qakbot | f2bffbb33a1dde799a1e19aee3eb88c71c23b2f1f0f2ccf4a61dec148f781bb0

Analysis

Target
f2bffbb33a1dde799a1e19aee3eb88c71c23b2f1f0f2ccf4a61dec148f781bb0.exe
Size 270KB
Sample201112-9ph8bgtbsx
SHA256 f2bffbb33a1dde799a1e19aee3eb88c71c23b2f1f0f2ccf4a61dec148f781bb0
MD5 434f01d0639f6955c1f36649ec57e092
SHA1 aaf913fcd91e155abe74f15ff5da594e30a0b0a9
SHA512 e91f9aab35b5d5c2cca58aa631891f4ddb35dfcd406955567c9c1b0877c296091d6d8b2b98e2000b11dab075d0e81b541861339491d0e2d03e68421564957c6a
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
1524	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1040	f2bffbb33a1dde799a1e19aee3eb88c71c23b2f1f0f2ccf4a61dec148f781bb0.exe
1768	f2bffbb33a1dde799a1e19aee3eb88c71c23b2f1f0f2ccf4a61dec148f781bb0.exe
1768	f2bffbb33a1dde799a1e19aee3eb88c71c23b2f1f0f2ccf4a61dec148f781bb0.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1040 wrote to memory of 1768	1040	f2bffbb33a1dde799a1e19aee3eb88c71c23b2f1f0f2ccf4a61dec148f781bb0.exe	29
PID 1040 wrote to memory of 1768	1040	f2bffbb33a1dde799a1e19aee3eb88c71c23b2f1f0f2ccf4a61dec148f781bb0.exe	29
PID 1040 wrote to memory of 1768	1040	f2bffbb33a1dde799a1e19aee3eb88c71c23b2f1f0f2ccf4a61dec148f781bb0.exe	29
PID 1040 wrote to memory of 1768	1040	f2bffbb33a1dde799a1e19aee3eb88c71c23b2f1f0f2ccf4a61dec148f781bb0.exe	29
PID 1040 wrote to memory of 1668	1040	f2bffbb33a1dde799a1e19aee3eb88c71c23b2f1f0f2ccf4a61dec148f781bb0.exe	30
PID 1040 wrote to memory of 1668	1040	f2bffbb33a1dde799a1e19aee3eb88c71c23b2f1f0f2ccf4a61dec148f781bb0.exe	30
PID 1040 wrote to memory of 1668	1040	f2bffbb33a1dde799a1e19aee3eb88c71c23b2f1f0f2ccf4a61dec148f781bb0.exe	30
PID 1040 wrote to memory of 1668	1040	f2bffbb33a1dde799a1e19aee3eb88c71c23b2f1f0f2ccf4a61dec148f781bb0.exe	30
PID 1668 wrote to memory of 1524	1668	cmd.exe	32
PID 1668 wrote to memory of 1524	1668	cmd.exe	32
PID 1668 wrote to memory of 1524	1668	cmd.exe	32
PID 1668 wrote to memory of 1524	1668	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\f2bffbb33a1dde799a1e19aee3eb88c71c23b2f1f0f2ccf4a61dec148f781bb0.exe
"C:\Users\Admin\AppData\Local\Temp\f2bffbb33a1dde799a1e19aee3eb88c71c23b2f1f0f2ccf4a61dec148f781bb0.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1040
- C:\Users\Admin\AppData\Local\Temp\f2bffbb33a1dde799a1e19aee3eb88c71c23b2f1f0f2ccf4a61dec148f781bb0.exe
  C:\Users\Admin\AppData\Local\Temp\f2bffbb33a1dde799a1e19aee3eb88c71c23b2f1f0f2ccf4a61dec148f781bb0.exe /C
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1768
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\f2bffbb33a1dde799a1e19aee3eb88c71c23b2f1f0f2ccf4a61dec148f781bb0.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1668
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1524

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1768-1-0x00000000024A0000-0x00000000024B1000-memory.dmp

Download