qakbot | 43fb8dd18c05f5c3fa1bda103cbad8066dafb4d4fb1871bc7c61a7cb1c040a56

Analysis

Target
43fb8dd18c05f5c3fa1bda103cbad8066dafb4d4fb1871bc7c61a7cb1c040a56.exe
Size 270KB
Sample201110-chkc1n83es
SHA256 43fb8dd18c05f5c3fa1bda103cbad8066dafb4d4fb1871bc7c61a7cb1c040a56
MD5 a632fb40fdaaeb05eef2d224f2f9cca5
SHA1 c6bed4aaf4c6bd157335f3625e645ebfcc51ae4d
SHA512 4dd72c243dc9151d06376747087dabf7198a51fd73d431d0c39122496642f90c648b6539b77c05f38f83c774750337023e844add06e65145f2a4453d0791b3a6
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
1548	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
484	43fb8dd18c05f5c3fa1bda103cbad8066dafb4d4fb1871bc7c61a7cb1c040a56.exe
1284	43fb8dd18c05f5c3fa1bda103cbad8066dafb4d4fb1871bc7c61a7cb1c040a56.exe
1284	43fb8dd18c05f5c3fa1bda103cbad8066dafb4d4fb1871bc7c61a7cb1c040a56.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 484 wrote to memory of 1284	484	43fb8dd18c05f5c3fa1bda103cbad8066dafb4d4fb1871bc7c61a7cb1c040a56.exe	29
PID 484 wrote to memory of 1284	484	43fb8dd18c05f5c3fa1bda103cbad8066dafb4d4fb1871bc7c61a7cb1c040a56.exe	29
PID 484 wrote to memory of 1284	484	43fb8dd18c05f5c3fa1bda103cbad8066dafb4d4fb1871bc7c61a7cb1c040a56.exe	29
PID 484 wrote to memory of 1284	484	43fb8dd18c05f5c3fa1bda103cbad8066dafb4d4fb1871bc7c61a7cb1c040a56.exe	29
PID 484 wrote to memory of 1460	484	43fb8dd18c05f5c3fa1bda103cbad8066dafb4d4fb1871bc7c61a7cb1c040a56.exe	30
PID 484 wrote to memory of 1460	484	43fb8dd18c05f5c3fa1bda103cbad8066dafb4d4fb1871bc7c61a7cb1c040a56.exe	30
PID 484 wrote to memory of 1460	484	43fb8dd18c05f5c3fa1bda103cbad8066dafb4d4fb1871bc7c61a7cb1c040a56.exe	30
PID 484 wrote to memory of 1460	484	43fb8dd18c05f5c3fa1bda103cbad8066dafb4d4fb1871bc7c61a7cb1c040a56.exe	30
PID 1460 wrote to memory of 1548	1460	cmd.exe	32
PID 1460 wrote to memory of 1548	1460	cmd.exe	32
PID 1460 wrote to memory of 1548	1460	cmd.exe	32
PID 1460 wrote to memory of 1548	1460	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\43fb8dd18c05f5c3fa1bda103cbad8066dafb4d4fb1871bc7c61a7cb1c040a56.exe
"C:\Users\Admin\AppData\Local\Temp\43fb8dd18c05f5c3fa1bda103cbad8066dafb4d4fb1871bc7c61a7cb1c040a56.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:484
- C:\Users\Admin\AppData\Local\Temp\43fb8dd18c05f5c3fa1bda103cbad8066dafb4d4fb1871bc7c61a7cb1c040a56.exe
  C:\Users\Admin\AppData\Local\Temp\43fb8dd18c05f5c3fa1bda103cbad8066dafb4d4fb1871bc7c61a7cb1c040a56.exe /C
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1284
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\43fb8dd18c05f5c3fa1bda103cbad8066dafb4d4fb1871bc7c61a7cb1c040a56.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1460
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1548

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1284-1-0x00000000026B0000-0x00000000026C1000-memory.dmp

Download