qakbot | 82aa970db939b35c763e6afddcde7ad596a5dc6e931efb2f88e85afd840fa5c6

Analysis

Target
82aa970db939b35c763e6afddcde7ad596a5dc6e931efb2f88e85afd840fa5c6.exe
Size 270KB
Sample201113-878m29dhvx
SHA256 82aa970db939b35c763e6afddcde7ad596a5dc6e931efb2f88e85afd840fa5c6
MD5 894e5eb4dd086c9fcd211d6325b21d92
SHA1 fab0f61fffe4a83adae43ef492572c76d8a5012d
SHA512 065f1ff364acc15f7b6e31c45ea0740d022c82d909a8ec92bbae6cea8f8336ac7296738a0fbd02eb7b03f733eab5e2b46643c1d4a20664327f463196be11686f
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
820	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1744	82aa970db939b35c763e6afddcde7ad596a5dc6e931efb2f88e85afd840fa5c6.exe
1908	82aa970db939b35c763e6afddcde7ad596a5dc6e931efb2f88e85afd840fa5c6.exe
1908	82aa970db939b35c763e6afddcde7ad596a5dc6e931efb2f88e85afd840fa5c6.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 1908	1744	82aa970db939b35c763e6afddcde7ad596a5dc6e931efb2f88e85afd840fa5c6.exe	29
PID 1744 wrote to memory of 1908	1744	82aa970db939b35c763e6afddcde7ad596a5dc6e931efb2f88e85afd840fa5c6.exe	29
PID 1744 wrote to memory of 1908	1744	82aa970db939b35c763e6afddcde7ad596a5dc6e931efb2f88e85afd840fa5c6.exe	29
PID 1744 wrote to memory of 1908	1744	82aa970db939b35c763e6afddcde7ad596a5dc6e931efb2f88e85afd840fa5c6.exe	29
PID 1744 wrote to memory of 816	1744	82aa970db939b35c763e6afddcde7ad596a5dc6e931efb2f88e85afd840fa5c6.exe	30
PID 1744 wrote to memory of 816	1744	82aa970db939b35c763e6afddcde7ad596a5dc6e931efb2f88e85afd840fa5c6.exe	30
PID 1744 wrote to memory of 816	1744	82aa970db939b35c763e6afddcde7ad596a5dc6e931efb2f88e85afd840fa5c6.exe	30
PID 1744 wrote to memory of 816	1744	82aa970db939b35c763e6afddcde7ad596a5dc6e931efb2f88e85afd840fa5c6.exe	30
PID 816 wrote to memory of 820	816	cmd.exe	32
PID 816 wrote to memory of 820	816	cmd.exe	32
PID 816 wrote to memory of 820	816	cmd.exe	32
PID 816 wrote to memory of 820	816	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\82aa970db939b35c763e6afddcde7ad596a5dc6e931efb2f88e85afd840fa5c6.exe
"C:\Users\Admin\AppData\Local\Temp\82aa970db939b35c763e6afddcde7ad596a5dc6e931efb2f88e85afd840fa5c6.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Users\Admin\AppData\Local\Temp\82aa970db939b35c763e6afddcde7ad596a5dc6e931efb2f88e85afd840fa5c6.exe
  C:\Users\Admin\AppData\Local\Temp\82aa970db939b35c763e6afddcde7ad596a5dc6e931efb2f88e85afd840fa5c6.exe /C
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1908
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\82aa970db939b35c763e6afddcde7ad596a5dc6e931efb2f88e85afd840fa5c6.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:816
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:820

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1908-1-0x0000000002610000-0x0000000002621000-memory.dmp

Download