qakbot | d01f849b78fbe0fb91cde35930c29f99f4deb219e3fc0639309bdedbfe83fed0

Analysis

Target
d01f849b78fbe0fb91cde35930c29f99f4deb219e3fc0639309bdedbfe83fed0.exe
Size 270KB
Sample201110-p7vy5j7ex2
SHA256 d01f849b78fbe0fb91cde35930c29f99f4deb219e3fc0639309bdedbfe83fed0
MD5 040bae6ab41f69d011846efa2544d0b9
SHA1 7e10ce07b43e55843a26ac8232b547ab9a6e1ebd
SHA512 6a6c37583bf1256930f3c16649d265695c5059fb52598feb6cd54126c1f051a89ce34080a0d5ba251849d0d844f4c2478c64c108e2e9a7c711e503f5fa3bc255
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
1196	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
748	d01f849b78fbe0fb91cde35930c29f99f4deb219e3fc0639309bdedbfe83fed0.exe
1712	d01f849b78fbe0fb91cde35930c29f99f4deb219e3fc0639309bdedbfe83fed0.exe
1712	d01f849b78fbe0fb91cde35930c29f99f4deb219e3fc0639309bdedbfe83fed0.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 748 wrote to memory of 1712	748	d01f849b78fbe0fb91cde35930c29f99f4deb219e3fc0639309bdedbfe83fed0.exe	29
PID 748 wrote to memory of 1712	748	d01f849b78fbe0fb91cde35930c29f99f4deb219e3fc0639309bdedbfe83fed0.exe	29
PID 748 wrote to memory of 1712	748	d01f849b78fbe0fb91cde35930c29f99f4deb219e3fc0639309bdedbfe83fed0.exe	29
PID 748 wrote to memory of 1712	748	d01f849b78fbe0fb91cde35930c29f99f4deb219e3fc0639309bdedbfe83fed0.exe	29
PID 748 wrote to memory of 1220	748	d01f849b78fbe0fb91cde35930c29f99f4deb219e3fc0639309bdedbfe83fed0.exe	30
PID 748 wrote to memory of 1220	748	d01f849b78fbe0fb91cde35930c29f99f4deb219e3fc0639309bdedbfe83fed0.exe	30
PID 748 wrote to memory of 1220	748	d01f849b78fbe0fb91cde35930c29f99f4deb219e3fc0639309bdedbfe83fed0.exe	30
PID 748 wrote to memory of 1220	748	d01f849b78fbe0fb91cde35930c29f99f4deb219e3fc0639309bdedbfe83fed0.exe	30
PID 1220 wrote to memory of 1196	1220	cmd.exe	32
PID 1220 wrote to memory of 1196	1220	cmd.exe	32
PID 1220 wrote to memory of 1196	1220	cmd.exe	32
PID 1220 wrote to memory of 1196	1220	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\d01f849b78fbe0fb91cde35930c29f99f4deb219e3fc0639309bdedbfe83fed0.exe
"C:\Users\Admin\AppData\Local\Temp\d01f849b78fbe0fb91cde35930c29f99f4deb219e3fc0639309bdedbfe83fed0.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:748
- C:\Users\Admin\AppData\Local\Temp\d01f849b78fbe0fb91cde35930c29f99f4deb219e3fc0639309bdedbfe83fed0.exe
  C:\Users\Admin\AppData\Local\Temp\d01f849b78fbe0fb91cde35930c29f99f4deb219e3fc0639309bdedbfe83fed0.exe /C
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1712
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\d01f849b78fbe0fb91cde35930c29f99f4deb219e3fc0639309bdedbfe83fed0.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1220
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1196

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1712-1-0x00000000026D0000-0x00000000026E1000-memory.dmp

Download