qakbot | bb114f4de8e76b31de99bf0e09cb03dfc3883b4e4a5171b6b67445040df91ed8

Analysis

Target
bb114f4de8e76b31de99bf0e09cb03dfc3883b4e4a5171b6b67445040df91ed8.exe
Size 270KB
Sample201109-hf4lbebj2n
SHA256 bb114f4de8e76b31de99bf0e09cb03dfc3883b4e4a5171b6b67445040df91ed8
MD5 579167f6c6d59be12817b2b6e1ebd0da
SHA1 80e2942803cfd9e7f92a7f1336ecf3e010ba8336
SHA512 eac544988a9246d4702f1e0eefc2cb576fcf3824d021a790cef90363269958abacec02a21fd13ab923f0349138afc2c79cf55bbc0c6f49e8648b6ac0238f828f
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
1676	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1056	bb114f4de8e76b31de99bf0e09cb03dfc3883b4e4a5171b6b67445040df91ed8.exe
1496	bb114f4de8e76b31de99bf0e09cb03dfc3883b4e4a5171b6b67445040df91ed8.exe
1496	bb114f4de8e76b31de99bf0e09cb03dfc3883b4e4a5171b6b67445040df91ed8.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1056 wrote to memory of 1496	1056	bb114f4de8e76b31de99bf0e09cb03dfc3883b4e4a5171b6b67445040df91ed8.exe	29
PID 1056 wrote to memory of 1496	1056	bb114f4de8e76b31de99bf0e09cb03dfc3883b4e4a5171b6b67445040df91ed8.exe	29
PID 1056 wrote to memory of 1496	1056	bb114f4de8e76b31de99bf0e09cb03dfc3883b4e4a5171b6b67445040df91ed8.exe	29
PID 1056 wrote to memory of 1496	1056	bb114f4de8e76b31de99bf0e09cb03dfc3883b4e4a5171b6b67445040df91ed8.exe	29
PID 1056 wrote to memory of 1684	1056	bb114f4de8e76b31de99bf0e09cb03dfc3883b4e4a5171b6b67445040df91ed8.exe	30
PID 1056 wrote to memory of 1684	1056	bb114f4de8e76b31de99bf0e09cb03dfc3883b4e4a5171b6b67445040df91ed8.exe	30
PID 1056 wrote to memory of 1684	1056	bb114f4de8e76b31de99bf0e09cb03dfc3883b4e4a5171b6b67445040df91ed8.exe	30
PID 1056 wrote to memory of 1684	1056	bb114f4de8e76b31de99bf0e09cb03dfc3883b4e4a5171b6b67445040df91ed8.exe	30
PID 1684 wrote to memory of 1676	1684	cmd.exe	32
PID 1684 wrote to memory of 1676	1684	cmd.exe	32
PID 1684 wrote to memory of 1676	1684	cmd.exe	32
PID 1684 wrote to memory of 1676	1684	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\bb114f4de8e76b31de99bf0e09cb03dfc3883b4e4a5171b6b67445040df91ed8.exe
"C:\Users\Admin\AppData\Local\Temp\bb114f4de8e76b31de99bf0e09cb03dfc3883b4e4a5171b6b67445040df91ed8.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Users\Admin\AppData\Local\Temp\bb114f4de8e76b31de99bf0e09cb03dfc3883b4e4a5171b6b67445040df91ed8.exe
  C:\Users\Admin\AppData\Local\Temp\bb114f4de8e76b31de99bf0e09cb03dfc3883b4e4a5171b6b67445040df91ed8.exe /C
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1496
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\bb114f4de8e76b31de99bf0e09cb03dfc3883b4e4a5171b6b67445040df91ed8.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1684
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1676

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1496-1-0x0000000002500000-0x0000000002511000-memory.dmp

Download