qakbot | e587322c098bb48e9a9bd10a12b1dc53bfd55915dec951f3697188387fedbbbf

Analysis

Target
e587322c098bb48e9a9bd10a12b1dc53bfd55915dec951f3697188387fedbbbf.exe
Size 270KB
Sample201112-rmh2ddq9za
SHA256 e587322c098bb48e9a9bd10a12b1dc53bfd55915dec951f3697188387fedbbbf
MD5 1a46871bd3283a25423d7242f1a8b480
SHA1 b0263d2c2472cd550d398d6684eb8e1c90c2da12
SHA512 1fd7fda3222579ee20a5f64b8bd1ad6841f3cfb9f6aa400f04305dd7b495cd9383316c14361ef3c660ca62d46dd4ea564f5d6cf0a923d11c0d74e0218dc15cb7
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
784	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1904	e587322c098bb48e9a9bd10a12b1dc53bfd55915dec951f3697188387fedbbbf.exe
1756	e587322c098bb48e9a9bd10a12b1dc53bfd55915dec951f3697188387fedbbbf.exe
1756	e587322c098bb48e9a9bd10a12b1dc53bfd55915dec951f3697188387fedbbbf.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 1756	1904	e587322c098bb48e9a9bd10a12b1dc53bfd55915dec951f3697188387fedbbbf.exe	29
PID 1904 wrote to memory of 1756	1904	e587322c098bb48e9a9bd10a12b1dc53bfd55915dec951f3697188387fedbbbf.exe	29
PID 1904 wrote to memory of 1756	1904	e587322c098bb48e9a9bd10a12b1dc53bfd55915dec951f3697188387fedbbbf.exe	29
PID 1904 wrote to memory of 1756	1904	e587322c098bb48e9a9bd10a12b1dc53bfd55915dec951f3697188387fedbbbf.exe	29
PID 1904 wrote to memory of 1180	1904	e587322c098bb48e9a9bd10a12b1dc53bfd55915dec951f3697188387fedbbbf.exe	30
PID 1904 wrote to memory of 1180	1904	e587322c098bb48e9a9bd10a12b1dc53bfd55915dec951f3697188387fedbbbf.exe	30
PID 1904 wrote to memory of 1180	1904	e587322c098bb48e9a9bd10a12b1dc53bfd55915dec951f3697188387fedbbbf.exe	30
PID 1904 wrote to memory of 1180	1904	e587322c098bb48e9a9bd10a12b1dc53bfd55915dec951f3697188387fedbbbf.exe	30
PID 1180 wrote to memory of 784	1180	cmd.exe	32
PID 1180 wrote to memory of 784	1180	cmd.exe	32
PID 1180 wrote to memory of 784	1180	cmd.exe	32
PID 1180 wrote to memory of 784	1180	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\e587322c098bb48e9a9bd10a12b1dc53bfd55915dec951f3697188387fedbbbf.exe
"C:\Users\Admin\AppData\Local\Temp\e587322c098bb48e9a9bd10a12b1dc53bfd55915dec951f3697188387fedbbbf.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Users\Admin\AppData\Local\Temp\e587322c098bb48e9a9bd10a12b1dc53bfd55915dec951f3697188387fedbbbf.exe
  C:\Users\Admin\AppData\Local\Temp\e587322c098bb48e9a9bd10a12b1dc53bfd55915dec951f3697188387fedbbbf.exe /C
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1756
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\e587322c098bb48e9a9bd10a12b1dc53bfd55915dec951f3697188387fedbbbf.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1180
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:784

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1756-1-0x0000000002440000-0x0000000002451000-memory.dmp

Download