qakbot | 24f828742baaedb176d3dba0bdf3d06682c174a9b46b35bf5d145ee57f2aa643

Analysis

Target
24f828742baaedb176d3dba0bdf3d06682c174a9b46b35bf5d145ee57f2aa643.exe
Size 1.0MB
Sample201110-s1tpcdk1ee
SHA256 24f828742baaedb176d3dba0bdf3d06682c174a9b46b35bf5d145ee57f2aa643
MD5 54913eba4af75459add05894f27669ed
SHA1 076e4a9a326d253d4fbf9e426b54f6f08cd04aad
SHA512 a6d19f375aa098a07a35c65184bcb5dd4d50a28590021747086bcb756e380023cdf95926fc459fb9d1d6cd1a2a844035555e89dbf04bdb80beedb344a5da8a7d
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
1300	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1876	24f828742baaedb176d3dba0bdf3d06682c174a9b46b35bf5d145ee57f2aa643.exe
1732	24f828742baaedb176d3dba0bdf3d06682c174a9b46b35bf5d145ee57f2aa643.exe
1732	24f828742baaedb176d3dba0bdf3d06682c174a9b46b35bf5d145ee57f2aa643.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 1732	1876	24f828742baaedb176d3dba0bdf3d06682c174a9b46b35bf5d145ee57f2aa643.exe	29
PID 1876 wrote to memory of 1732	1876	24f828742baaedb176d3dba0bdf3d06682c174a9b46b35bf5d145ee57f2aa643.exe	29
PID 1876 wrote to memory of 1732	1876	24f828742baaedb176d3dba0bdf3d06682c174a9b46b35bf5d145ee57f2aa643.exe	29
PID 1876 wrote to memory of 1732	1876	24f828742baaedb176d3dba0bdf3d06682c174a9b46b35bf5d145ee57f2aa643.exe	29
PID 1876 wrote to memory of 1620	1876	24f828742baaedb176d3dba0bdf3d06682c174a9b46b35bf5d145ee57f2aa643.exe	30
PID 1876 wrote to memory of 1620	1876	24f828742baaedb176d3dba0bdf3d06682c174a9b46b35bf5d145ee57f2aa643.exe	30
PID 1876 wrote to memory of 1620	1876	24f828742baaedb176d3dba0bdf3d06682c174a9b46b35bf5d145ee57f2aa643.exe	30
PID 1876 wrote to memory of 1620	1876	24f828742baaedb176d3dba0bdf3d06682c174a9b46b35bf5d145ee57f2aa643.exe	30
PID 1620 wrote to memory of 1300	1620	cmd.exe	32
PID 1620 wrote to memory of 1300	1620	cmd.exe	32
PID 1620 wrote to memory of 1300	1620	cmd.exe	32
PID 1620 wrote to memory of 1300	1620	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\24f828742baaedb176d3dba0bdf3d06682c174a9b46b35bf5d145ee57f2aa643.exe
"C:\Users\Admin\AppData\Local\Temp\24f828742baaedb176d3dba0bdf3d06682c174a9b46b35bf5d145ee57f2aa643.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Users\Admin\AppData\Local\Temp\24f828742baaedb176d3dba0bdf3d06682c174a9b46b35bf5d145ee57f2aa643.exe
  C:\Users\Admin\AppData\Local\Temp\24f828742baaedb176d3dba0bdf3d06682c174a9b46b35bf5d145ee57f2aa643.exe /C
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1732
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\24f828742baaedb176d3dba0bdf3d06682c174a9b46b35bf5d145ee57f2aa643.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1620
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1300

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1732-1-0x0000000002830000-0x0000000002841000-memory.dmp

Download