qakbot | 60494d0e44e94acaa558ec9bd8cf2781e91865873d4c7af02ccdc545b9f5466c

Analysis

Target
60494d0e44e94acaa558ec9bd8cf2781e91865873d4c7af02ccdc545b9f5466c.exe
Size 270KB
Sample201113-l6qwhpwarn
SHA256 60494d0e44e94acaa558ec9bd8cf2781e91865873d4c7af02ccdc545b9f5466c
MD5 f54a28f3b8daea94a623a12958182761
SHA1 147952ce2c7cc9bd9f86dc2ab133e36873ca074f
SHA512 bb2df474139d028de6a89e3e1ec3fda4db6b8217dc5d15825c7ce153c645ca37625295f8ae298cbbb52ecfe30b2b55bb1cc6b46048421214e91066719ed547a1
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
1332	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
336	60494d0e44e94acaa558ec9bd8cf2781e91865873d4c7af02ccdc545b9f5466c.exe
1664	60494d0e44e94acaa558ec9bd8cf2781e91865873d4c7af02ccdc545b9f5466c.exe
1664	60494d0e44e94acaa558ec9bd8cf2781e91865873d4c7af02ccdc545b9f5466c.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 336 wrote to memory of 1664	336	60494d0e44e94acaa558ec9bd8cf2781e91865873d4c7af02ccdc545b9f5466c.exe	29
PID 336 wrote to memory of 1664	336	60494d0e44e94acaa558ec9bd8cf2781e91865873d4c7af02ccdc545b9f5466c.exe	29
PID 336 wrote to memory of 1664	336	60494d0e44e94acaa558ec9bd8cf2781e91865873d4c7af02ccdc545b9f5466c.exe	29
PID 336 wrote to memory of 1664	336	60494d0e44e94acaa558ec9bd8cf2781e91865873d4c7af02ccdc545b9f5466c.exe	29
PID 336 wrote to memory of 1276	336	60494d0e44e94acaa558ec9bd8cf2781e91865873d4c7af02ccdc545b9f5466c.exe	30
PID 336 wrote to memory of 1276	336	60494d0e44e94acaa558ec9bd8cf2781e91865873d4c7af02ccdc545b9f5466c.exe	30
PID 336 wrote to memory of 1276	336	60494d0e44e94acaa558ec9bd8cf2781e91865873d4c7af02ccdc545b9f5466c.exe	30
PID 336 wrote to memory of 1276	336	60494d0e44e94acaa558ec9bd8cf2781e91865873d4c7af02ccdc545b9f5466c.exe	30
PID 1276 wrote to memory of 1332	1276	cmd.exe	32
PID 1276 wrote to memory of 1332	1276	cmd.exe	32
PID 1276 wrote to memory of 1332	1276	cmd.exe	32
PID 1276 wrote to memory of 1332	1276	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\60494d0e44e94acaa558ec9bd8cf2781e91865873d4c7af02ccdc545b9f5466c.exe
"C:\Users\Admin\AppData\Local\Temp\60494d0e44e94acaa558ec9bd8cf2781e91865873d4c7af02ccdc545b9f5466c.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:336
- C:\Users\Admin\AppData\Local\Temp\60494d0e44e94acaa558ec9bd8cf2781e91865873d4c7af02ccdc545b9f5466c.exe
  C:\Users\Admin\AppData\Local\Temp\60494d0e44e94acaa558ec9bd8cf2781e91865873d4c7af02ccdc545b9f5466c.exe /C
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1664
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\60494d0e44e94acaa558ec9bd8cf2781e91865873d4c7af02ccdc545b9f5466c.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1276
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1332

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1664-1-0x0000000002520000-0x0000000002531000-memory.dmp

Download