qakbot | 9e619d56b954dd079896ec90e9412621fd8600a4eca95be54a0b00607b9f9cec

Analysis

Target
9e619d56b954dd079896ec90e9412621fd8600a4eca95be54a0b00607b9f9cec.exe
Size 250KB
Sample201108-bklcl3ddb2
SHA256 9e619d56b954dd079896ec90e9412621fd8600a4eca95be54a0b00607b9f9cec
MD5 8cc74434e2a37c3af7943a83f7376972
SHA1 ab888fe0161fbdfa08cdba632b65f619fb7e234f
SHA512 7c8c40732946b3da17e8926df027fec89b4eaf016992eec7629bbec7a71d6c21efdd51d0a5f4849d4d9b5601d4797ba42a3ed4f2a3a8109e5ac3aa9a8fa57c8e
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
336	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
836	9e619d56b954dd079896ec90e9412621fd8600a4eca95be54a0b00607b9f9cec.exe
1084	9e619d56b954dd079896ec90e9412621fd8600a4eca95be54a0b00607b9f9cec.exe
1084	9e619d56b954dd079896ec90e9412621fd8600a4eca95be54a0b00607b9f9cec.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 836 wrote to memory of 1084	836	9e619d56b954dd079896ec90e9412621fd8600a4eca95be54a0b00607b9f9cec.exe	29
PID 836 wrote to memory of 1084	836	9e619d56b954dd079896ec90e9412621fd8600a4eca95be54a0b00607b9f9cec.exe	29
PID 836 wrote to memory of 1084	836	9e619d56b954dd079896ec90e9412621fd8600a4eca95be54a0b00607b9f9cec.exe	29
PID 836 wrote to memory of 1084	836	9e619d56b954dd079896ec90e9412621fd8600a4eca95be54a0b00607b9f9cec.exe	29
PID 836 wrote to memory of 1408	836	9e619d56b954dd079896ec90e9412621fd8600a4eca95be54a0b00607b9f9cec.exe	30
PID 836 wrote to memory of 1408	836	9e619d56b954dd079896ec90e9412621fd8600a4eca95be54a0b00607b9f9cec.exe	30
PID 836 wrote to memory of 1408	836	9e619d56b954dd079896ec90e9412621fd8600a4eca95be54a0b00607b9f9cec.exe	30
PID 836 wrote to memory of 1408	836	9e619d56b954dd079896ec90e9412621fd8600a4eca95be54a0b00607b9f9cec.exe	30
PID 1408 wrote to memory of 336	1408	cmd.exe	32
PID 1408 wrote to memory of 336	1408	cmd.exe	32
PID 1408 wrote to memory of 336	1408	cmd.exe	32
PID 1408 wrote to memory of 336	1408	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\9e619d56b954dd079896ec90e9412621fd8600a4eca95be54a0b00607b9f9cec.exe
"C:\Users\Admin\AppData\Local\Temp\9e619d56b954dd079896ec90e9412621fd8600a4eca95be54a0b00607b9f9cec.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:836
- C:\Users\Admin\AppData\Local\Temp\9e619d56b954dd079896ec90e9412621fd8600a4eca95be54a0b00607b9f9cec.exe
  C:\Users\Admin\AppData\Local\Temp\9e619d56b954dd079896ec90e9412621fd8600a4eca95be54a0b00607b9f9cec.exe /C
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1084
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\9e619d56b954dd079896ec90e9412621fd8600a4eca95be54a0b00607b9f9cec.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1408
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:336

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1084-1-0x00000000024A0000-0x00000000024B1000-memory.dmp

Download