qakbot | 38133b95604cbf9c73ab525f0980b04a3d2f3cdced76e13e341f164b66339795

Analysis

Target
38133b95604cbf9c73ab525f0980b04a3d2f3cdced76e13e341f164b66339795.exe
Size 270KB
Sample201113-c8l5d3dwha
SHA256 38133b95604cbf9c73ab525f0980b04a3d2f3cdced76e13e341f164b66339795
MD5 e8700eddd6cece16a9743e58a324f421
SHA1 0fd049e90a131d7edb94d2f661b7c10d4d5ec088
SHA512 8b0565019203ae5bb74a25c3645070b715606024ca8ef077d92265366ec83d1e8ce34ecf35855b9b9874a8bfd84e664f9dc857affacc70723e6fe7db55c270ed
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
1912	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1424 wrote to memory of 1652	1424	38133b95604cbf9c73ab525f0980b04a3d2f3cdced76e13e341f164b66339795.exe	29
PID 1424 wrote to memory of 1652	1424	38133b95604cbf9c73ab525f0980b04a3d2f3cdced76e13e341f164b66339795.exe	29
PID 1424 wrote to memory of 1652	1424	38133b95604cbf9c73ab525f0980b04a3d2f3cdced76e13e341f164b66339795.exe	29
PID 1424 wrote to memory of 1652	1424	38133b95604cbf9c73ab525f0980b04a3d2f3cdced76e13e341f164b66339795.exe	29
PID 1424 wrote to memory of 2016	1424	38133b95604cbf9c73ab525f0980b04a3d2f3cdced76e13e341f164b66339795.exe	30
PID 1424 wrote to memory of 2016	1424	38133b95604cbf9c73ab525f0980b04a3d2f3cdced76e13e341f164b66339795.exe	30
PID 1424 wrote to memory of 2016	1424	38133b95604cbf9c73ab525f0980b04a3d2f3cdced76e13e341f164b66339795.exe	30
PID 1424 wrote to memory of 2016	1424	38133b95604cbf9c73ab525f0980b04a3d2f3cdced76e13e341f164b66339795.exe	30
PID 2016 wrote to memory of 1912	2016	cmd.exe	32
PID 2016 wrote to memory of 1912	2016	cmd.exe	32
PID 2016 wrote to memory of 1912	2016	cmd.exe	32
PID 2016 wrote to memory of 1912	2016	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\38133b95604cbf9c73ab525f0980b04a3d2f3cdced76e13e341f164b66339795.exe
"C:\Users\Admin\AppData\Local\Temp\38133b95604cbf9c73ab525f0980b04a3d2f3cdced76e13e341f164b66339795.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1424
- C:\Users\Admin\AppData\Local\Temp\38133b95604cbf9c73ab525f0980b04a3d2f3cdced76e13e341f164b66339795.exe
  C:\Users\Admin\AppData\Local\Temp\38133b95604cbf9c73ab525f0980b04a3d2f3cdced76e13e341f164b66339795.exe /C
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1652
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\38133b95604cbf9c73ab525f0980b04a3d2f3cdced76e13e341f164b66339795.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2016
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1912

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1652-1-0x00000000024D0000-0x00000000024E1000-memory.dmp

Download