qakbot | 3b354c92223367f47bd3b020aa5a951ad209b501d5d6cc8cfeb3ca0f34c8ccb1

Analysis

Target
3b354c92223367f47bd3b020aa5a951ad209b501d5d6cc8cfeb3ca0f34c8ccb1.exe
Size 270KB
Sample201112-4fp9djc5ds
SHA256 3b354c92223367f47bd3b020aa5a951ad209b501d5d6cc8cfeb3ca0f34c8ccb1
MD5 9ecdfbe3da0fe540deefaba098f4991f
SHA1 9128c73e9bdd1ccd7b3334c2704d050ac2a0b70a
SHA512 5fe7dd6abf2d9296c9fbdd5cad62b20e70f865d24ec88658136a96018320401aca949a24bad61dbfbbbe9a96866524fe44a2198722500d5e969413bc30db1c49
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
800	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1960	3b354c92223367f47bd3b020aa5a951ad209b501d5d6cc8cfeb3ca0f34c8ccb1.exe
1768	3b354c92223367f47bd3b020aa5a951ad209b501d5d6cc8cfeb3ca0f34c8ccb1.exe
1768	3b354c92223367f47bd3b020aa5a951ad209b501d5d6cc8cfeb3ca0f34c8ccb1.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 1768	1960	3b354c92223367f47bd3b020aa5a951ad209b501d5d6cc8cfeb3ca0f34c8ccb1.exe	29
PID 1960 wrote to memory of 1768	1960	3b354c92223367f47bd3b020aa5a951ad209b501d5d6cc8cfeb3ca0f34c8ccb1.exe	29
PID 1960 wrote to memory of 1768	1960	3b354c92223367f47bd3b020aa5a951ad209b501d5d6cc8cfeb3ca0f34c8ccb1.exe	29
PID 1960 wrote to memory of 1768	1960	3b354c92223367f47bd3b020aa5a951ad209b501d5d6cc8cfeb3ca0f34c8ccb1.exe	29
PID 1960 wrote to memory of 1760	1960	3b354c92223367f47bd3b020aa5a951ad209b501d5d6cc8cfeb3ca0f34c8ccb1.exe	30
PID 1960 wrote to memory of 1760	1960	3b354c92223367f47bd3b020aa5a951ad209b501d5d6cc8cfeb3ca0f34c8ccb1.exe	30
PID 1960 wrote to memory of 1760	1960	3b354c92223367f47bd3b020aa5a951ad209b501d5d6cc8cfeb3ca0f34c8ccb1.exe	30
PID 1960 wrote to memory of 1760	1960	3b354c92223367f47bd3b020aa5a951ad209b501d5d6cc8cfeb3ca0f34c8ccb1.exe	30
PID 1760 wrote to memory of 800	1760	cmd.exe	32
PID 1760 wrote to memory of 800	1760	cmd.exe	32
PID 1760 wrote to memory of 800	1760	cmd.exe	32
PID 1760 wrote to memory of 800	1760	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\3b354c92223367f47bd3b020aa5a951ad209b501d5d6cc8cfeb3ca0f34c8ccb1.exe
"C:\Users\Admin\AppData\Local\Temp\3b354c92223367f47bd3b020aa5a951ad209b501d5d6cc8cfeb3ca0f34c8ccb1.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Users\Admin\AppData\Local\Temp\3b354c92223367f47bd3b020aa5a951ad209b501d5d6cc8cfeb3ca0f34c8ccb1.exe
  C:\Users\Admin\AppData\Local\Temp\3b354c92223367f47bd3b020aa5a951ad209b501d5d6cc8cfeb3ca0f34c8ccb1.exe /C
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1768
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\3b354c92223367f47bd3b020aa5a951ad209b501d5d6cc8cfeb3ca0f34c8ccb1.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1760
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:800

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1768-1-0x0000000002610000-0x0000000002621000-memory.dmp

Download