qakbot | aaa7fcff7b19c59f14a6cee1ea723957b8a1dc9c54153e89599e610e40f022f2

Analysis

Target
aaa7fcff7b19c59f14a6cee1ea723957b8a1dc9c54153e89599e610e40f022f2.exe
Size 270KB
Sample201113-gexhyrjhh2
SHA256 aaa7fcff7b19c59f14a6cee1ea723957b8a1dc9c54153e89599e610e40f022f2
MD5 85ef477b23ec26047f1585143eb0d08b
SHA1 ced36144579785685f23c9dbff0a90885bd7622d
SHA512 1df58986796d06c24a8b6127d92101c013a4cd02d77a04868f03c80d138ca10b5e96638a77a8dd332874b055e8b0951bcd4648d9e95e0036e7d66c644a3bed7f
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
1440	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1128	aaa7fcff7b19c59f14a6cee1ea723957b8a1dc9c54153e89599e610e40f022f2.exe
1108	aaa7fcff7b19c59f14a6cee1ea723957b8a1dc9c54153e89599e610e40f022f2.exe
1108	aaa7fcff7b19c59f14a6cee1ea723957b8a1dc9c54153e89599e610e40f022f2.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1128 wrote to memory of 1108	1128	aaa7fcff7b19c59f14a6cee1ea723957b8a1dc9c54153e89599e610e40f022f2.exe	29
PID 1128 wrote to memory of 1108	1128	aaa7fcff7b19c59f14a6cee1ea723957b8a1dc9c54153e89599e610e40f022f2.exe	29
PID 1128 wrote to memory of 1108	1128	aaa7fcff7b19c59f14a6cee1ea723957b8a1dc9c54153e89599e610e40f022f2.exe	29
PID 1128 wrote to memory of 1108	1128	aaa7fcff7b19c59f14a6cee1ea723957b8a1dc9c54153e89599e610e40f022f2.exe	29
PID 1128 wrote to memory of 1544	1128	aaa7fcff7b19c59f14a6cee1ea723957b8a1dc9c54153e89599e610e40f022f2.exe	30
PID 1128 wrote to memory of 1544	1128	aaa7fcff7b19c59f14a6cee1ea723957b8a1dc9c54153e89599e610e40f022f2.exe	30
PID 1128 wrote to memory of 1544	1128	aaa7fcff7b19c59f14a6cee1ea723957b8a1dc9c54153e89599e610e40f022f2.exe	30
PID 1128 wrote to memory of 1544	1128	aaa7fcff7b19c59f14a6cee1ea723957b8a1dc9c54153e89599e610e40f022f2.exe	30
PID 1544 wrote to memory of 1440	1544	cmd.exe	32
PID 1544 wrote to memory of 1440	1544	cmd.exe	32
PID 1544 wrote to memory of 1440	1544	cmd.exe	32
PID 1544 wrote to memory of 1440	1544	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\aaa7fcff7b19c59f14a6cee1ea723957b8a1dc9c54153e89599e610e40f022f2.exe
"C:\Users\Admin\AppData\Local\Temp\aaa7fcff7b19c59f14a6cee1ea723957b8a1dc9c54153e89599e610e40f022f2.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Users\Admin\AppData\Local\Temp\aaa7fcff7b19c59f14a6cee1ea723957b8a1dc9c54153e89599e610e40f022f2.exe
  C:\Users\Admin\AppData\Local\Temp\aaa7fcff7b19c59f14a6cee1ea723957b8a1dc9c54153e89599e610e40f022f2.exe /C
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1108
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\aaa7fcff7b19c59f14a6cee1ea723957b8a1dc9c54153e89599e610e40f022f2.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1544
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1440

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1108-1-0x0000000002650000-0x0000000002661000-memory.dmp

Download