qakbot | bbc878fcae5a3520ebba1570f785764498cd54ab00abcc38286bf57e2c5f0e81

Analysis

Target
bbc878fcae5a3520ebba1570f785764498cd54ab00abcc38286bf57e2c5f0e81.exe
Size 270KB
Sample201112-5hs66dsvcj
SHA256 bbc878fcae5a3520ebba1570f785764498cd54ab00abcc38286bf57e2c5f0e81
MD5 4e5a1696e15a77fab2a06a671d047d8d
SHA1 a01f0400ad56bff156567376fef9f25cb620761d
SHA512 16d6af2064786defb3d07667a6cad8566cc22e99d5ef3f830725f6c56295cf745bc213701776dbadfe64c58e5d0912207e6efb787e76b84065a24f90d7e3fdee
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
1620	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1688	bbc878fcae5a3520ebba1570f785764498cd54ab00abcc38286bf57e2c5f0e81.exe
1732	bbc878fcae5a3520ebba1570f785764498cd54ab00abcc38286bf57e2c5f0e81.exe
1732	bbc878fcae5a3520ebba1570f785764498cd54ab00abcc38286bf57e2c5f0e81.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 1732	1688	bbc878fcae5a3520ebba1570f785764498cd54ab00abcc38286bf57e2c5f0e81.exe	29
PID 1688 wrote to memory of 1732	1688	bbc878fcae5a3520ebba1570f785764498cd54ab00abcc38286bf57e2c5f0e81.exe	29
PID 1688 wrote to memory of 1732	1688	bbc878fcae5a3520ebba1570f785764498cd54ab00abcc38286bf57e2c5f0e81.exe	29
PID 1688 wrote to memory of 1732	1688	bbc878fcae5a3520ebba1570f785764498cd54ab00abcc38286bf57e2c5f0e81.exe	29
PID 1688 wrote to memory of 620	1688	bbc878fcae5a3520ebba1570f785764498cd54ab00abcc38286bf57e2c5f0e81.exe	30
PID 1688 wrote to memory of 620	1688	bbc878fcae5a3520ebba1570f785764498cd54ab00abcc38286bf57e2c5f0e81.exe	30
PID 1688 wrote to memory of 620	1688	bbc878fcae5a3520ebba1570f785764498cd54ab00abcc38286bf57e2c5f0e81.exe	30
PID 1688 wrote to memory of 620	1688	bbc878fcae5a3520ebba1570f785764498cd54ab00abcc38286bf57e2c5f0e81.exe	30
PID 620 wrote to memory of 1620	620	cmd.exe	32
PID 620 wrote to memory of 1620	620	cmd.exe	32
PID 620 wrote to memory of 1620	620	cmd.exe	32
PID 620 wrote to memory of 1620	620	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\bbc878fcae5a3520ebba1570f785764498cd54ab00abcc38286bf57e2c5f0e81.exe
"C:\Users\Admin\AppData\Local\Temp\bbc878fcae5a3520ebba1570f785764498cd54ab00abcc38286bf57e2c5f0e81.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Users\Admin\AppData\Local\Temp\bbc878fcae5a3520ebba1570f785764498cd54ab00abcc38286bf57e2c5f0e81.exe
  C:\Users\Admin\AppData\Local\Temp\bbc878fcae5a3520ebba1570f785764498cd54ab00abcc38286bf57e2c5f0e81.exe /C
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1732
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\bbc878fcae5a3520ebba1570f785764498cd54ab00abcc38286bf57e2c5f0e81.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:620
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1620

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1732-1-0x0000000002560000-0x0000000002571000-memory.dmp

Download