qakbot | ca939daa0f3f00aadd7bd1bce4b41f79b5a0ccf716159ed68619c3015122c0ce

Analysis

Target
ca939daa0f3f00aadd7bd1bce4b41f79b5a0ccf716159ed68619c3015122c0ce.exe
Size 270KB
Sample201111-1gpbvry69x
SHA256 ca939daa0f3f00aadd7bd1bce4b41f79b5a0ccf716159ed68619c3015122c0ce
MD5 c9c24163416fbc5530516b0dd6605e59
SHA1 a9f20abdaf4d177ce3699d43d296a08e6825560b
SHA512 ec9dc455ad96f60c98e7f391d14d6023d2efcbcb857155d7af2a1bf7de847a508d75c2a2acca14fd517fb56ba74ef2db27207245ad596c06793e69afc16e059b
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
1500	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1632	ca939daa0f3f00aadd7bd1bce4b41f79b5a0ccf716159ed68619c3015122c0ce.exe
1708	ca939daa0f3f00aadd7bd1bce4b41f79b5a0ccf716159ed68619c3015122c0ce.exe
1708	ca939daa0f3f00aadd7bd1bce4b41f79b5a0ccf716159ed68619c3015122c0ce.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 1708	1632	ca939daa0f3f00aadd7bd1bce4b41f79b5a0ccf716159ed68619c3015122c0ce.exe	29
PID 1632 wrote to memory of 1708	1632	ca939daa0f3f00aadd7bd1bce4b41f79b5a0ccf716159ed68619c3015122c0ce.exe	29
PID 1632 wrote to memory of 1708	1632	ca939daa0f3f00aadd7bd1bce4b41f79b5a0ccf716159ed68619c3015122c0ce.exe	29
PID 1632 wrote to memory of 1708	1632	ca939daa0f3f00aadd7bd1bce4b41f79b5a0ccf716159ed68619c3015122c0ce.exe	29
PID 1632 wrote to memory of 568	1632	ca939daa0f3f00aadd7bd1bce4b41f79b5a0ccf716159ed68619c3015122c0ce.exe	30
PID 1632 wrote to memory of 568	1632	ca939daa0f3f00aadd7bd1bce4b41f79b5a0ccf716159ed68619c3015122c0ce.exe	30
PID 1632 wrote to memory of 568	1632	ca939daa0f3f00aadd7bd1bce4b41f79b5a0ccf716159ed68619c3015122c0ce.exe	30
PID 1632 wrote to memory of 568	1632	ca939daa0f3f00aadd7bd1bce4b41f79b5a0ccf716159ed68619c3015122c0ce.exe	30
PID 568 wrote to memory of 1500	568	cmd.exe	32
PID 568 wrote to memory of 1500	568	cmd.exe	32
PID 568 wrote to memory of 1500	568	cmd.exe	32
PID 568 wrote to memory of 1500	568	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\ca939daa0f3f00aadd7bd1bce4b41f79b5a0ccf716159ed68619c3015122c0ce.exe
"C:\Users\Admin\AppData\Local\Temp\ca939daa0f3f00aadd7bd1bce4b41f79b5a0ccf716159ed68619c3015122c0ce.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Users\Admin\AppData\Local\Temp\ca939daa0f3f00aadd7bd1bce4b41f79b5a0ccf716159ed68619c3015122c0ce.exe
  C:\Users\Admin\AppData\Local\Temp\ca939daa0f3f00aadd7bd1bce4b41f79b5a0ccf716159ed68619c3015122c0ce.exe /C
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1708
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\ca939daa0f3f00aadd7bd1bce4b41f79b5a0ccf716159ed68619c3015122c0ce.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:568
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1500

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1708-1-0x0000000002770000-0x0000000002781000-memory.dmp

Download