qakbot | c75c4a0df0dd899533dfefd1d6806d85a7ce0070d1e76e6a8562c153c7c1bf6d

Analysis

Target
c75c4a0df0dd899533dfefd1d6806d85a7ce0070d1e76e6a8562c153c7c1bf6d.exe
Size 254KB
Sample201111-kcd2cyjwbs
SHA256 c75c4a0df0dd899533dfefd1d6806d85a7ce0070d1e76e6a8562c153c7c1bf6d
MD5 becaf9dcb54ff897b4e71c388c711821
SHA1 f76cdfa15875f979c29477941286698bab525bf6
SHA512 83470bd15400e6d62317c0d09d78a6d77e40edebec709171efd48a22b286538716059f8459b35cd6f0f4acfb6043df8c9ce7d46ba0e975823943377849704ca1
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
308	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1992	c75c4a0df0dd899533dfefd1d6806d85a7ce0070d1e76e6a8562c153c7c1bf6d.exe
1764	c75c4a0df0dd899533dfefd1d6806d85a7ce0070d1e76e6a8562c153c7c1bf6d.exe
1764	c75c4a0df0dd899533dfefd1d6806d85a7ce0070d1e76e6a8562c153c7c1bf6d.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 1764	1992	c75c4a0df0dd899533dfefd1d6806d85a7ce0070d1e76e6a8562c153c7c1bf6d.exe	29
PID 1992 wrote to memory of 1764	1992	c75c4a0df0dd899533dfefd1d6806d85a7ce0070d1e76e6a8562c153c7c1bf6d.exe	29
PID 1992 wrote to memory of 1764	1992	c75c4a0df0dd899533dfefd1d6806d85a7ce0070d1e76e6a8562c153c7c1bf6d.exe	29
PID 1992 wrote to memory of 1764	1992	c75c4a0df0dd899533dfefd1d6806d85a7ce0070d1e76e6a8562c153c7c1bf6d.exe	29
PID 1992 wrote to memory of 1696	1992	c75c4a0df0dd899533dfefd1d6806d85a7ce0070d1e76e6a8562c153c7c1bf6d.exe	30
PID 1992 wrote to memory of 1696	1992	c75c4a0df0dd899533dfefd1d6806d85a7ce0070d1e76e6a8562c153c7c1bf6d.exe	30
PID 1992 wrote to memory of 1696	1992	c75c4a0df0dd899533dfefd1d6806d85a7ce0070d1e76e6a8562c153c7c1bf6d.exe	30
PID 1992 wrote to memory of 1696	1992	c75c4a0df0dd899533dfefd1d6806d85a7ce0070d1e76e6a8562c153c7c1bf6d.exe	30
PID 1696 wrote to memory of 308	1696	cmd.exe	32
PID 1696 wrote to memory of 308	1696	cmd.exe	32
PID 1696 wrote to memory of 308	1696	cmd.exe	32
PID 1696 wrote to memory of 308	1696	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\c75c4a0df0dd899533dfefd1d6806d85a7ce0070d1e76e6a8562c153c7c1bf6d.exe
"C:\Users\Admin\AppData\Local\Temp\c75c4a0df0dd899533dfefd1d6806d85a7ce0070d1e76e6a8562c153c7c1bf6d.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Users\Admin\AppData\Local\Temp\c75c4a0df0dd899533dfefd1d6806d85a7ce0070d1e76e6a8562c153c7c1bf6d.exe
  C:\Users\Admin\AppData\Local\Temp\c75c4a0df0dd899533dfefd1d6806d85a7ce0070d1e76e6a8562c153c7c1bf6d.exe /C
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1764
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\c75c4a0df0dd899533dfefd1d6806d85a7ce0070d1e76e6a8562c153c7c1bf6d.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1696
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:308

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1764-1-0x0000000002430000-0x0000000002441000-memory.dmp

Download