qakbot | 044df9496396f39de1d8abb5fbf2841d528ecbf3f8c83283176bf6f65ece7325

Analysis

Target
044df9496396f39de1d8abb5fbf2841d528ecbf3f8c83283176bf6f65ece7325.exe
Size 270KB
Sample201110-b33menrw6s
SHA256 044df9496396f39de1d8abb5fbf2841d528ecbf3f8c83283176bf6f65ece7325
MD5 d245848da68e50a3fd06a4bc7f662fe0
SHA1 9d33a5c93cb816597aea7316fbd4734676cdc284
SHA512 e41c9946cb7d4f6b72c4b71de2687c592c5d1b405a1b97aca8d6a5f9450d95288904d6f435cb9e473aa40e0b2eb74e5c6b0637fed582e752f4924b01a3720270
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
900	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1756	044df9496396f39de1d8abb5fbf2841d528ecbf3f8c83283176bf6f65ece7325.exe
1460	044df9496396f39de1d8abb5fbf2841d528ecbf3f8c83283176bf6f65ece7325.exe
1460	044df9496396f39de1d8abb5fbf2841d528ecbf3f8c83283176bf6f65ece7325.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 1460	1756	044df9496396f39de1d8abb5fbf2841d528ecbf3f8c83283176bf6f65ece7325.exe	29
PID 1756 wrote to memory of 1460	1756	044df9496396f39de1d8abb5fbf2841d528ecbf3f8c83283176bf6f65ece7325.exe	29
PID 1756 wrote to memory of 1460	1756	044df9496396f39de1d8abb5fbf2841d528ecbf3f8c83283176bf6f65ece7325.exe	29
PID 1756 wrote to memory of 1460	1756	044df9496396f39de1d8abb5fbf2841d528ecbf3f8c83283176bf6f65ece7325.exe	29
PID 1756 wrote to memory of 316	1756	044df9496396f39de1d8abb5fbf2841d528ecbf3f8c83283176bf6f65ece7325.exe	30
PID 1756 wrote to memory of 316	1756	044df9496396f39de1d8abb5fbf2841d528ecbf3f8c83283176bf6f65ece7325.exe	30
PID 1756 wrote to memory of 316	1756	044df9496396f39de1d8abb5fbf2841d528ecbf3f8c83283176bf6f65ece7325.exe	30
PID 1756 wrote to memory of 316	1756	044df9496396f39de1d8abb5fbf2841d528ecbf3f8c83283176bf6f65ece7325.exe	30
PID 316 wrote to memory of 900	316	cmd.exe	32
PID 316 wrote to memory of 900	316	cmd.exe	32
PID 316 wrote to memory of 900	316	cmd.exe	32
PID 316 wrote to memory of 900	316	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\044df9496396f39de1d8abb5fbf2841d528ecbf3f8c83283176bf6f65ece7325.exe
"C:\Users\Admin\AppData\Local\Temp\044df9496396f39de1d8abb5fbf2841d528ecbf3f8c83283176bf6f65ece7325.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Users\Admin\AppData\Local\Temp\044df9496396f39de1d8abb5fbf2841d528ecbf3f8c83283176bf6f65ece7325.exe
  C:\Users\Admin\AppData\Local\Temp\044df9496396f39de1d8abb5fbf2841d528ecbf3f8c83283176bf6f65ece7325.exe /C
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1460
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\044df9496396f39de1d8abb5fbf2841d528ecbf3f8c83283176bf6f65ece7325.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:316
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:900

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1460-1-0x00000000024E0000-0x00000000024F1000-memory.dmp

Download