da97d22eb7016e9daa46962d9c6eb47d9227ad534a996531b793cd00f71b36a0

Analysis

Target

SecuriteInfo.com.Troj.Qbot-FS.19822.1181.exe
Size

620KB
MD5

377a9b356f6e80ec29083be9f5b8f74f
SHA1

e69d5175c3db1190927f680eb4173b2abd64fa19
SHA256

da97d22eb7016e9daa46962d9c6eb47d9227ad534a996531b793cd00f71b36a0
SHA512

31c4a38c48f85e48b87bfb0fcb557ee5305227ec4e1f5690291800dfa79839a143642eb126b24574c504848f52c43c806124fc14ea7cfe920f35dc0d4bfad60e

Score

1^/10

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1432 PING.EXE

pid	process
1432	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

SecuriteInfo.com.Troj.Qbot-FS.19822.1181.exeSecuriteInfo.com.Troj.Qbot-FS.19822.1181.exe

pid	process
1688	SecuriteInfo.com.Troj.Qbot-FS.19822.1181.exe
1792	SecuriteInfo.com.Troj.Qbot-FS.19822.1181.exe
1792	SecuriteInfo.com.Troj.Qbot-FS.19822.1181.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

SecuriteInfo.com.Troj.Qbot-FS.19822.1181.execmd.exe

description	pid	process	target process
PID 1688 wrote to memory of 1792	1688	SecuriteInfo.com.Troj.Qbot-FS.19822.1181.exe	SecuriteInfo.com.Troj.Qbot-FS.19822.1181.exe
PID 1688 wrote to memory of 1792	1688	SecuriteInfo.com.Troj.Qbot-FS.19822.1181.exe	SecuriteInfo.com.Troj.Qbot-FS.19822.1181.exe
PID 1688 wrote to memory of 1792	1688	SecuriteInfo.com.Troj.Qbot-FS.19822.1181.exe	SecuriteInfo.com.Troj.Qbot-FS.19822.1181.exe
PID 1688 wrote to memory of 1792	1688	SecuriteInfo.com.Troj.Qbot-FS.19822.1181.exe	SecuriteInfo.com.Troj.Qbot-FS.19822.1181.exe
PID 1688 wrote to memory of 1532	1688	SecuriteInfo.com.Troj.Qbot-FS.19822.1181.exe	cmd.exe
PID 1688 wrote to memory of 1532	1688	SecuriteInfo.com.Troj.Qbot-FS.19822.1181.exe	cmd.exe
PID 1688 wrote to memory of 1532	1688	SecuriteInfo.com.Troj.Qbot-FS.19822.1181.exe	cmd.exe
PID 1688 wrote to memory of 1532	1688	SecuriteInfo.com.Troj.Qbot-FS.19822.1181.exe	cmd.exe
PID 1532 wrote to memory of 1432	1532	cmd.exe	PING.EXE
PID 1532 wrote to memory of 1432	1532	cmd.exe	PING.EXE
PID 1532 wrote to memory of 1432	1532	cmd.exe	PING.EXE
PID 1532 wrote to memory of 1432	1532	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Troj.Qbot-FS.19822.1181.exe
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Troj.Qbot-FS.19822.1181.exe /C
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1792

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Troj.Qbot-FS.19822.1181.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1532

C:\Windows\SysWOW64\PING.EXE
ping.exe -n 6 127.0.0.1
3⤵
- Runs ping.exe
PID:1432

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1432-3-0x0000000000000000-mapping.dmp

Download
memory/1532-2-0x0000000000000000-mapping.dmp

Download
memory/1792-0-0x0000000000000000-mapping.dmp

Download
memory/1792-1-0x0000000002420000-0x0000000002431000-memory.dmp

Filesize
68KB

Download