qakbot | 915c3441f6637976dfe4c25a115911d8ec6cea3c0eb8f6d4c89daf8a33be58e2

General

Target

SecuriteInfo.com.Troj.Qbot-FS.11041.3342.exe
Size

1.2MB
MD5

9d5d00bb183e7e2690c3adf041565b02
SHA1

5ccf4e02ed3b4e2d4a902ab15f63e33ecb49801f
SHA256

915c3441f6637976dfe4c25a115911d8ec6cea3c0eb8f6d4c89daf8a33be58e2
SHA512

58a94d493d022aa4562c03bac76c2e9b2167dba321ad5916bcd4a14c42d59bf2a8ccf0359eb2296479ce71019e2a75bd84866f980aea88d3a256e0384e3af0bd

Score

10^/10

qakbot banker stealer trojan

Malware Config

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1676 PING.EXE

pid	process
1676	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

SecuriteInfo.com.Troj.Qbot-FS.11041.3342.exeSecuriteInfo.com.Troj.Qbot-FS.11041.3342.exe

pid	process
788	SecuriteInfo.com.Troj.Qbot-FS.11041.3342.exe
896	SecuriteInfo.com.Troj.Qbot-FS.11041.3342.exe
896	SecuriteInfo.com.Troj.Qbot-FS.11041.3342.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

SecuriteInfo.com.Troj.Qbot-FS.11041.3342.execmd.exe

description	pid	process	target process
PID 788 wrote to memory of 896	788	SecuriteInfo.com.Troj.Qbot-FS.11041.3342.exe	SecuriteInfo.com.Troj.Qbot-FS.11041.3342.exe
PID 788 wrote to memory of 896	788	SecuriteInfo.com.Troj.Qbot-FS.11041.3342.exe	SecuriteInfo.com.Troj.Qbot-FS.11041.3342.exe
PID 788 wrote to memory of 896	788	SecuriteInfo.com.Troj.Qbot-FS.11041.3342.exe	SecuriteInfo.com.Troj.Qbot-FS.11041.3342.exe
PID 788 wrote to memory of 896	788	SecuriteInfo.com.Troj.Qbot-FS.11041.3342.exe	SecuriteInfo.com.Troj.Qbot-FS.11041.3342.exe
PID 788 wrote to memory of 1288	788	SecuriteInfo.com.Troj.Qbot-FS.11041.3342.exe	cmd.exe
PID 788 wrote to memory of 1288	788	SecuriteInfo.com.Troj.Qbot-FS.11041.3342.exe	cmd.exe
PID 788 wrote to memory of 1288	788	SecuriteInfo.com.Troj.Qbot-FS.11041.3342.exe	cmd.exe
PID 788 wrote to memory of 1288	788	SecuriteInfo.com.Troj.Qbot-FS.11041.3342.exe	cmd.exe
PID 1288 wrote to memory of 1676	1288	cmd.exe	PING.EXE
PID 1288 wrote to memory of 1676	1288	cmd.exe	PING.EXE
PID 1288 wrote to memory of 1676	1288	cmd.exe	PING.EXE
PID 1288 wrote to memory of 1676	1288	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Troj.Qbot-FS.11041.3342.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Troj.Qbot-FS.11041.3342.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:788

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Troj.Qbot-FS.11041.3342.exe
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Troj.Qbot-FS.11041.3342.exe /C
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:896

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Troj.Qbot-FS.11041.3342.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1288

C:\Windows\SysWOW64\PING.EXE
ping.exe -n 6 127.0.0.1
3⤵
- Runs ping.exe
PID:1676

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/896-0-0x0000000000000000-mapping.dmp

Download
memory/896-1-0x00000000023B0000-0x00000000023C1000-memory.dmp

Filesize
68KB

Download
memory/1288-2-0x0000000000000000-mapping.dmp

Download
memory/1676-3-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing