00a57f0.exe
Size 274KB
Sample201108-4zeppvx8gs
SHA256 0a7b23f6d097b50a1e73f3a8957e0ccdbaf9c11d5e589a8c48cb93aad00a57f0
MD5 3a4b2f940ce615551b18a7d1480f2f35
SHA1 707fc849fe57d25e73df1c856aa5ee04e2d67a6d
SHA512 2ffb096c72b66fa5aa217e8f256bf91f04d4fb3b07cbc4042a5486046756395030c0e54444456c3af7846b81d3d9ee495267616b983a14b96b1501f3ca8c4a8e
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
864	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1004	0a7b23f6d097b50a1e73f3a8957e0ccdbaf9c11d5e589a8c48cb93aad00a57f0.exe
1684	0a7b23f6d097b50a1e73f3a8957e0ccdbaf9c11d5e589a8c48cb93aad00a57f0.exe
1684	0a7b23f6d097b50a1e73f3a8957e0ccdbaf9c11d5e589a8c48cb93aad00a57f0.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1004 wrote to memory of 1684	1004	0a7b23f6d097b50a1e73f3a8957e0ccdbaf9c11d5e589a8c48cb93aad00a57f0.exe	29
PID 1004 wrote to memory of 1684	1004	0a7b23f6d097b50a1e73f3a8957e0ccdbaf9c11d5e589a8c48cb93aad00a57f0.exe	29
PID 1004 wrote to memory of 1684	1004	0a7b23f6d097b50a1e73f3a8957e0ccdbaf9c11d5e589a8c48cb93aad00a57f0.exe	29
PID 1004 wrote to memory of 1684	1004	0a7b23f6d097b50a1e73f3a8957e0ccdbaf9c11d5e589a8c48cb93aad00a57f0.exe	29
PID 1004 wrote to memory of 2036	1004	0a7b23f6d097b50a1e73f3a8957e0ccdbaf9c11d5e589a8c48cb93aad00a57f0.exe	30
PID 1004 wrote to memory of 2036	1004	0a7b23f6d097b50a1e73f3a8957e0ccdbaf9c11d5e589a8c48cb93aad00a57f0.exe	30
PID 1004 wrote to memory of 2036	1004	0a7b23f6d097b50a1e73f3a8957e0ccdbaf9c11d5e589a8c48cb93aad00a57f0.exe	30
PID 1004 wrote to memory of 2036	1004	0a7b23f6d097b50a1e73f3a8957e0ccdbaf9c11d5e589a8c48cb93aad00a57f0.exe	30
PID 2036 wrote to memory of 864	2036	cmd.exe	32
PID 2036 wrote to memory of 864	2036	cmd.exe	32
PID 2036 wrote to memory of 864	2036	cmd.exe	32
PID 2036 wrote to memory of 864	2036	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\0a7b23f6d097b50a1e73f3a8957e0ccdbaf9c11d5e589a8c48cb93aad00a57f0.exe
"C:\Users\Admin\AppData\Local\Temp\0a7b23f6d097b50a1e73f3a8957e0ccdbaf9c11d5e589a8c48cb93aad00a57f0.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1004
- C:\Users\Admin\AppData\Local\Temp\0a7b23f6d097b50a1e73f3a8957e0ccdbaf9c11d5e589a8c48cb93aad00a57f0.exe
  C:\Users\Admin\AppData\Local\Temp\0a7b23f6d097b50a1e73f3a8957e0ccdbaf9c11d5e589a8c48cb93aad00a57f0.exe /C
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1684
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\0a7b23f6d097b50a1e73f3a8957e0ccdbaf9c11d5e589a8c48cb93aad00a57f0.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2036
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:864

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1684-1-0x00000000025A0000-0x00000000025B1000-memory.dmp

Download