qakbot | 4b86fd8b253aec2bf5f6603028b48ce2c106d265172d58d013006bb3fd99198f

Analysis

Target
4b86fd8b253aec2bf5f6603028b48ce2c106d265172d58d013006bb3fd99198f.exe
Size 270KB
Sample201110-5e222mec26
SHA256 4b86fd8b253aec2bf5f6603028b48ce2c106d265172d58d013006bb3fd99198f
MD5 2e7d0ace86ff77fb0f8caab622744a2a
SHA1 ce917310afa10330ccaf40a1257f18d1bd681a72
SHA512 b29700e41a93b8c40d5cb008c17aa1ac921a5278f3c5463c7da51313ba26f6499f0ad70daff905942e7fc00841a9d600e80af0f935299edead9fae0c02beb38d
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
1756	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1924	4b86fd8b253aec2bf5f6603028b48ce2c106d265172d58d013006bb3fd99198f.exe
1764	4b86fd8b253aec2bf5f6603028b48ce2c106d265172d58d013006bb3fd99198f.exe
1764	4b86fd8b253aec2bf5f6603028b48ce2c106d265172d58d013006bb3fd99198f.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 1764	1924	4b86fd8b253aec2bf5f6603028b48ce2c106d265172d58d013006bb3fd99198f.exe	29
PID 1924 wrote to memory of 1764	1924	4b86fd8b253aec2bf5f6603028b48ce2c106d265172d58d013006bb3fd99198f.exe	29
PID 1924 wrote to memory of 1764	1924	4b86fd8b253aec2bf5f6603028b48ce2c106d265172d58d013006bb3fd99198f.exe	29
PID 1924 wrote to memory of 1764	1924	4b86fd8b253aec2bf5f6603028b48ce2c106d265172d58d013006bb3fd99198f.exe	29
PID 1924 wrote to memory of 780	1924	4b86fd8b253aec2bf5f6603028b48ce2c106d265172d58d013006bb3fd99198f.exe	30
PID 1924 wrote to memory of 780	1924	4b86fd8b253aec2bf5f6603028b48ce2c106d265172d58d013006bb3fd99198f.exe	30
PID 1924 wrote to memory of 780	1924	4b86fd8b253aec2bf5f6603028b48ce2c106d265172d58d013006bb3fd99198f.exe	30
PID 1924 wrote to memory of 780	1924	4b86fd8b253aec2bf5f6603028b48ce2c106d265172d58d013006bb3fd99198f.exe	30
PID 780 wrote to memory of 1756	780	cmd.exe	32
PID 780 wrote to memory of 1756	780	cmd.exe	32
PID 780 wrote to memory of 1756	780	cmd.exe	32
PID 780 wrote to memory of 1756	780	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\4b86fd8b253aec2bf5f6603028b48ce2c106d265172d58d013006bb3fd99198f.exe
"C:\Users\Admin\AppData\Local\Temp\4b86fd8b253aec2bf5f6603028b48ce2c106d265172d58d013006bb3fd99198f.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Users\Admin\AppData\Local\Temp\4b86fd8b253aec2bf5f6603028b48ce2c106d265172d58d013006bb3fd99198f.exe
  C:\Users\Admin\AppData\Local\Temp\4b86fd8b253aec2bf5f6603028b48ce2c106d265172d58d013006bb3fd99198f.exe /C
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1764
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\4b86fd8b253aec2bf5f6603028b48ce2c106d265172d58d013006bb3fd99198f.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:780
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1756

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1764-1-0x0000000002580000-0x0000000002591000-memory.dmp

Download