qakbot | bc00bd86934394f9fb148f2c7f3579f0813019dbb9bdfee47a8b001bdb7b9985

General

Target

SecuriteInfo.com.Trojan.Inject3.39726.9675.20202.exe
Size

1.9MB
MD5

ffa0aa2fc0ad9b5c6a0af90dad01d1a6
SHA1

8ce18c5158dfa562cfc42297761f74b4cb3726ba
SHA256

bc00bd86934394f9fb148f2c7f3579f0813019dbb9bdfee47a8b001bdb7b9985
SHA512

206f5cf5972eca736978067d4e4679c608126667918749e6be6f4c88ab18ceca3c41cb33ac5e33f4835d67c1fdf44ff3c5186b9ce5804fdca2c26a1d0b4a3ee4

Score

10^/10

qakbot banker stealer trojan

Malware Config

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

756 PING.EXE

pid	process
756	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

SecuriteInfo.com.Trojan.Inject3.39726.9675.20202.exeSecuriteInfo.com.Trojan.Inject3.39726.9675.20202.exe

pid	process
1960	SecuriteInfo.com.Trojan.Inject3.39726.9675.20202.exe
1736	SecuriteInfo.com.Trojan.Inject3.39726.9675.20202.exe
1736	SecuriteInfo.com.Trojan.Inject3.39726.9675.20202.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

SecuriteInfo.com.Trojan.Inject3.39726.9675.20202.execmd.exe

description	pid	process	target process
PID 1960 wrote to memory of 1736	1960	SecuriteInfo.com.Trojan.Inject3.39726.9675.20202.exe	SecuriteInfo.com.Trojan.Inject3.39726.9675.20202.exe
PID 1960 wrote to memory of 1736	1960	SecuriteInfo.com.Trojan.Inject3.39726.9675.20202.exe	SecuriteInfo.com.Trojan.Inject3.39726.9675.20202.exe
PID 1960 wrote to memory of 1736	1960	SecuriteInfo.com.Trojan.Inject3.39726.9675.20202.exe	SecuriteInfo.com.Trojan.Inject3.39726.9675.20202.exe
PID 1960 wrote to memory of 1736	1960	SecuriteInfo.com.Trojan.Inject3.39726.9675.20202.exe	SecuriteInfo.com.Trojan.Inject3.39726.9675.20202.exe
PID 1960 wrote to memory of 1644	1960	SecuriteInfo.com.Trojan.Inject3.39726.9675.20202.exe	cmd.exe
PID 1960 wrote to memory of 1644	1960	SecuriteInfo.com.Trojan.Inject3.39726.9675.20202.exe	cmd.exe
PID 1960 wrote to memory of 1644	1960	SecuriteInfo.com.Trojan.Inject3.39726.9675.20202.exe	cmd.exe
PID 1960 wrote to memory of 1644	1960	SecuriteInfo.com.Trojan.Inject3.39726.9675.20202.exe	cmd.exe
PID 1644 wrote to memory of 756	1644	cmd.exe	PING.EXE
PID 1644 wrote to memory of 756	1644	cmd.exe	PING.EXE
PID 1644 wrote to memory of 756	1644	cmd.exe	PING.EXE
PID 1644 wrote to memory of 756	1644	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Inject3.39726.9675.20202.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Inject3.39726.9675.20202.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1960

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Inject3.39726.9675.20202.exe
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Inject3.39726.9675.20202.exe /C
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1736

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Inject3.39726.9675.20202.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1644

C:\Windows\SysWOW64\PING.EXE
ping.exe -n 6 127.0.0.1
3⤵
- Runs ping.exe
PID:756

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/756-3-0x0000000000000000-mapping.dmp

Download
memory/1644-2-0x0000000000000000-mapping.dmp

Download
memory/1736-0-0x0000000000000000-mapping.dmp

Download
memory/1736-1-0x0000000002320000-0x0000000002331000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing