qakbot | ee57658d9452e64a59c91c5f86f30b14b650e716d9cef472e16f7f45f244477e

General

Target

SecuriteInfo.com.Trojan.Agent.EQDY.8332.1464.exe
Size

2.0MB
MD5

beea5a38dd2c801097ce28c737c5640e
SHA1

497050a91f506e67da74e5c830a6db0726730222
SHA256

ee57658d9452e64a59c91c5f86f30b14b650e716d9cef472e16f7f45f244477e
SHA512

cb80c3c6c51706e4ea79471384d3c474a658652abaf825b2eb11ed74921fa44a6f5a7b0094e2f2f5aa64d846ea0d878705274114b513e040061ee456523dd78f

Score

10^/10

qakbot banker stealer trojan

Malware Config

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1632 PING.EXE

pid	process
1632	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

SecuriteInfo.com.Trojan.Agent.EQDY.8332.1464.exeSecuriteInfo.com.Trojan.Agent.EQDY.8332.1464.exe

pid	process
1688	SecuriteInfo.com.Trojan.Agent.EQDY.8332.1464.exe
1712	SecuriteInfo.com.Trojan.Agent.EQDY.8332.1464.exe
1712	SecuriteInfo.com.Trojan.Agent.EQDY.8332.1464.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

SecuriteInfo.com.Trojan.Agent.EQDY.8332.1464.execmd.exe

description	pid	process	target process
PID 1688 wrote to memory of 1712	1688	SecuriteInfo.com.Trojan.Agent.EQDY.8332.1464.exe	SecuriteInfo.com.Trojan.Agent.EQDY.8332.1464.exe
PID 1688 wrote to memory of 1712	1688	SecuriteInfo.com.Trojan.Agent.EQDY.8332.1464.exe	SecuriteInfo.com.Trojan.Agent.EQDY.8332.1464.exe
PID 1688 wrote to memory of 1712	1688	SecuriteInfo.com.Trojan.Agent.EQDY.8332.1464.exe	SecuriteInfo.com.Trojan.Agent.EQDY.8332.1464.exe
PID 1688 wrote to memory of 1712	1688	SecuriteInfo.com.Trojan.Agent.EQDY.8332.1464.exe	SecuriteInfo.com.Trojan.Agent.EQDY.8332.1464.exe
PID 1688 wrote to memory of 1244	1688	SecuriteInfo.com.Trojan.Agent.EQDY.8332.1464.exe	cmd.exe
PID 1688 wrote to memory of 1244	1688	SecuriteInfo.com.Trojan.Agent.EQDY.8332.1464.exe	cmd.exe
PID 1688 wrote to memory of 1244	1688	SecuriteInfo.com.Trojan.Agent.EQDY.8332.1464.exe	cmd.exe
PID 1688 wrote to memory of 1244	1688	SecuriteInfo.com.Trojan.Agent.EQDY.8332.1464.exe	cmd.exe
PID 1244 wrote to memory of 1632	1244	cmd.exe	PING.EXE
PID 1244 wrote to memory of 1632	1244	cmd.exe	PING.EXE
PID 1244 wrote to memory of 1632	1244	cmd.exe	PING.EXE
PID 1244 wrote to memory of 1632	1244	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Agent.EQDY.8332.1464.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Agent.EQDY.8332.1464.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1688

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Agent.EQDY.8332.1464.exe
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Agent.EQDY.8332.1464.exe /C
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1712

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Agent.EQDY.8332.1464.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1244

C:\Windows\SysWOW64\PING.EXE
ping.exe -n 6 127.0.0.1
3⤵
- Runs ping.exe
PID:1632

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1244-2-0x0000000000000000-mapping.dmp

Download
memory/1632-3-0x0000000000000000-mapping.dmp

Download
memory/1712-0-0x0000000000000000-mapping.dmp

Download
memory/1712-1-0x0000000002430000-0x0000000002441000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing