qakbot | 61e1c319c54ed2c6ff60c0fa623f66189aa25a71854e06ffdb408e928bf01832

General

Target

SecuriteInfo.com.Win32.Kryptik.HDBX.19253.exe
Size

1.8MB
MD5

df44e606f03e953e2407f6952993e094
SHA1

001411061628905aaf57e9f9ac4036ceced91f79
SHA256

61e1c319c54ed2c6ff60c0fa623f66189aa25a71854e06ffdb408e928bf01832
SHA512

37ad4cc8dc47c9419dbdea83c252d1c8229325c6f135576f2b7871b5fed22f9bc32603f49f84ca7593c516c0e82aa43498d89aaca7d7413611d3179d3e3c4ca2

Score

10^/10

qakbot banker stealer trojan

Malware Config

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1596 PING.EXE

pid	process
1596	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

SecuriteInfo.com.Win32.Kryptik.HDBX.19253.exeSecuriteInfo.com.Win32.Kryptik.HDBX.19253.exe

pid	process
1852	SecuriteInfo.com.Win32.Kryptik.HDBX.19253.exe
1784	SecuriteInfo.com.Win32.Kryptik.HDBX.19253.exe
1784	SecuriteInfo.com.Win32.Kryptik.HDBX.19253.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

SecuriteInfo.com.Win32.Kryptik.HDBX.19253.execmd.exe

description	pid	process	target process
PID 1852 wrote to memory of 1784	1852	SecuriteInfo.com.Win32.Kryptik.HDBX.19253.exe	SecuriteInfo.com.Win32.Kryptik.HDBX.19253.exe
PID 1852 wrote to memory of 1784	1852	SecuriteInfo.com.Win32.Kryptik.HDBX.19253.exe	SecuriteInfo.com.Win32.Kryptik.HDBX.19253.exe
PID 1852 wrote to memory of 1784	1852	SecuriteInfo.com.Win32.Kryptik.HDBX.19253.exe	SecuriteInfo.com.Win32.Kryptik.HDBX.19253.exe
PID 1852 wrote to memory of 1784	1852	SecuriteInfo.com.Win32.Kryptik.HDBX.19253.exe	SecuriteInfo.com.Win32.Kryptik.HDBX.19253.exe
PID 1852 wrote to memory of 1648	1852	SecuriteInfo.com.Win32.Kryptik.HDBX.19253.exe	cmd.exe
PID 1852 wrote to memory of 1648	1852	SecuriteInfo.com.Win32.Kryptik.HDBX.19253.exe	cmd.exe
PID 1852 wrote to memory of 1648	1852	SecuriteInfo.com.Win32.Kryptik.HDBX.19253.exe	cmd.exe
PID 1852 wrote to memory of 1648	1852	SecuriteInfo.com.Win32.Kryptik.HDBX.19253.exe	cmd.exe
PID 1648 wrote to memory of 1596	1648	cmd.exe	PING.EXE
PID 1648 wrote to memory of 1596	1648	cmd.exe	PING.EXE
PID 1648 wrote to memory of 1596	1648	cmd.exe	PING.EXE
PID 1648 wrote to memory of 1596	1648	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Kryptik.HDBX.19253.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Kryptik.HDBX.19253.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1852

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Kryptik.HDBX.19253.exe
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Kryptik.HDBX.19253.exe /C
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1784

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Kryptik.HDBX.19253.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1648

C:\Windows\SysWOW64\PING.EXE
ping.exe -n 6 127.0.0.1
3⤵
- Runs ping.exe
PID:1596

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1596-3-0x0000000000000000-mapping.dmp

Download
memory/1648-2-0x0000000000000000-mapping.dmp

Download
memory/1784-0-0x0000000000000000-mapping.dmp

Download
memory/1784-1-0x0000000002570000-0x0000000002581000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing