qakbot | dcdfd3402f02baf3a62ef9e28ab553751b137a148cd72a69ca72d6c4a0c0776a

Analysis

Target
dcdfd3402f02baf3a62ef9e28ab553751b137a148cd72a69ca72d6c4a0c0776a.exe
Size 270KB
Sample201111-sdm83bhrfj
SHA256 dcdfd3402f02baf3a62ef9e28ab553751b137a148cd72a69ca72d6c4a0c0776a
MD5 088c2554cb0133841f244abc424273c9
SHA1 33bccd1a8a026ad834582f9d731156e2534e707b
SHA512 733d4c445a3291af061d3908c2db4b0be440bd2623d5b0fe28aef59ab08772496b852e581945bc1d3d17119e6565dfa165c5c812dccd02cbd14e9b7797d12c0c
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
760	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1880	dcdfd3402f02baf3a62ef9e28ab553751b137a148cd72a69ca72d6c4a0c0776a.exe
1700	dcdfd3402f02baf3a62ef9e28ab553751b137a148cd72a69ca72d6c4a0c0776a.exe
1700	dcdfd3402f02baf3a62ef9e28ab553751b137a148cd72a69ca72d6c4a0c0776a.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1880 wrote to memory of 1700	1880	dcdfd3402f02baf3a62ef9e28ab553751b137a148cd72a69ca72d6c4a0c0776a.exe	29
PID 1880 wrote to memory of 1700	1880	dcdfd3402f02baf3a62ef9e28ab553751b137a148cd72a69ca72d6c4a0c0776a.exe	29
PID 1880 wrote to memory of 1700	1880	dcdfd3402f02baf3a62ef9e28ab553751b137a148cd72a69ca72d6c4a0c0776a.exe	29
PID 1880 wrote to memory of 1700	1880	dcdfd3402f02baf3a62ef9e28ab553751b137a148cd72a69ca72d6c4a0c0776a.exe	29
PID 1880 wrote to memory of 752	1880	dcdfd3402f02baf3a62ef9e28ab553751b137a148cd72a69ca72d6c4a0c0776a.exe	30
PID 1880 wrote to memory of 752	1880	dcdfd3402f02baf3a62ef9e28ab553751b137a148cd72a69ca72d6c4a0c0776a.exe	30
PID 1880 wrote to memory of 752	1880	dcdfd3402f02baf3a62ef9e28ab553751b137a148cd72a69ca72d6c4a0c0776a.exe	30
PID 1880 wrote to memory of 752	1880	dcdfd3402f02baf3a62ef9e28ab553751b137a148cd72a69ca72d6c4a0c0776a.exe	30
PID 752 wrote to memory of 760	752	cmd.exe	32
PID 752 wrote to memory of 760	752	cmd.exe	32
PID 752 wrote to memory of 760	752	cmd.exe	32
PID 752 wrote to memory of 760	752	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\dcdfd3402f02baf3a62ef9e28ab553751b137a148cd72a69ca72d6c4a0c0776a.exe
"C:\Users\Admin\AppData\Local\Temp\dcdfd3402f02baf3a62ef9e28ab553751b137a148cd72a69ca72d6c4a0c0776a.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1880
- C:\Users\Admin\AppData\Local\Temp\dcdfd3402f02baf3a62ef9e28ab553751b137a148cd72a69ca72d6c4a0c0776a.exe
  C:\Users\Admin\AppData\Local\Temp\dcdfd3402f02baf3a62ef9e28ab553751b137a148cd72a69ca72d6c4a0c0776a.exe /C
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1700
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\dcdfd3402f02baf3a62ef9e28ab553751b137a148cd72a69ca72d6c4a0c0776a.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:752
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:760

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1700-1-0x00000000025A0000-0x00000000025B1000-memory.dmp

Download