qakbot | c20ad36b4bf4e442fd1f4b65c183fcf5581607b315484347977ea89aa807b4aa

Analysis

Target
c20ad36b4bf4e442fd1f4b65c183fcf5581607b315484347977ea89aa807b4aa.exe
Size 257KB
Sample201110-k7n8dfj9fa
SHA256 c20ad36b4bf4e442fd1f4b65c183fcf5581607b315484347977ea89aa807b4aa
MD5 e79d9ea329cffb4b74caf0dcd1fd4fe5
SHA1 e45dd8c285c2e4662ad4664cfa07c450c5cbead3
SHA512 7b2403510235e517f6fda72dab623c18c2b080516066a5ca02b5bb80cd49f3be990a08b61e8c699808e8cc99a8c51975a592596e617ed04eb959b290df9c14d9
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
1648	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1068	c20ad36b4bf4e442fd1f4b65c183fcf5581607b315484347977ea89aa807b4aa.exe
1520	c20ad36b4bf4e442fd1f4b65c183fcf5581607b315484347977ea89aa807b4aa.exe
1520	c20ad36b4bf4e442fd1f4b65c183fcf5581607b315484347977ea89aa807b4aa.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1068 wrote to memory of 1520	1068	c20ad36b4bf4e442fd1f4b65c183fcf5581607b315484347977ea89aa807b4aa.exe	29
PID 1068 wrote to memory of 1520	1068	c20ad36b4bf4e442fd1f4b65c183fcf5581607b315484347977ea89aa807b4aa.exe	29
PID 1068 wrote to memory of 1520	1068	c20ad36b4bf4e442fd1f4b65c183fcf5581607b315484347977ea89aa807b4aa.exe	29
PID 1068 wrote to memory of 1520	1068	c20ad36b4bf4e442fd1f4b65c183fcf5581607b315484347977ea89aa807b4aa.exe	29
PID 1068 wrote to memory of 1588	1068	c20ad36b4bf4e442fd1f4b65c183fcf5581607b315484347977ea89aa807b4aa.exe	30
PID 1068 wrote to memory of 1588	1068	c20ad36b4bf4e442fd1f4b65c183fcf5581607b315484347977ea89aa807b4aa.exe	30
PID 1068 wrote to memory of 1588	1068	c20ad36b4bf4e442fd1f4b65c183fcf5581607b315484347977ea89aa807b4aa.exe	30
PID 1068 wrote to memory of 1588	1068	c20ad36b4bf4e442fd1f4b65c183fcf5581607b315484347977ea89aa807b4aa.exe	30
PID 1588 wrote to memory of 1648	1588	cmd.exe	32
PID 1588 wrote to memory of 1648	1588	cmd.exe	32
PID 1588 wrote to memory of 1648	1588	cmd.exe	32
PID 1588 wrote to memory of 1648	1588	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\c20ad36b4bf4e442fd1f4b65c183fcf5581607b315484347977ea89aa807b4aa.exe
"C:\Users\Admin\AppData\Local\Temp\c20ad36b4bf4e442fd1f4b65c183fcf5581607b315484347977ea89aa807b4aa.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1068
- C:\Users\Admin\AppData\Local\Temp\c20ad36b4bf4e442fd1f4b65c183fcf5581607b315484347977ea89aa807b4aa.exe
  C:\Users\Admin\AppData\Local\Temp\c20ad36b4bf4e442fd1f4b65c183fcf5581607b315484347977ea89aa807b4aa.exe /C
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1520
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\c20ad36b4bf4e442fd1f4b65c183fcf5581607b315484347977ea89aa807b4aa.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1588
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1648

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1520-1-0x0000000002630000-0x0000000002641000-memory.dmp

Download