qakbot | 972fb4092f04ba1bbdc82d137f36ac43bcc66375fa3d6dabf33197e61c8ff9d8

Analysis

Target
972fb4092f04ba1bbdc82d137f36ac43bcc66375fa3d6dabf33197e61c8ff9d8.exe
Size 257KB
Sample201110-6pa71dss8e
SHA256 972fb4092f04ba1bbdc82d137f36ac43bcc66375fa3d6dabf33197e61c8ff9d8
MD5 d60dfb70d88f04ac05791588cfb70e7f
SHA1 9ef08c1888f352ca259b67062dd44b8211954aee
SHA512 477f9db2ccc7e52c5c00817eb71981f9705887013264a19de187f75bca2999fdf78ccc817e479383f0f1187dbc5178917786ebf674dc6a04a65ffbf595697350
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
1472	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
596	972fb4092f04ba1bbdc82d137f36ac43bcc66375fa3d6dabf33197e61c8ff9d8.exe
1680	972fb4092f04ba1bbdc82d137f36ac43bcc66375fa3d6dabf33197e61c8ff9d8.exe
1680	972fb4092f04ba1bbdc82d137f36ac43bcc66375fa3d6dabf33197e61c8ff9d8.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 596 wrote to memory of 1680	596	972fb4092f04ba1bbdc82d137f36ac43bcc66375fa3d6dabf33197e61c8ff9d8.exe	29
PID 596 wrote to memory of 1680	596	972fb4092f04ba1bbdc82d137f36ac43bcc66375fa3d6dabf33197e61c8ff9d8.exe	29
PID 596 wrote to memory of 1680	596	972fb4092f04ba1bbdc82d137f36ac43bcc66375fa3d6dabf33197e61c8ff9d8.exe	29
PID 596 wrote to memory of 1680	596	972fb4092f04ba1bbdc82d137f36ac43bcc66375fa3d6dabf33197e61c8ff9d8.exe	29
PID 596 wrote to memory of 1300	596	972fb4092f04ba1bbdc82d137f36ac43bcc66375fa3d6dabf33197e61c8ff9d8.exe	30
PID 596 wrote to memory of 1300	596	972fb4092f04ba1bbdc82d137f36ac43bcc66375fa3d6dabf33197e61c8ff9d8.exe	30
PID 596 wrote to memory of 1300	596	972fb4092f04ba1bbdc82d137f36ac43bcc66375fa3d6dabf33197e61c8ff9d8.exe	30
PID 596 wrote to memory of 1300	596	972fb4092f04ba1bbdc82d137f36ac43bcc66375fa3d6dabf33197e61c8ff9d8.exe	30
PID 1300 wrote to memory of 1472	1300	cmd.exe	32
PID 1300 wrote to memory of 1472	1300	cmd.exe	32
PID 1300 wrote to memory of 1472	1300	cmd.exe	32
PID 1300 wrote to memory of 1472	1300	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\972fb4092f04ba1bbdc82d137f36ac43bcc66375fa3d6dabf33197e61c8ff9d8.exe
"C:\Users\Admin\AppData\Local\Temp\972fb4092f04ba1bbdc82d137f36ac43bcc66375fa3d6dabf33197e61c8ff9d8.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:596
- C:\Users\Admin\AppData\Local\Temp\972fb4092f04ba1bbdc82d137f36ac43bcc66375fa3d6dabf33197e61c8ff9d8.exe
  C:\Users\Admin\AppData\Local\Temp\972fb4092f04ba1bbdc82d137f36ac43bcc66375fa3d6dabf33197e61c8ff9d8.exe /C
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1680
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\972fb4092f04ba1bbdc82d137f36ac43bcc66375fa3d6dabf33197e61c8ff9d8.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1300
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1472

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1680-1-0x0000000002630000-0x0000000002641000-memory.dmp

Download