qakbot | f64800204e656c873d5e33b4de022a24be18465b5a06affa1f1140bb28b8fef1

Analysis

Target
f64800204e656c873d5e33b4de022a24be18465b5a06affa1f1140bb28b8fef1.exe
Size 257KB
Sample201108-aafp14gmla
SHA256 f64800204e656c873d5e33b4de022a24be18465b5a06affa1f1140bb28b8fef1
MD5 72a3b13d8dfdedffc81b92f5b0be8592
SHA1 73b318e636579a5297fe40d1efc5c2d6bffd069a
SHA512 d108cec025af0de98b38f1b1026b7ec8d79b86d91fd092d3a4ce45e235620a41b1d4156ba7e8a18287ad5c36f6e1d943b0cd17735d93d4d2d2dd71b611b4f76d
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
1612	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1068	f64800204e656c873d5e33b4de022a24be18465b5a06affa1f1140bb28b8fef1.exe
1088	f64800204e656c873d5e33b4de022a24be18465b5a06affa1f1140bb28b8fef1.exe
1088	f64800204e656c873d5e33b4de022a24be18465b5a06affa1f1140bb28b8fef1.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1068 wrote to memory of 1088	1068	f64800204e656c873d5e33b4de022a24be18465b5a06affa1f1140bb28b8fef1.exe	29
PID 1068 wrote to memory of 1088	1068	f64800204e656c873d5e33b4de022a24be18465b5a06affa1f1140bb28b8fef1.exe	29
PID 1068 wrote to memory of 1088	1068	f64800204e656c873d5e33b4de022a24be18465b5a06affa1f1140bb28b8fef1.exe	29
PID 1068 wrote to memory of 1088	1068	f64800204e656c873d5e33b4de022a24be18465b5a06affa1f1140bb28b8fef1.exe	29
PID 1068 wrote to memory of 1848	1068	f64800204e656c873d5e33b4de022a24be18465b5a06affa1f1140bb28b8fef1.exe	30
PID 1068 wrote to memory of 1848	1068	f64800204e656c873d5e33b4de022a24be18465b5a06affa1f1140bb28b8fef1.exe	30
PID 1068 wrote to memory of 1848	1068	f64800204e656c873d5e33b4de022a24be18465b5a06affa1f1140bb28b8fef1.exe	30
PID 1068 wrote to memory of 1848	1068	f64800204e656c873d5e33b4de022a24be18465b5a06affa1f1140bb28b8fef1.exe	30
PID 1848 wrote to memory of 1612	1848	cmd.exe	32
PID 1848 wrote to memory of 1612	1848	cmd.exe	32
PID 1848 wrote to memory of 1612	1848	cmd.exe	32
PID 1848 wrote to memory of 1612	1848	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\f64800204e656c873d5e33b4de022a24be18465b5a06affa1f1140bb28b8fef1.exe
"C:\Users\Admin\AppData\Local\Temp\f64800204e656c873d5e33b4de022a24be18465b5a06affa1f1140bb28b8fef1.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1068
- C:\Users\Admin\AppData\Local\Temp\f64800204e656c873d5e33b4de022a24be18465b5a06affa1f1140bb28b8fef1.exe
  C:\Users\Admin\AppData\Local\Temp\f64800204e656c873d5e33b4de022a24be18465b5a06affa1f1140bb28b8fef1.exe /C
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1088
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\f64800204e656c873d5e33b4de022a24be18465b5a06affa1f1140bb28b8fef1.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1848
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1612

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1088-1-0x00000000024E0000-0x00000000024F1000-memory.dmp

Download