qakbot | f8cde02a2534b3177bdace62263d68c0ae5fbfe18c4a5349bc9d31bddd5e9f83

Analysis

Target
f8cde02a2534b3177bdace62263d68c0ae5fbfe18c4a5349bc9d31bddd5e9f83.exe
Size 270KB
Sample201111-cmn48kceca
SHA256 f8cde02a2534b3177bdace62263d68c0ae5fbfe18c4a5349bc9d31bddd5e9f83
MD5 0f624fe1a605587961b10150c519bdba
SHA1 99989b84c562dbc4e89242d4e19ce45adccab285
SHA512 bf72f0aeee034b4578f32388e34c2f4724a087314707004b1077f1c848e55b402417c2ea4854083abc04e25c40c958051b115fc704e4daee56195022be4a2879
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
1664	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1756	f8cde02a2534b3177bdace62263d68c0ae5fbfe18c4a5349bc9d31bddd5e9f83.exe
1336	f8cde02a2534b3177bdace62263d68c0ae5fbfe18c4a5349bc9d31bddd5e9f83.exe
1336	f8cde02a2534b3177bdace62263d68c0ae5fbfe18c4a5349bc9d31bddd5e9f83.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 1336	1756	f8cde02a2534b3177bdace62263d68c0ae5fbfe18c4a5349bc9d31bddd5e9f83.exe	29
PID 1756 wrote to memory of 1336	1756	f8cde02a2534b3177bdace62263d68c0ae5fbfe18c4a5349bc9d31bddd5e9f83.exe	29
PID 1756 wrote to memory of 1336	1756	f8cde02a2534b3177bdace62263d68c0ae5fbfe18c4a5349bc9d31bddd5e9f83.exe	29
PID 1756 wrote to memory of 1336	1756	f8cde02a2534b3177bdace62263d68c0ae5fbfe18c4a5349bc9d31bddd5e9f83.exe	29
PID 1756 wrote to memory of 1480	1756	f8cde02a2534b3177bdace62263d68c0ae5fbfe18c4a5349bc9d31bddd5e9f83.exe	30
PID 1756 wrote to memory of 1480	1756	f8cde02a2534b3177bdace62263d68c0ae5fbfe18c4a5349bc9d31bddd5e9f83.exe	30
PID 1756 wrote to memory of 1480	1756	f8cde02a2534b3177bdace62263d68c0ae5fbfe18c4a5349bc9d31bddd5e9f83.exe	30
PID 1756 wrote to memory of 1480	1756	f8cde02a2534b3177bdace62263d68c0ae5fbfe18c4a5349bc9d31bddd5e9f83.exe	30
PID 1480 wrote to memory of 1664	1480	cmd.exe	32
PID 1480 wrote to memory of 1664	1480	cmd.exe	32
PID 1480 wrote to memory of 1664	1480	cmd.exe	32
PID 1480 wrote to memory of 1664	1480	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\f8cde02a2534b3177bdace62263d68c0ae5fbfe18c4a5349bc9d31bddd5e9f83.exe
"C:\Users\Admin\AppData\Local\Temp\f8cde02a2534b3177bdace62263d68c0ae5fbfe18c4a5349bc9d31bddd5e9f83.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Users\Admin\AppData\Local\Temp\f8cde02a2534b3177bdace62263d68c0ae5fbfe18c4a5349bc9d31bddd5e9f83.exe
  C:\Users\Admin\AppData\Local\Temp\f8cde02a2534b3177bdace62263d68c0ae5fbfe18c4a5349bc9d31bddd5e9f83.exe /C
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1336
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\f8cde02a2534b3177bdace62263d68c0ae5fbfe18c4a5349bc9d31bddd5e9f83.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1480
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1664

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1336-1-0x0000000002540000-0x0000000002551000-memory.dmp

Download