qakbot | 56d529f84f59923d5169bae5e6c2b9f476aea1faaa58a85d38ba8e8551dca502

Analysis

Target
56d529f84f59923d5169bae5e6c2b9f476aea1faaa58a85d38ba8e8551dca502.exe
Size 250KB
Sample201113-vevsv5a83e
SHA256 56d529f84f59923d5169bae5e6c2b9f476aea1faaa58a85d38ba8e8551dca502
MD5 d3f2ea7dbb6169bb752096a698d4d3f7
SHA1 cb9856ac313a1adafffb9707ced271d71af8f0ea
SHA512 ab85f2589bb7714f00c55928ca3ae46b1786e7978889432b7880b14995cd3f3d09e2a8c49591eca68a495838e15e1c4cec6a9b1341b04d62018352afa2bbcdb3
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
1144	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1588	56d529f84f59923d5169bae5e6c2b9f476aea1faaa58a85d38ba8e8551dca502.exe
1064	56d529f84f59923d5169bae5e6c2b9f476aea1faaa58a85d38ba8e8551dca502.exe
1064	56d529f84f59923d5169bae5e6c2b9f476aea1faaa58a85d38ba8e8551dca502.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1588 wrote to memory of 1064	1588	56d529f84f59923d5169bae5e6c2b9f476aea1faaa58a85d38ba8e8551dca502.exe	29
PID 1588 wrote to memory of 1064	1588	56d529f84f59923d5169bae5e6c2b9f476aea1faaa58a85d38ba8e8551dca502.exe	29
PID 1588 wrote to memory of 1064	1588	56d529f84f59923d5169bae5e6c2b9f476aea1faaa58a85d38ba8e8551dca502.exe	29
PID 1588 wrote to memory of 1064	1588	56d529f84f59923d5169bae5e6c2b9f476aea1faaa58a85d38ba8e8551dca502.exe	29
PID 1588 wrote to memory of 2012	1588	56d529f84f59923d5169bae5e6c2b9f476aea1faaa58a85d38ba8e8551dca502.exe	30
PID 1588 wrote to memory of 2012	1588	56d529f84f59923d5169bae5e6c2b9f476aea1faaa58a85d38ba8e8551dca502.exe	30
PID 1588 wrote to memory of 2012	1588	56d529f84f59923d5169bae5e6c2b9f476aea1faaa58a85d38ba8e8551dca502.exe	30
PID 1588 wrote to memory of 2012	1588	56d529f84f59923d5169bae5e6c2b9f476aea1faaa58a85d38ba8e8551dca502.exe	30
PID 2012 wrote to memory of 1144	2012	cmd.exe	32
PID 2012 wrote to memory of 1144	2012	cmd.exe	32
PID 2012 wrote to memory of 1144	2012	cmd.exe	32
PID 2012 wrote to memory of 1144	2012	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\56d529f84f59923d5169bae5e6c2b9f476aea1faaa58a85d38ba8e8551dca502.exe
"C:\Users\Admin\AppData\Local\Temp\56d529f84f59923d5169bae5e6c2b9f476aea1faaa58a85d38ba8e8551dca502.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1588
- C:\Users\Admin\AppData\Local\Temp\56d529f84f59923d5169bae5e6c2b9f476aea1faaa58a85d38ba8e8551dca502.exe
  C:\Users\Admin\AppData\Local\Temp\56d529f84f59923d5169bae5e6c2b9f476aea1faaa58a85d38ba8e8551dca502.exe /C
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1064
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\56d529f84f59923d5169bae5e6c2b9f476aea1faaa58a85d38ba8e8551dca502.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2012
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1144

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1064-1-0x0000000002420000-0x0000000002431000-memory.dmp

Download