qakbot | 9084ca339691e1be6a9c65c1bcb9a404ace163b7ad2e6ea1f55f590d988990e3

General

Target

SecuriteInfo.com.Trojan.Agent.EQDY.30279.19455.exe
Size

2.0MB
MD5

8ee2e2ee071e248052de8b9ecd51431b
SHA1

5acc8a6425dc02db5650aa1a4854d192977815cc
SHA256

9084ca339691e1be6a9c65c1bcb9a404ace163b7ad2e6ea1f55f590d988990e3
SHA512

c6818e13db695d916c54c7faf4019815734f482ee8aa2752ff0b310c15a92f120cf2a167a499f3b3ea6f06755ab21de4e3859953dde95585f3ef49dd38881385

Score

10^/10

qakbot banker stealer trojan

Malware Config

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

792 PING.EXE

pid	process
792	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

SecuriteInfo.com.Trojan.Agent.EQDY.30279.19455.exeSecuriteInfo.com.Trojan.Agent.EQDY.30279.19455.exe

pid	process
1900	SecuriteInfo.com.Trojan.Agent.EQDY.30279.19455.exe
1768	SecuriteInfo.com.Trojan.Agent.EQDY.30279.19455.exe
1768	SecuriteInfo.com.Trojan.Agent.EQDY.30279.19455.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

SecuriteInfo.com.Trojan.Agent.EQDY.30279.19455.execmd.exe

description	pid	process	target process
PID 1900 wrote to memory of 1768	1900	SecuriteInfo.com.Trojan.Agent.EQDY.30279.19455.exe	SecuriteInfo.com.Trojan.Agent.EQDY.30279.19455.exe
PID 1900 wrote to memory of 1768	1900	SecuriteInfo.com.Trojan.Agent.EQDY.30279.19455.exe	SecuriteInfo.com.Trojan.Agent.EQDY.30279.19455.exe
PID 1900 wrote to memory of 1768	1900	SecuriteInfo.com.Trojan.Agent.EQDY.30279.19455.exe	SecuriteInfo.com.Trojan.Agent.EQDY.30279.19455.exe
PID 1900 wrote to memory of 1768	1900	SecuriteInfo.com.Trojan.Agent.EQDY.30279.19455.exe	SecuriteInfo.com.Trojan.Agent.EQDY.30279.19455.exe
PID 1900 wrote to memory of 1624	1900	SecuriteInfo.com.Trojan.Agent.EQDY.30279.19455.exe	cmd.exe
PID 1900 wrote to memory of 1624	1900	SecuriteInfo.com.Trojan.Agent.EQDY.30279.19455.exe	cmd.exe
PID 1900 wrote to memory of 1624	1900	SecuriteInfo.com.Trojan.Agent.EQDY.30279.19455.exe	cmd.exe
PID 1900 wrote to memory of 1624	1900	SecuriteInfo.com.Trojan.Agent.EQDY.30279.19455.exe	cmd.exe
PID 1624 wrote to memory of 792	1624	cmd.exe	PING.EXE
PID 1624 wrote to memory of 792	1624	cmd.exe	PING.EXE
PID 1624 wrote to memory of 792	1624	cmd.exe	PING.EXE
PID 1624 wrote to memory of 792	1624	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Agent.EQDY.30279.19455.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Agent.EQDY.30279.19455.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1900

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Agent.EQDY.30279.19455.exe
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Agent.EQDY.30279.19455.exe /C
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1768

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Agent.EQDY.30279.19455.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1624

C:\Windows\SysWOW64\PING.EXE
ping.exe -n 6 127.0.0.1
3⤵
- Runs ping.exe
PID:792

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/792-3-0x0000000000000000-mapping.dmp

Download
memory/1624-2-0x0000000000000000-mapping.dmp

Download
memory/1768-0-0x0000000000000000-mapping.dmp

Download
memory/1768-1-0x00000000024A0000-0x00000000024B1000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing