qakbot | bb49117541bbda33fd99a2a41c06be02005e513146f5ea2965a21c3ad504dc97

Analysis

Target
bb49117541bbda33fd99a2a41c06be02005e513146f5ea2965a21c3ad504dc97.exe
Size 2.7MB
Sample201109-nrgcss68jj
SHA256 bb49117541bbda33fd99a2a41c06be02005e513146f5ea2965a21c3ad504dc97
MD5 cb5af161e84ffe8a04db26a202e75104
SHA1 6e00dd9d762c3378055f093f840214d2369d5d79
SHA512 57fa677c00dc6164ef333cc811305d6bfe5215aa76e4cf4e0e63e0eb2c8aa5a039496682be6d0ebcaab56fb1a0cae5e88b7e4b49726a8dd1f2c15e0a6fb9d3f9
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
1440	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
644	bb49117541bbda33fd99a2a41c06be02005e513146f5ea2965a21c3ad504dc97.exe
1256	bb49117541bbda33fd99a2a41c06be02005e513146f5ea2965a21c3ad504dc97.exe
1256	bb49117541bbda33fd99a2a41c06be02005e513146f5ea2965a21c3ad504dc97.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 644 wrote to memory of 1256	644	bb49117541bbda33fd99a2a41c06be02005e513146f5ea2965a21c3ad504dc97.exe	29
PID 644 wrote to memory of 1256	644	bb49117541bbda33fd99a2a41c06be02005e513146f5ea2965a21c3ad504dc97.exe	29
PID 644 wrote to memory of 1256	644	bb49117541bbda33fd99a2a41c06be02005e513146f5ea2965a21c3ad504dc97.exe	29
PID 644 wrote to memory of 1256	644	bb49117541bbda33fd99a2a41c06be02005e513146f5ea2965a21c3ad504dc97.exe	29
PID 644 wrote to memory of 1612	644	bb49117541bbda33fd99a2a41c06be02005e513146f5ea2965a21c3ad504dc97.exe	30
PID 644 wrote to memory of 1612	644	bb49117541bbda33fd99a2a41c06be02005e513146f5ea2965a21c3ad504dc97.exe	30
PID 644 wrote to memory of 1612	644	bb49117541bbda33fd99a2a41c06be02005e513146f5ea2965a21c3ad504dc97.exe	30
PID 644 wrote to memory of 1612	644	bb49117541bbda33fd99a2a41c06be02005e513146f5ea2965a21c3ad504dc97.exe	30
PID 1612 wrote to memory of 1440	1612	cmd.exe	32
PID 1612 wrote to memory of 1440	1612	cmd.exe	32
PID 1612 wrote to memory of 1440	1612	cmd.exe	32
PID 1612 wrote to memory of 1440	1612	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\bb49117541bbda33fd99a2a41c06be02005e513146f5ea2965a21c3ad504dc97.exe
"C:\Users\Admin\AppData\Local\Temp\bb49117541bbda33fd99a2a41c06be02005e513146f5ea2965a21c3ad504dc97.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:644
- C:\Users\Admin\AppData\Local\Temp\bb49117541bbda33fd99a2a41c06be02005e513146f5ea2965a21c3ad504dc97.exe
  C:\Users\Admin\AppData\Local\Temp\bb49117541bbda33fd99a2a41c06be02005e513146f5ea2965a21c3ad504dc97.exe /C
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1256
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\bb49117541bbda33fd99a2a41c06be02005e513146f5ea2965a21c3ad504dc97.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1612
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1440

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1256-1-0x00000000026A0000-0x00000000026B1000-memory.dmp

Download