qakbot | 4182baab441baf376bc0ccb0c1f9d7c65628f721f02bb75b0d81cfdfd7dc5517

Analysis

Target
4182baab441baf376bc0ccb0c1f9d7c65628f721f02bb75b0d81cfdfd7dc5517.exe
Size 270KB
Sample201113-evl5fdq7ka
SHA256 4182baab441baf376bc0ccb0c1f9d7c65628f721f02bb75b0d81cfdfd7dc5517
MD5 9fbda2a1a0c26b41751ea9a6e1427a00
SHA1 3b55541ab76059b0f64cbdd11d642b8da1781ff3
SHA512 32b5298ead3469fea2905f6fbcc053735f0abe23fcb19220071329de31249ed65019a53861174ffa8d20cbe7890b5a78b42dc6f97bc94eb32e769a6d896d5042
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
1568	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1032	4182baab441baf376bc0ccb0c1f9d7c65628f721f02bb75b0d81cfdfd7dc5517.exe
1480	4182baab441baf376bc0ccb0c1f9d7c65628f721f02bb75b0d81cfdfd7dc5517.exe
1480	4182baab441baf376bc0ccb0c1f9d7c65628f721f02bb75b0d81cfdfd7dc5517.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 1480	1032	4182baab441baf376bc0ccb0c1f9d7c65628f721f02bb75b0d81cfdfd7dc5517.exe	29
PID 1032 wrote to memory of 1480	1032	4182baab441baf376bc0ccb0c1f9d7c65628f721f02bb75b0d81cfdfd7dc5517.exe	29
PID 1032 wrote to memory of 1480	1032	4182baab441baf376bc0ccb0c1f9d7c65628f721f02bb75b0d81cfdfd7dc5517.exe	29
PID 1032 wrote to memory of 1480	1032	4182baab441baf376bc0ccb0c1f9d7c65628f721f02bb75b0d81cfdfd7dc5517.exe	29
PID 1032 wrote to memory of 1728	1032	4182baab441baf376bc0ccb0c1f9d7c65628f721f02bb75b0d81cfdfd7dc5517.exe	30
PID 1032 wrote to memory of 1728	1032	4182baab441baf376bc0ccb0c1f9d7c65628f721f02bb75b0d81cfdfd7dc5517.exe	30
PID 1032 wrote to memory of 1728	1032	4182baab441baf376bc0ccb0c1f9d7c65628f721f02bb75b0d81cfdfd7dc5517.exe	30
PID 1032 wrote to memory of 1728	1032	4182baab441baf376bc0ccb0c1f9d7c65628f721f02bb75b0d81cfdfd7dc5517.exe	30
PID 1728 wrote to memory of 1568	1728	cmd.exe	32
PID 1728 wrote to memory of 1568	1728	cmd.exe	32
PID 1728 wrote to memory of 1568	1728	cmd.exe	32
PID 1728 wrote to memory of 1568	1728	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\4182baab441baf376bc0ccb0c1f9d7c65628f721f02bb75b0d81cfdfd7dc5517.exe
"C:\Users\Admin\AppData\Local\Temp\4182baab441baf376bc0ccb0c1f9d7c65628f721f02bb75b0d81cfdfd7dc5517.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Users\Admin\AppData\Local\Temp\4182baab441baf376bc0ccb0c1f9d7c65628f721f02bb75b0d81cfdfd7dc5517.exe
  C:\Users\Admin\AppData\Local\Temp\4182baab441baf376bc0ccb0c1f9d7c65628f721f02bb75b0d81cfdfd7dc5517.exe /C
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1480
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\4182baab441baf376bc0ccb0c1f9d7c65628f721f02bb75b0d81cfdfd7dc5517.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1728
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1568

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1480-1-0x00000000024D0000-0x00000000024E1000-memory.dmp

Download