qakbot | 413aee455addc831a220d6ea744938ec65a6a34e8eed09ec3593afc4e316a928

Analysis

Target
413aee455addc831a220d6ea744938ec65a6a34e8eed09ec3593afc4e316a928.exe
Size 270KB
Sample201111-qa9eawea5n
SHA256 413aee455addc831a220d6ea744938ec65a6a34e8eed09ec3593afc4e316a928
MD5 78489c3333a0d6d8511237a97ba9c4b2
SHA1 b6cdbac86ecfe616dbae21ac09d1a5aaa25f0217
SHA512 24c7a970b821e1e8b441940b1ecdab063b2dbea184f93f336aa9eb07953119b37d02ca91ba78e5ea359b87bf007684fb3822b20a5dc2e086c7339da191947348
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
1240	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1700	413aee455addc831a220d6ea744938ec65a6a34e8eed09ec3593afc4e316a928.exe
1708	413aee455addc831a220d6ea744938ec65a6a34e8eed09ec3593afc4e316a928.exe
1708	413aee455addc831a220d6ea744938ec65a6a34e8eed09ec3593afc4e316a928.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 1708	1700	413aee455addc831a220d6ea744938ec65a6a34e8eed09ec3593afc4e316a928.exe	29
PID 1700 wrote to memory of 1708	1700	413aee455addc831a220d6ea744938ec65a6a34e8eed09ec3593afc4e316a928.exe	29
PID 1700 wrote to memory of 1708	1700	413aee455addc831a220d6ea744938ec65a6a34e8eed09ec3593afc4e316a928.exe	29
PID 1700 wrote to memory of 1708	1700	413aee455addc831a220d6ea744938ec65a6a34e8eed09ec3593afc4e316a928.exe	29
PID 1700 wrote to memory of 1184	1700	413aee455addc831a220d6ea744938ec65a6a34e8eed09ec3593afc4e316a928.exe	30
PID 1700 wrote to memory of 1184	1700	413aee455addc831a220d6ea744938ec65a6a34e8eed09ec3593afc4e316a928.exe	30
PID 1700 wrote to memory of 1184	1700	413aee455addc831a220d6ea744938ec65a6a34e8eed09ec3593afc4e316a928.exe	30
PID 1700 wrote to memory of 1184	1700	413aee455addc831a220d6ea744938ec65a6a34e8eed09ec3593afc4e316a928.exe	30
PID 1184 wrote to memory of 1240	1184	cmd.exe	32
PID 1184 wrote to memory of 1240	1184	cmd.exe	32
PID 1184 wrote to memory of 1240	1184	cmd.exe	32
PID 1184 wrote to memory of 1240	1184	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\413aee455addc831a220d6ea744938ec65a6a34e8eed09ec3593afc4e316a928.exe
"C:\Users\Admin\AppData\Local\Temp\413aee455addc831a220d6ea744938ec65a6a34e8eed09ec3593afc4e316a928.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Users\Admin\AppData\Local\Temp\413aee455addc831a220d6ea744938ec65a6a34e8eed09ec3593afc4e316a928.exe
  C:\Users\Admin\AppData\Local\Temp\413aee455addc831a220d6ea744938ec65a6a34e8eed09ec3593afc4e316a928.exe /C
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1708
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\413aee455addc831a220d6ea744938ec65a6a34e8eed09ec3593afc4e316a928.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1184
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1240

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1708-1-0x00000000025A0000-0x00000000025B1000-memory.dmp

Download