qakbot | 82ab91a0e1cf1d67b6db1d94d6d1fb0fd849ae16778bd23d9426d8e45a8def8d

Analysis

Target
82ab91a0e1cf1d67b6db1d94d6d1fb0fd849ae16778bd23d9426d8e45a8def8d.exe
Size 270KB
Sample201113-3ehsfesyl2
SHA256 82ab91a0e1cf1d67b6db1d94d6d1fb0fd849ae16778bd23d9426d8e45a8def8d
MD5 ce325136695bbf29fe72c619a1aae5a6
SHA1 5ecfca21470cce363be686ced4cece5471d6e2cb
SHA512 86e844351b0772d0742373e7cf3e23f056f046ead2caf1c5c8e233433641b972d5e7acd069c36c344938006151b4184f3be46a53e46a208ecf7a3aa0cafe4f69
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
2004	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2028	82ab91a0e1cf1d67b6db1d94d6d1fb0fd849ae16778bd23d9426d8e45a8def8d.exe
1220	82ab91a0e1cf1d67b6db1d94d6d1fb0fd849ae16778bd23d9426d8e45a8def8d.exe
1220	82ab91a0e1cf1d67b6db1d94d6d1fb0fd849ae16778bd23d9426d8e45a8def8d.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 1220	2028	82ab91a0e1cf1d67b6db1d94d6d1fb0fd849ae16778bd23d9426d8e45a8def8d.exe	29
PID 2028 wrote to memory of 1220	2028	82ab91a0e1cf1d67b6db1d94d6d1fb0fd849ae16778bd23d9426d8e45a8def8d.exe	29
PID 2028 wrote to memory of 1220	2028	82ab91a0e1cf1d67b6db1d94d6d1fb0fd849ae16778bd23d9426d8e45a8def8d.exe	29
PID 2028 wrote to memory of 1220	2028	82ab91a0e1cf1d67b6db1d94d6d1fb0fd849ae16778bd23d9426d8e45a8def8d.exe	29
PID 2028 wrote to memory of 1664	2028	82ab91a0e1cf1d67b6db1d94d6d1fb0fd849ae16778bd23d9426d8e45a8def8d.exe	30
PID 2028 wrote to memory of 1664	2028	82ab91a0e1cf1d67b6db1d94d6d1fb0fd849ae16778bd23d9426d8e45a8def8d.exe	30
PID 2028 wrote to memory of 1664	2028	82ab91a0e1cf1d67b6db1d94d6d1fb0fd849ae16778bd23d9426d8e45a8def8d.exe	30
PID 2028 wrote to memory of 1664	2028	82ab91a0e1cf1d67b6db1d94d6d1fb0fd849ae16778bd23d9426d8e45a8def8d.exe	30
PID 1664 wrote to memory of 2004	1664	cmd.exe	32
PID 1664 wrote to memory of 2004	1664	cmd.exe	32
PID 1664 wrote to memory of 2004	1664	cmd.exe	32
PID 1664 wrote to memory of 2004	1664	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\82ab91a0e1cf1d67b6db1d94d6d1fb0fd849ae16778bd23d9426d8e45a8def8d.exe
"C:\Users\Admin\AppData\Local\Temp\82ab91a0e1cf1d67b6db1d94d6d1fb0fd849ae16778bd23d9426d8e45a8def8d.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Users\Admin\AppData\Local\Temp\82ab91a0e1cf1d67b6db1d94d6d1fb0fd849ae16778bd23d9426d8e45a8def8d.exe
  C:\Users\Admin\AppData\Local\Temp\82ab91a0e1cf1d67b6db1d94d6d1fb0fd849ae16778bd23d9426d8e45a8def8d.exe /C
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1220
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\82ab91a0e1cf1d67b6db1d94d6d1fb0fd849ae16778bd23d9426d8e45a8def8d.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1664
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:2004

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1220-1-0x00000000024C0000-0x00000000024D1000-memory.dmp

Download