qakbot | 881a2c7897390d89ecc9457641c19eac7bc5771efcb60bde8f2be08496e23517

Analysis

Target
881a2c7897390d89ecc9457641c19eac7bc5771efcb60bde8f2be08496e23517.exe
Size 1.4MB
Sample201113-eq42hyp2n6
SHA256 881a2c7897390d89ecc9457641c19eac7bc5771efcb60bde8f2be08496e23517
MD5 2fa82397ef60046860065d5ac43956c2
SHA1 fc7e30d60418217d3c1dcf94991908df15ebd347
SHA512 96ae708ccd9da3e0ab0f143dc63d2852a04930b0f5ecc6403da5c843c34adffe94858df8d6f40383cf5f0b7cc5ed5f2e2557f834b866eb07c84b82d02a480157
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
1348	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1700	881a2c7897390d89ecc9457641c19eac7bc5771efcb60bde8f2be08496e23517.exe
1264	881a2c7897390d89ecc9457641c19eac7bc5771efcb60bde8f2be08496e23517.exe
1264	881a2c7897390d89ecc9457641c19eac7bc5771efcb60bde8f2be08496e23517.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 1264	1700	881a2c7897390d89ecc9457641c19eac7bc5771efcb60bde8f2be08496e23517.exe	29
PID 1700 wrote to memory of 1264	1700	881a2c7897390d89ecc9457641c19eac7bc5771efcb60bde8f2be08496e23517.exe	29
PID 1700 wrote to memory of 1264	1700	881a2c7897390d89ecc9457641c19eac7bc5771efcb60bde8f2be08496e23517.exe	29
PID 1700 wrote to memory of 1264	1700	881a2c7897390d89ecc9457641c19eac7bc5771efcb60bde8f2be08496e23517.exe	29
PID 1700 wrote to memory of 1432	1700	881a2c7897390d89ecc9457641c19eac7bc5771efcb60bde8f2be08496e23517.exe	30
PID 1700 wrote to memory of 1432	1700	881a2c7897390d89ecc9457641c19eac7bc5771efcb60bde8f2be08496e23517.exe	30
PID 1700 wrote to memory of 1432	1700	881a2c7897390d89ecc9457641c19eac7bc5771efcb60bde8f2be08496e23517.exe	30
PID 1700 wrote to memory of 1432	1700	881a2c7897390d89ecc9457641c19eac7bc5771efcb60bde8f2be08496e23517.exe	30
PID 1432 wrote to memory of 1348	1432	cmd.exe	32
PID 1432 wrote to memory of 1348	1432	cmd.exe	32
PID 1432 wrote to memory of 1348	1432	cmd.exe	32
PID 1432 wrote to memory of 1348	1432	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\881a2c7897390d89ecc9457641c19eac7bc5771efcb60bde8f2be08496e23517.exe
"C:\Users\Admin\AppData\Local\Temp\881a2c7897390d89ecc9457641c19eac7bc5771efcb60bde8f2be08496e23517.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Users\Admin\AppData\Local\Temp\881a2c7897390d89ecc9457641c19eac7bc5771efcb60bde8f2be08496e23517.exe
  C:\Users\Admin\AppData\Local\Temp\881a2c7897390d89ecc9457641c19eac7bc5771efcb60bde8f2be08496e23517.exe /C
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1264
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\881a2c7897390d89ecc9457641c19eac7bc5771efcb60bde8f2be08496e23517.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1432
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1348

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1264-1-0x00000000027D0000-0x00000000027E1000-memory.dmp

Download