qakbot | 6c9675f638fbb25404e6ebce311734be0cb2317b919b0c7b149b8fc98fabf608

Analysis

Target
6c9675f638fbb25404e6ebce311734be0cb2317b919b0c7b149b8fc98fabf608.exe
Size 270KB
Sample201110-151ekxaace
SHA256 6c9675f638fbb25404e6ebce311734be0cb2317b919b0c7b149b8fc98fabf608
MD5 73d89a4aefb0da45757c040b63caefce
SHA1 3b375a3969d1855b5fa93277ce3165e3226cdec9
SHA512 619b89e0563aacb01a15a165f5d0515a6944ea688189a6b8531a33496489861962d6beb34c663711ea9563d2787d43344a1dc93bcc82725474595cb4977aad3f
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
1100	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1848	6c9675f638fbb25404e6ebce311734be0cb2317b919b0c7b149b8fc98fabf608.exe
1688	6c9675f638fbb25404e6ebce311734be0cb2317b919b0c7b149b8fc98fabf608.exe
1688	6c9675f638fbb25404e6ebce311734be0cb2317b919b0c7b149b8fc98fabf608.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 1688	1848	6c9675f638fbb25404e6ebce311734be0cb2317b919b0c7b149b8fc98fabf608.exe	29
PID 1848 wrote to memory of 1688	1848	6c9675f638fbb25404e6ebce311734be0cb2317b919b0c7b149b8fc98fabf608.exe	29
PID 1848 wrote to memory of 1688	1848	6c9675f638fbb25404e6ebce311734be0cb2317b919b0c7b149b8fc98fabf608.exe	29
PID 1848 wrote to memory of 1688	1848	6c9675f638fbb25404e6ebce311734be0cb2317b919b0c7b149b8fc98fabf608.exe	29
PID 1848 wrote to memory of 912	1848	6c9675f638fbb25404e6ebce311734be0cb2317b919b0c7b149b8fc98fabf608.exe	30
PID 1848 wrote to memory of 912	1848	6c9675f638fbb25404e6ebce311734be0cb2317b919b0c7b149b8fc98fabf608.exe	30
PID 1848 wrote to memory of 912	1848	6c9675f638fbb25404e6ebce311734be0cb2317b919b0c7b149b8fc98fabf608.exe	30
PID 1848 wrote to memory of 912	1848	6c9675f638fbb25404e6ebce311734be0cb2317b919b0c7b149b8fc98fabf608.exe	30
PID 912 wrote to memory of 1100	912	cmd.exe	32
PID 912 wrote to memory of 1100	912	cmd.exe	32
PID 912 wrote to memory of 1100	912	cmd.exe	32
PID 912 wrote to memory of 1100	912	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\6c9675f638fbb25404e6ebce311734be0cb2317b919b0c7b149b8fc98fabf608.exe
"C:\Users\Admin\AppData\Local\Temp\6c9675f638fbb25404e6ebce311734be0cb2317b919b0c7b149b8fc98fabf608.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Users\Admin\AppData\Local\Temp\6c9675f638fbb25404e6ebce311734be0cb2317b919b0c7b149b8fc98fabf608.exe
  C:\Users\Admin\AppData\Local\Temp\6c9675f638fbb25404e6ebce311734be0cb2317b919b0c7b149b8fc98fabf608.exe /C
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1688
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\6c9675f638fbb25404e6ebce311734be0cb2317b919b0c7b149b8fc98fabf608.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:912
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1100

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1688-1-0x0000000002570000-0x0000000002581000-memory.dmp

Download