qakbot | 95ffaf81a2b0bd1f8fbd29c1d440c774f5f50c8a8310931778982c953347dbda

Analysis

Target
95ffaf81a2b0bd1f8fbd29c1d440c774f5f50c8a8310931778982c953347dbda.exe
Size 270KB
Sample201111-qralrm62be
SHA256 95ffaf81a2b0bd1f8fbd29c1d440c774f5f50c8a8310931778982c953347dbda
MD5 aaf86ea17f33a4aebdeaca1b84752d94
SHA1 8b97b639f468527b72d82e16c6338c9771916e41
SHA512 07d256bbc70a21ed74e3ef42d7a6c34c913085797067ad335da64c1cc5a0656c2cf31721da0eadb6fdcccc6e68e5451944f644a9b5e891af01dda172c947ddde
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
1756	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1924	95ffaf81a2b0bd1f8fbd29c1d440c774f5f50c8a8310931778982c953347dbda.exe
108	95ffaf81a2b0bd1f8fbd29c1d440c774f5f50c8a8310931778982c953347dbda.exe
108	95ffaf81a2b0bd1f8fbd29c1d440c774f5f50c8a8310931778982c953347dbda.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 108	1924	95ffaf81a2b0bd1f8fbd29c1d440c774f5f50c8a8310931778982c953347dbda.exe	29
PID 1924 wrote to memory of 108	1924	95ffaf81a2b0bd1f8fbd29c1d440c774f5f50c8a8310931778982c953347dbda.exe	29
PID 1924 wrote to memory of 108	1924	95ffaf81a2b0bd1f8fbd29c1d440c774f5f50c8a8310931778982c953347dbda.exe	29
PID 1924 wrote to memory of 108	1924	95ffaf81a2b0bd1f8fbd29c1d440c774f5f50c8a8310931778982c953347dbda.exe	29
PID 1924 wrote to memory of 780	1924	95ffaf81a2b0bd1f8fbd29c1d440c774f5f50c8a8310931778982c953347dbda.exe	30
PID 1924 wrote to memory of 780	1924	95ffaf81a2b0bd1f8fbd29c1d440c774f5f50c8a8310931778982c953347dbda.exe	30
PID 1924 wrote to memory of 780	1924	95ffaf81a2b0bd1f8fbd29c1d440c774f5f50c8a8310931778982c953347dbda.exe	30
PID 1924 wrote to memory of 780	1924	95ffaf81a2b0bd1f8fbd29c1d440c774f5f50c8a8310931778982c953347dbda.exe	30
PID 780 wrote to memory of 1756	780	cmd.exe	32
PID 780 wrote to memory of 1756	780	cmd.exe	32
PID 780 wrote to memory of 1756	780	cmd.exe	32
PID 780 wrote to memory of 1756	780	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\95ffaf81a2b0bd1f8fbd29c1d440c774f5f50c8a8310931778982c953347dbda.exe
"C:\Users\Admin\AppData\Local\Temp\95ffaf81a2b0bd1f8fbd29c1d440c774f5f50c8a8310931778982c953347dbda.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Users\Admin\AppData\Local\Temp\95ffaf81a2b0bd1f8fbd29c1d440c774f5f50c8a8310931778982c953347dbda.exe
  C:\Users\Admin\AppData\Local\Temp\95ffaf81a2b0bd1f8fbd29c1d440c774f5f50c8a8310931778982c953347dbda.exe /C
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:108
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\95ffaf81a2b0bd1f8fbd29c1d440c774f5f50c8a8310931778982c953347dbda.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:780
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1756

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/108-1-0x0000000002530000-0x0000000002541000-memory.dmp

Download