qakbot | c2189b97ec395ed6ddb2ad323c0a86af3ddea49af790b2c0bc8a678f94dce1e6

Analysis

Target
c2189b97ec395ed6ddb2ad323c0a86af3ddea49af790b2c0bc8a678f94dce1e6.exe
Size 270KB
Sample201110-ls9la5pvde
SHA256 c2189b97ec395ed6ddb2ad323c0a86af3ddea49af790b2c0bc8a678f94dce1e6
MD5 0db0e70bf56938c73e137e45f0a51545
SHA1 d12c8adf99e6046541da446491b121f14a367b49
SHA512 c8da4cac290bb5cf10608d9fc6e5b26fd5cb99f13faff36c79591b508058d0825427422a86d0bff505044a6bc5879c57ecceab29b7b4a345b3bf265a705c19fa
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
744	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
844	c2189b97ec395ed6ddb2ad323c0a86af3ddea49af790b2c0bc8a678f94dce1e6.exe
1256	c2189b97ec395ed6ddb2ad323c0a86af3ddea49af790b2c0bc8a678f94dce1e6.exe
1256	c2189b97ec395ed6ddb2ad323c0a86af3ddea49af790b2c0bc8a678f94dce1e6.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 844 wrote to memory of 1256	844	c2189b97ec395ed6ddb2ad323c0a86af3ddea49af790b2c0bc8a678f94dce1e6.exe	29
PID 844 wrote to memory of 1256	844	c2189b97ec395ed6ddb2ad323c0a86af3ddea49af790b2c0bc8a678f94dce1e6.exe	29
PID 844 wrote to memory of 1256	844	c2189b97ec395ed6ddb2ad323c0a86af3ddea49af790b2c0bc8a678f94dce1e6.exe	29
PID 844 wrote to memory of 1256	844	c2189b97ec395ed6ddb2ad323c0a86af3ddea49af790b2c0bc8a678f94dce1e6.exe	29
PID 844 wrote to memory of 1236	844	c2189b97ec395ed6ddb2ad323c0a86af3ddea49af790b2c0bc8a678f94dce1e6.exe	30
PID 844 wrote to memory of 1236	844	c2189b97ec395ed6ddb2ad323c0a86af3ddea49af790b2c0bc8a678f94dce1e6.exe	30
PID 844 wrote to memory of 1236	844	c2189b97ec395ed6ddb2ad323c0a86af3ddea49af790b2c0bc8a678f94dce1e6.exe	30
PID 844 wrote to memory of 1236	844	c2189b97ec395ed6ddb2ad323c0a86af3ddea49af790b2c0bc8a678f94dce1e6.exe	30
PID 1236 wrote to memory of 744	1236	cmd.exe	32
PID 1236 wrote to memory of 744	1236	cmd.exe	32
PID 1236 wrote to memory of 744	1236	cmd.exe	32
PID 1236 wrote to memory of 744	1236	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\c2189b97ec395ed6ddb2ad323c0a86af3ddea49af790b2c0bc8a678f94dce1e6.exe
"C:\Users\Admin\AppData\Local\Temp\c2189b97ec395ed6ddb2ad323c0a86af3ddea49af790b2c0bc8a678f94dce1e6.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:844
- C:\Users\Admin\AppData\Local\Temp\c2189b97ec395ed6ddb2ad323c0a86af3ddea49af790b2c0bc8a678f94dce1e6.exe
  C:\Users\Admin\AppData\Local\Temp\c2189b97ec395ed6ddb2ad323c0a86af3ddea49af790b2c0bc8a678f94dce1e6.exe /C
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1256
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\c2189b97ec395ed6ddb2ad323c0a86af3ddea49af790b2c0bc8a678f94dce1e6.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1236
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:744

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1256-1-0x0000000002570000-0x0000000002581000-memory.dmp

Download