qakbot | a49bb23f311e66fee620bffb2a3fa1e97d1b39ee4bc4ca8e5b34c4e232b1416e

Analysis

Target
a49bb23f311e66fee620bffb2a3fa1e97d1b39ee4bc4ca8e5b34c4e232b1416e.exe
Size 270KB
Sample201113-bprgvd1f3x
SHA256 a49bb23f311e66fee620bffb2a3fa1e97d1b39ee4bc4ca8e5b34c4e232b1416e
MD5 0613ac8ff8e5fec5c108894cd0ec78b5
SHA1 6e6a05481216c49cde85ffea3f7c06cde9fc7e01
SHA512 10a7252849d4f945c31745472d8009b6821dae42d5479352e3aa42feb27b35d3b7405eb6d77a0b63c8804408f5e396a7162f87fd3ce7eb1e18b379c03cc3e24e
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
1620	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1804	a49bb23f311e66fee620bffb2a3fa1e97d1b39ee4bc4ca8e5b34c4e232b1416e.exe
1796	a49bb23f311e66fee620bffb2a3fa1e97d1b39ee4bc4ca8e5b34c4e232b1416e.exe
1796	a49bb23f311e66fee620bffb2a3fa1e97d1b39ee4bc4ca8e5b34c4e232b1416e.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1804 wrote to memory of 1796	1804	a49bb23f311e66fee620bffb2a3fa1e97d1b39ee4bc4ca8e5b34c4e232b1416e.exe	29
PID 1804 wrote to memory of 1796	1804	a49bb23f311e66fee620bffb2a3fa1e97d1b39ee4bc4ca8e5b34c4e232b1416e.exe	29
PID 1804 wrote to memory of 1796	1804	a49bb23f311e66fee620bffb2a3fa1e97d1b39ee4bc4ca8e5b34c4e232b1416e.exe	29
PID 1804 wrote to memory of 1796	1804	a49bb23f311e66fee620bffb2a3fa1e97d1b39ee4bc4ca8e5b34c4e232b1416e.exe	29
PID 1804 wrote to memory of 1220	1804	a49bb23f311e66fee620bffb2a3fa1e97d1b39ee4bc4ca8e5b34c4e232b1416e.exe	30
PID 1804 wrote to memory of 1220	1804	a49bb23f311e66fee620bffb2a3fa1e97d1b39ee4bc4ca8e5b34c4e232b1416e.exe	30
PID 1804 wrote to memory of 1220	1804	a49bb23f311e66fee620bffb2a3fa1e97d1b39ee4bc4ca8e5b34c4e232b1416e.exe	30
PID 1804 wrote to memory of 1220	1804	a49bb23f311e66fee620bffb2a3fa1e97d1b39ee4bc4ca8e5b34c4e232b1416e.exe	30
PID 1220 wrote to memory of 1620	1220	cmd.exe	32
PID 1220 wrote to memory of 1620	1220	cmd.exe	32
PID 1220 wrote to memory of 1620	1220	cmd.exe	32
PID 1220 wrote to memory of 1620	1220	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\a49bb23f311e66fee620bffb2a3fa1e97d1b39ee4bc4ca8e5b34c4e232b1416e.exe
"C:\Users\Admin\AppData\Local\Temp\a49bb23f311e66fee620bffb2a3fa1e97d1b39ee4bc4ca8e5b34c4e232b1416e.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1804
- C:\Users\Admin\AppData\Local\Temp\a49bb23f311e66fee620bffb2a3fa1e97d1b39ee4bc4ca8e5b34c4e232b1416e.exe
  C:\Users\Admin\AppData\Local\Temp\a49bb23f311e66fee620bffb2a3fa1e97d1b39ee4bc4ca8e5b34c4e232b1416e.exe /C
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1796
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\a49bb23f311e66fee620bffb2a3fa1e97d1b39ee4bc4ca8e5b34c4e232b1416e.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1220
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1620

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1796-1-0x00000000024B0000-0x00000000024C1000-memory.dmp

Download