qakbot | 9de59cdb97f46e12da2bb6c0fd0aeffc257c6cfa71b487aaf9a149d580a88549

Analysis

Target
9de59cdb97f46e12da2bb6c0fd0aeffc257c6cfa71b487aaf9a149d580a88549.exe
Size 270KB
Sample201112-2whb17x4p2
SHA256 9de59cdb97f46e12da2bb6c0fd0aeffc257c6cfa71b487aaf9a149d580a88549
MD5 12e085464159654e91ee3bb86a3405b1
SHA1 cb19d127f920545bdac377b17ea4021da72ebe88
SHA512 b1cb49381e9a08857b642b7882d936171fbe44bb2ce8e353ff2aa714ce946f0666c94d861a29946ebbe0c0e02ec362bd899cb487937885ea6a5ce0aa9f1134ac
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
884	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
536	9de59cdb97f46e12da2bb6c0fd0aeffc257c6cfa71b487aaf9a149d580a88549.exe
1196	9de59cdb97f46e12da2bb6c0fd0aeffc257c6cfa71b487aaf9a149d580a88549.exe
1196	9de59cdb97f46e12da2bb6c0fd0aeffc257c6cfa71b487aaf9a149d580a88549.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 536 wrote to memory of 1196	536	9de59cdb97f46e12da2bb6c0fd0aeffc257c6cfa71b487aaf9a149d580a88549.exe	29
PID 536 wrote to memory of 1196	536	9de59cdb97f46e12da2bb6c0fd0aeffc257c6cfa71b487aaf9a149d580a88549.exe	29
PID 536 wrote to memory of 1196	536	9de59cdb97f46e12da2bb6c0fd0aeffc257c6cfa71b487aaf9a149d580a88549.exe	29
PID 536 wrote to memory of 1196	536	9de59cdb97f46e12da2bb6c0fd0aeffc257c6cfa71b487aaf9a149d580a88549.exe	29
PID 536 wrote to memory of 520	536	9de59cdb97f46e12da2bb6c0fd0aeffc257c6cfa71b487aaf9a149d580a88549.exe	30
PID 536 wrote to memory of 520	536	9de59cdb97f46e12da2bb6c0fd0aeffc257c6cfa71b487aaf9a149d580a88549.exe	30
PID 536 wrote to memory of 520	536	9de59cdb97f46e12da2bb6c0fd0aeffc257c6cfa71b487aaf9a149d580a88549.exe	30
PID 536 wrote to memory of 520	536	9de59cdb97f46e12da2bb6c0fd0aeffc257c6cfa71b487aaf9a149d580a88549.exe	30
PID 520 wrote to memory of 884	520	cmd.exe	32
PID 520 wrote to memory of 884	520	cmd.exe	32
PID 520 wrote to memory of 884	520	cmd.exe	32
PID 520 wrote to memory of 884	520	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\9de59cdb97f46e12da2bb6c0fd0aeffc257c6cfa71b487aaf9a149d580a88549.exe
"C:\Users\Admin\AppData\Local\Temp\9de59cdb97f46e12da2bb6c0fd0aeffc257c6cfa71b487aaf9a149d580a88549.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:536
- C:\Users\Admin\AppData\Local\Temp\9de59cdb97f46e12da2bb6c0fd0aeffc257c6cfa71b487aaf9a149d580a88549.exe
  C:\Users\Admin\AppData\Local\Temp\9de59cdb97f46e12da2bb6c0fd0aeffc257c6cfa71b487aaf9a149d580a88549.exe /C
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1196
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\9de59cdb97f46e12da2bb6c0fd0aeffc257c6cfa71b487aaf9a149d580a88549.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:520
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:884

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1196-1-0x0000000002530000-0x0000000002541000-memory.dmp

Download