qakbot | 62aedb588c4c8afb74f218b971d8b8c4ba8c27d0404ea8a2e09b4a40048cc6c5

Analysis

Target
62aedb588c4c8afb74f218b971d8b8c4ba8c27d0404ea8a2e09b4a40048cc6c5.exe
Size 270KB
Sample201113-b5p76n7ace
SHA256 62aedb588c4c8afb74f218b971d8b8c4ba8c27d0404ea8a2e09b4a40048cc6c5
MD5 1ecdde1e4aba955630e98771f64d1834
SHA1 12ba30c3c33e2bd8e8c2dc21d325304be5ccba2e
SHA512 b4f24036ade3c255469ebe844118b21f947cf64708733651950ccf952397a40d4dba8e3bac458a009e1027119567aab5d2e35a6868f8dff9c88dc316187dd4e4
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
1412	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
344	62aedb588c4c8afb74f218b971d8b8c4ba8c27d0404ea8a2e09b4a40048cc6c5.exe
1700	62aedb588c4c8afb74f218b971d8b8c4ba8c27d0404ea8a2e09b4a40048cc6c5.exe
1700	62aedb588c4c8afb74f218b971d8b8c4ba8c27d0404ea8a2e09b4a40048cc6c5.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 344 wrote to memory of 1700	344	62aedb588c4c8afb74f218b971d8b8c4ba8c27d0404ea8a2e09b4a40048cc6c5.exe	29
PID 344 wrote to memory of 1700	344	62aedb588c4c8afb74f218b971d8b8c4ba8c27d0404ea8a2e09b4a40048cc6c5.exe	29
PID 344 wrote to memory of 1700	344	62aedb588c4c8afb74f218b971d8b8c4ba8c27d0404ea8a2e09b4a40048cc6c5.exe	29
PID 344 wrote to memory of 1700	344	62aedb588c4c8afb74f218b971d8b8c4ba8c27d0404ea8a2e09b4a40048cc6c5.exe	29
PID 344 wrote to memory of 1180	344	62aedb588c4c8afb74f218b971d8b8c4ba8c27d0404ea8a2e09b4a40048cc6c5.exe	30
PID 344 wrote to memory of 1180	344	62aedb588c4c8afb74f218b971d8b8c4ba8c27d0404ea8a2e09b4a40048cc6c5.exe	30
PID 344 wrote to memory of 1180	344	62aedb588c4c8afb74f218b971d8b8c4ba8c27d0404ea8a2e09b4a40048cc6c5.exe	30
PID 344 wrote to memory of 1180	344	62aedb588c4c8afb74f218b971d8b8c4ba8c27d0404ea8a2e09b4a40048cc6c5.exe	30
PID 1180 wrote to memory of 1412	1180	cmd.exe	32
PID 1180 wrote to memory of 1412	1180	cmd.exe	32
PID 1180 wrote to memory of 1412	1180	cmd.exe	32
PID 1180 wrote to memory of 1412	1180	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\62aedb588c4c8afb74f218b971d8b8c4ba8c27d0404ea8a2e09b4a40048cc6c5.exe
"C:\Users\Admin\AppData\Local\Temp\62aedb588c4c8afb74f218b971d8b8c4ba8c27d0404ea8a2e09b4a40048cc6c5.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:344
- C:\Users\Admin\AppData\Local\Temp\62aedb588c4c8afb74f218b971d8b8c4ba8c27d0404ea8a2e09b4a40048cc6c5.exe
  C:\Users\Admin\AppData\Local\Temp\62aedb588c4c8afb74f218b971d8b8c4ba8c27d0404ea8a2e09b4a40048cc6c5.exe /C
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1700
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\62aedb588c4c8afb74f218b971d8b8c4ba8c27d0404ea8a2e09b4a40048cc6c5.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1180
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1412

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1700-1-0x00000000025E0000-0x00000000025F1000-memory.dmp

Download