qakbot | e9cea0a8f4245481b6015d25ef387ab61b32c7ff2f27aac65bf48d1ac71bf5cf

Analysis

Target
e9cea0a8f4245481b6015d25ef387ab61b32c7ff2f27aac65bf48d1ac71bf5cf.exe
Size 270KB
Sample201112-e6x7xzg382
SHA256 e9cea0a8f4245481b6015d25ef387ab61b32c7ff2f27aac65bf48d1ac71bf5cf
MD5 385c831403e12093b83d1175b0433d38
SHA1 3725be7b6c5b12625c192d7f7250bed9f6511f91
SHA512 9f428551e51e461915c87638509489a292175e79971e823aa9c2cd529bf5cca85d20742a37bcbb51299ad9dbcc483d3d45e6fef366f57c78fe2c566bd95c7ca6
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
1628	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
484	e9cea0a8f4245481b6015d25ef387ab61b32c7ff2f27aac65bf48d1ac71bf5cf.exe
1284	e9cea0a8f4245481b6015d25ef387ab61b32c7ff2f27aac65bf48d1ac71bf5cf.exe
1284	e9cea0a8f4245481b6015d25ef387ab61b32c7ff2f27aac65bf48d1ac71bf5cf.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 484 wrote to memory of 1284	484	e9cea0a8f4245481b6015d25ef387ab61b32c7ff2f27aac65bf48d1ac71bf5cf.exe	29
PID 484 wrote to memory of 1284	484	e9cea0a8f4245481b6015d25ef387ab61b32c7ff2f27aac65bf48d1ac71bf5cf.exe	29
PID 484 wrote to memory of 1284	484	e9cea0a8f4245481b6015d25ef387ab61b32c7ff2f27aac65bf48d1ac71bf5cf.exe	29
PID 484 wrote to memory of 1284	484	e9cea0a8f4245481b6015d25ef387ab61b32c7ff2f27aac65bf48d1ac71bf5cf.exe	29
PID 484 wrote to memory of 1516	484	e9cea0a8f4245481b6015d25ef387ab61b32c7ff2f27aac65bf48d1ac71bf5cf.exe	30
PID 484 wrote to memory of 1516	484	e9cea0a8f4245481b6015d25ef387ab61b32c7ff2f27aac65bf48d1ac71bf5cf.exe	30
PID 484 wrote to memory of 1516	484	e9cea0a8f4245481b6015d25ef387ab61b32c7ff2f27aac65bf48d1ac71bf5cf.exe	30
PID 484 wrote to memory of 1516	484	e9cea0a8f4245481b6015d25ef387ab61b32c7ff2f27aac65bf48d1ac71bf5cf.exe	30
PID 1516 wrote to memory of 1628	1516	cmd.exe	32
PID 1516 wrote to memory of 1628	1516	cmd.exe	32
PID 1516 wrote to memory of 1628	1516	cmd.exe	32
PID 1516 wrote to memory of 1628	1516	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\e9cea0a8f4245481b6015d25ef387ab61b32c7ff2f27aac65bf48d1ac71bf5cf.exe
"C:\Users\Admin\AppData\Local\Temp\e9cea0a8f4245481b6015d25ef387ab61b32c7ff2f27aac65bf48d1ac71bf5cf.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:484
- C:\Users\Admin\AppData\Local\Temp\e9cea0a8f4245481b6015d25ef387ab61b32c7ff2f27aac65bf48d1ac71bf5cf.exe
  C:\Users\Admin\AppData\Local\Temp\e9cea0a8f4245481b6015d25ef387ab61b32c7ff2f27aac65bf48d1ac71bf5cf.exe /C
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1284
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\e9cea0a8f4245481b6015d25ef387ab61b32c7ff2f27aac65bf48d1ac71bf5cf.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1516
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1628

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1284-1-0x0000000002610000-0x0000000002621000-memory.dmp

Download