qakbot | 16d8d5c193f45c2b3adcddff4d3322158fdd6448a3bedf4c5ee2f35b8eba2f38

Analysis

Target
16d8d5c193f45c2b3adcddff4d3322158fdd6448a3bedf4c5ee2f35b8eba2f38.exe
Size 270KB
Sample201113-qbmdhsn7h2
SHA256 16d8d5c193f45c2b3adcddff4d3322158fdd6448a3bedf4c5ee2f35b8eba2f38
MD5 dc1e55e3105475565e92cea507ef0eed
SHA1 6b5f7dea1b66aa3c164a626808fc838c3a4a729f
SHA512 d44da873f6e81bc7fafbed43689633c3a5d6e3cfc580f738f737c124783185502e8f6faea204a06f9bad882e6fea3d0d1ad57f87ce3e963df8a80535e5e0f04f
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
1568	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1008	16d8d5c193f45c2b3adcddff4d3322158fdd6448a3bedf4c5ee2f35b8eba2f38.exe
1064	16d8d5c193f45c2b3adcddff4d3322158fdd6448a3bedf4c5ee2f35b8eba2f38.exe
1064	16d8d5c193f45c2b3adcddff4d3322158fdd6448a3bedf4c5ee2f35b8eba2f38.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1008 wrote to memory of 1064	1008	16d8d5c193f45c2b3adcddff4d3322158fdd6448a3bedf4c5ee2f35b8eba2f38.exe	29
PID 1008 wrote to memory of 1064	1008	16d8d5c193f45c2b3adcddff4d3322158fdd6448a3bedf4c5ee2f35b8eba2f38.exe	29
PID 1008 wrote to memory of 1064	1008	16d8d5c193f45c2b3adcddff4d3322158fdd6448a3bedf4c5ee2f35b8eba2f38.exe	29
PID 1008 wrote to memory of 1064	1008	16d8d5c193f45c2b3adcddff4d3322158fdd6448a3bedf4c5ee2f35b8eba2f38.exe	29
PID 1008 wrote to memory of 1328	1008	16d8d5c193f45c2b3adcddff4d3322158fdd6448a3bedf4c5ee2f35b8eba2f38.exe	30
PID 1008 wrote to memory of 1328	1008	16d8d5c193f45c2b3adcddff4d3322158fdd6448a3bedf4c5ee2f35b8eba2f38.exe	30
PID 1008 wrote to memory of 1328	1008	16d8d5c193f45c2b3adcddff4d3322158fdd6448a3bedf4c5ee2f35b8eba2f38.exe	30
PID 1008 wrote to memory of 1328	1008	16d8d5c193f45c2b3adcddff4d3322158fdd6448a3bedf4c5ee2f35b8eba2f38.exe	30
PID 1328 wrote to memory of 1568	1328	cmd.exe	32
PID 1328 wrote to memory of 1568	1328	cmd.exe	32
PID 1328 wrote to memory of 1568	1328	cmd.exe	32
PID 1328 wrote to memory of 1568	1328	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\16d8d5c193f45c2b3adcddff4d3322158fdd6448a3bedf4c5ee2f35b8eba2f38.exe
"C:\Users\Admin\AppData\Local\Temp\16d8d5c193f45c2b3adcddff4d3322158fdd6448a3bedf4c5ee2f35b8eba2f38.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1008
- C:\Users\Admin\AppData\Local\Temp\16d8d5c193f45c2b3adcddff4d3322158fdd6448a3bedf4c5ee2f35b8eba2f38.exe
  C:\Users\Admin\AppData\Local\Temp\16d8d5c193f45c2b3adcddff4d3322158fdd6448a3bedf4c5ee2f35b8eba2f38.exe /C
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1064
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\16d8d5c193f45c2b3adcddff4d3322158fdd6448a3bedf4c5ee2f35b8eba2f38.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1328
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1568

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1064-1-0x0000000002580000-0x0000000002591000-memory.dmp

Download