qakbot | b0fc4b6da906b2f14bb48447a3b0a3ee22ed817f70d272bbc49af4e193b9a546

Analysis

Target
b0fc4b6da906b2f14bb48447a3b0a3ee22ed817f70d272bbc49af4e193b9a546.exe
Size 270KB
Sample201111-pdkjdgrf7e
SHA256 b0fc4b6da906b2f14bb48447a3b0a3ee22ed817f70d272bbc49af4e193b9a546
MD5 c456fc96ade3d6d78b61c95d4f8136dc
SHA1 c26deecbb9954d488a3c2607886f44a7f2c1c36b
SHA512 4c98f79526b5b3839c65740a9e3745f04d324e23e86a96ed7705b948543a73190e40e42b6a819c3cb57aa48cc480a262ef0eed7dd5ec36f5ed1b7509b6ff7d80
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
1492	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
596	b0fc4b6da906b2f14bb48447a3b0a3ee22ed817f70d272bbc49af4e193b9a546.exe
1692	b0fc4b6da906b2f14bb48447a3b0a3ee22ed817f70d272bbc49af4e193b9a546.exe
1692	b0fc4b6da906b2f14bb48447a3b0a3ee22ed817f70d272bbc49af4e193b9a546.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 596 wrote to memory of 1692	596	b0fc4b6da906b2f14bb48447a3b0a3ee22ed817f70d272bbc49af4e193b9a546.exe	29
PID 596 wrote to memory of 1692	596	b0fc4b6da906b2f14bb48447a3b0a3ee22ed817f70d272bbc49af4e193b9a546.exe	29
PID 596 wrote to memory of 1692	596	b0fc4b6da906b2f14bb48447a3b0a3ee22ed817f70d272bbc49af4e193b9a546.exe	29
PID 596 wrote to memory of 1692	596	b0fc4b6da906b2f14bb48447a3b0a3ee22ed817f70d272bbc49af4e193b9a546.exe	29
PID 596 wrote to memory of 1124	596	b0fc4b6da906b2f14bb48447a3b0a3ee22ed817f70d272bbc49af4e193b9a546.exe	30
PID 596 wrote to memory of 1124	596	b0fc4b6da906b2f14bb48447a3b0a3ee22ed817f70d272bbc49af4e193b9a546.exe	30
PID 596 wrote to memory of 1124	596	b0fc4b6da906b2f14bb48447a3b0a3ee22ed817f70d272bbc49af4e193b9a546.exe	30
PID 596 wrote to memory of 1124	596	b0fc4b6da906b2f14bb48447a3b0a3ee22ed817f70d272bbc49af4e193b9a546.exe	30
PID 1124 wrote to memory of 1492	1124	cmd.exe	32
PID 1124 wrote to memory of 1492	1124	cmd.exe	32
PID 1124 wrote to memory of 1492	1124	cmd.exe	32
PID 1124 wrote to memory of 1492	1124	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\b0fc4b6da906b2f14bb48447a3b0a3ee22ed817f70d272bbc49af4e193b9a546.exe
"C:\Users\Admin\AppData\Local\Temp\b0fc4b6da906b2f14bb48447a3b0a3ee22ed817f70d272bbc49af4e193b9a546.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:596
- C:\Users\Admin\AppData\Local\Temp\b0fc4b6da906b2f14bb48447a3b0a3ee22ed817f70d272bbc49af4e193b9a546.exe
  C:\Users\Admin\AppData\Local\Temp\b0fc4b6da906b2f14bb48447a3b0a3ee22ed817f70d272bbc49af4e193b9a546.exe /C
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1692
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\b0fc4b6da906b2f14bb48447a3b0a3ee22ed817f70d272bbc49af4e193b9a546.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1124
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1492

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1692-1-0x0000000002540000-0x0000000002551000-memory.dmp

Download