qakbot | a9f43c19c6b0d3d50d9fce59baa60651d03282169a4a62aa9ef9f0fe370dd927

Analysis

Target
a9f43c19c6b0d3d50d9fce59baa60651d03282169a4a62aa9ef9f0fe370dd927.exe
Size 270KB
Sample201110-jdvnvzf65e
SHA256 a9f43c19c6b0d3d50d9fce59baa60651d03282169a4a62aa9ef9f0fe370dd927
MD5 6a63909442fde08d60478659edc90e95
SHA1 9540a1d05085b8da05727566cf4a22bb800001ef
SHA512 f82983baf1c895c2a233dfc7edf8663e6456d603516c94a8a33224b3e3ecab6a8d10279c9c7f295e656fc06433ae64abb51e09d3c0c30708091c7f0259a38fea
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
852	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1808	a9f43c19c6b0d3d50d9fce59baa60651d03282169a4a62aa9ef9f0fe370dd927.exe
1688	a9f43c19c6b0d3d50d9fce59baa60651d03282169a4a62aa9ef9f0fe370dd927.exe
1688	a9f43c19c6b0d3d50d9fce59baa60651d03282169a4a62aa9ef9f0fe370dd927.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1808 wrote to memory of 1688	1808	a9f43c19c6b0d3d50d9fce59baa60651d03282169a4a62aa9ef9f0fe370dd927.exe	29
PID 1808 wrote to memory of 1688	1808	a9f43c19c6b0d3d50d9fce59baa60651d03282169a4a62aa9ef9f0fe370dd927.exe	29
PID 1808 wrote to memory of 1688	1808	a9f43c19c6b0d3d50d9fce59baa60651d03282169a4a62aa9ef9f0fe370dd927.exe	29
PID 1808 wrote to memory of 1688	1808	a9f43c19c6b0d3d50d9fce59baa60651d03282169a4a62aa9ef9f0fe370dd927.exe	29
PID 1808 wrote to memory of 1536	1808	a9f43c19c6b0d3d50d9fce59baa60651d03282169a4a62aa9ef9f0fe370dd927.exe	30
PID 1808 wrote to memory of 1536	1808	a9f43c19c6b0d3d50d9fce59baa60651d03282169a4a62aa9ef9f0fe370dd927.exe	30
PID 1808 wrote to memory of 1536	1808	a9f43c19c6b0d3d50d9fce59baa60651d03282169a4a62aa9ef9f0fe370dd927.exe	30
PID 1808 wrote to memory of 1536	1808	a9f43c19c6b0d3d50d9fce59baa60651d03282169a4a62aa9ef9f0fe370dd927.exe	30
PID 1536 wrote to memory of 852	1536	cmd.exe	32
PID 1536 wrote to memory of 852	1536	cmd.exe	32
PID 1536 wrote to memory of 852	1536	cmd.exe	32
PID 1536 wrote to memory of 852	1536	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\a9f43c19c6b0d3d50d9fce59baa60651d03282169a4a62aa9ef9f0fe370dd927.exe
"C:\Users\Admin\AppData\Local\Temp\a9f43c19c6b0d3d50d9fce59baa60651d03282169a4a62aa9ef9f0fe370dd927.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Users\Admin\AppData\Local\Temp\a9f43c19c6b0d3d50d9fce59baa60651d03282169a4a62aa9ef9f0fe370dd927.exe
  C:\Users\Admin\AppData\Local\Temp\a9f43c19c6b0d3d50d9fce59baa60651d03282169a4a62aa9ef9f0fe370dd927.exe /C
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1688
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\a9f43c19c6b0d3d50d9fce59baa60651d03282169a4a62aa9ef9f0fe370dd927.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1536
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:852

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1688-1-0x00000000024E0000-0x00000000024F1000-memory.dmp

Download