qakbot | eca012073670858ffd58fd0c1ccd1359c08bf779678a55f696e570ed1e4a46c6

Analysis

Target
eca012073670858ffd58fd0c1ccd1359c08bf779678a55f696e570ed1e4a46c6.exe
Size 270KB
Sample201110-vmk9kdk9me
SHA256 eca012073670858ffd58fd0c1ccd1359c08bf779678a55f696e570ed1e4a46c6
MD5 97241fde2ba5c8836380fb3749c9814b
SHA1 f088c8b49546b4c5e7ce06de10d3d537d90c15ee
SHA512 140ff6b10b9cc85111f185bf0e9ef16dd28f212fa2b5a9e871c138e24370990d77da6830bcda7a12978bc1baa79fe4d87d1f779caf5b3f06ccc916d145b5e135
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
1388	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1588	eca012073670858ffd58fd0c1ccd1359c08bf779678a55f696e570ed1e4a46c6.exe
2028	eca012073670858ffd58fd0c1ccd1359c08bf779678a55f696e570ed1e4a46c6.exe
2028	eca012073670858ffd58fd0c1ccd1359c08bf779678a55f696e570ed1e4a46c6.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1588 wrote to memory of 2028	1588	eca012073670858ffd58fd0c1ccd1359c08bf779678a55f696e570ed1e4a46c6.exe	29
PID 1588 wrote to memory of 2028	1588	eca012073670858ffd58fd0c1ccd1359c08bf779678a55f696e570ed1e4a46c6.exe	29
PID 1588 wrote to memory of 2028	1588	eca012073670858ffd58fd0c1ccd1359c08bf779678a55f696e570ed1e4a46c6.exe	29
PID 1588 wrote to memory of 2028	1588	eca012073670858ffd58fd0c1ccd1359c08bf779678a55f696e570ed1e4a46c6.exe	29
PID 1588 wrote to memory of 1228	1588	eca012073670858ffd58fd0c1ccd1359c08bf779678a55f696e570ed1e4a46c6.exe	30
PID 1588 wrote to memory of 1228	1588	eca012073670858ffd58fd0c1ccd1359c08bf779678a55f696e570ed1e4a46c6.exe	30
PID 1588 wrote to memory of 1228	1588	eca012073670858ffd58fd0c1ccd1359c08bf779678a55f696e570ed1e4a46c6.exe	30
PID 1588 wrote to memory of 1228	1588	eca012073670858ffd58fd0c1ccd1359c08bf779678a55f696e570ed1e4a46c6.exe	30
PID 1228 wrote to memory of 1388	1228	cmd.exe	32
PID 1228 wrote to memory of 1388	1228	cmd.exe	32
PID 1228 wrote to memory of 1388	1228	cmd.exe	32
PID 1228 wrote to memory of 1388	1228	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\eca012073670858ffd58fd0c1ccd1359c08bf779678a55f696e570ed1e4a46c6.exe
"C:\Users\Admin\AppData\Local\Temp\eca012073670858ffd58fd0c1ccd1359c08bf779678a55f696e570ed1e4a46c6.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1588
- C:\Users\Admin\AppData\Local\Temp\eca012073670858ffd58fd0c1ccd1359c08bf779678a55f696e570ed1e4a46c6.exe
  C:\Users\Admin\AppData\Local\Temp\eca012073670858ffd58fd0c1ccd1359c08bf779678a55f696e570ed1e4a46c6.exe /C
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2028
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\eca012073670858ffd58fd0c1ccd1359c08bf779678a55f696e570ed1e4a46c6.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1228
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1388

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2028-1-0x0000000002540000-0x0000000002551000-memory.dmp

Download