qakbot | 343cacc8bcad546c1320dfc9af431e4c24973cc5768d2f586bb4df470e20fb32

Analysis

Target
343cacc8bcad546c1320dfc9af431e4c24973cc5768d2f586bb4df470e20fb32.exe
Size 270KB
Sample201112-la41vdns2x
SHA256 343cacc8bcad546c1320dfc9af431e4c24973cc5768d2f586bb4df470e20fb32
MD5 5091c4870ca1b7a8904b1033504070bb
SHA1 370c9b4ba54c2f7164901379bacdc22e5f2568bb
SHA512 4709e064eb8e6bcafc9786bf80ede856cd8826803987e64823c204b5bfaaf89442a17415315cd02918b32f19821d620940f462eaaa89e3027ec90773e263b1c0
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
1560	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1056	343cacc8bcad546c1320dfc9af431e4c24973cc5768d2f586bb4df470e20fb32.exe
1488	343cacc8bcad546c1320dfc9af431e4c24973cc5768d2f586bb4df470e20fb32.exe
1488	343cacc8bcad546c1320dfc9af431e4c24973cc5768d2f586bb4df470e20fb32.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1056 wrote to memory of 1488	1056	343cacc8bcad546c1320dfc9af431e4c24973cc5768d2f586bb4df470e20fb32.exe	29
PID 1056 wrote to memory of 1488	1056	343cacc8bcad546c1320dfc9af431e4c24973cc5768d2f586bb4df470e20fb32.exe	29
PID 1056 wrote to memory of 1488	1056	343cacc8bcad546c1320dfc9af431e4c24973cc5768d2f586bb4df470e20fb32.exe	29
PID 1056 wrote to memory of 1488	1056	343cacc8bcad546c1320dfc9af431e4c24973cc5768d2f586bb4df470e20fb32.exe	29
PID 1056 wrote to memory of 1704	1056	343cacc8bcad546c1320dfc9af431e4c24973cc5768d2f586bb4df470e20fb32.exe	30
PID 1056 wrote to memory of 1704	1056	343cacc8bcad546c1320dfc9af431e4c24973cc5768d2f586bb4df470e20fb32.exe	30
PID 1056 wrote to memory of 1704	1056	343cacc8bcad546c1320dfc9af431e4c24973cc5768d2f586bb4df470e20fb32.exe	30
PID 1056 wrote to memory of 1704	1056	343cacc8bcad546c1320dfc9af431e4c24973cc5768d2f586bb4df470e20fb32.exe	30
PID 1704 wrote to memory of 1560	1704	cmd.exe	32
PID 1704 wrote to memory of 1560	1704	cmd.exe	32
PID 1704 wrote to memory of 1560	1704	cmd.exe	32
PID 1704 wrote to memory of 1560	1704	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\343cacc8bcad546c1320dfc9af431e4c24973cc5768d2f586bb4df470e20fb32.exe
"C:\Users\Admin\AppData\Local\Temp\343cacc8bcad546c1320dfc9af431e4c24973cc5768d2f586bb4df470e20fb32.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Users\Admin\AppData\Local\Temp\343cacc8bcad546c1320dfc9af431e4c24973cc5768d2f586bb4df470e20fb32.exe
  C:\Users\Admin\AppData\Local\Temp\343cacc8bcad546c1320dfc9af431e4c24973cc5768d2f586bb4df470e20fb32.exe /C
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1488
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\343cacc8bcad546c1320dfc9af431e4c24973cc5768d2f586bb4df470e20fb32.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1704
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1560

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1488-1-0x0000000002420000-0x0000000002431000-memory.dmp

Download