qakbot | 65469fb02cadcc7e78158404a781b8868b93bd8fbe6d01b5132e51ddcd07e4ee

Analysis

Target
65469fb02cadcc7e78158404a781b8868b93bd8fbe6d01b5132e51ddcd07e4ee.exe
Size 270KB
Sample201114-2d6llmn7vs
SHA256 65469fb02cadcc7e78158404a781b8868b93bd8fbe6d01b5132e51ddcd07e4ee
MD5 324d0bff14b847860c7aef1445a519a6
SHA1 dd32a1039eaf66b2de4a58a1bbb59d5b632a77a3
SHA512 2f7d9e28fbe13b9260bdcf083003df7e27f6d38b82f6d4c9a9b2e694a25f0f566c7d0cafbdf0500a455869a502efd5a750f7e465ca9d5ae3c2c7e64c334ae71e
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
804	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
300	65469fb02cadcc7e78158404a781b8868b93bd8fbe6d01b5132e51ddcd07e4ee.exe
2032	65469fb02cadcc7e78158404a781b8868b93bd8fbe6d01b5132e51ddcd07e4ee.exe
2032	65469fb02cadcc7e78158404a781b8868b93bd8fbe6d01b5132e51ddcd07e4ee.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 300 wrote to memory of 2032	300	65469fb02cadcc7e78158404a781b8868b93bd8fbe6d01b5132e51ddcd07e4ee.exe	29
PID 300 wrote to memory of 2032	300	65469fb02cadcc7e78158404a781b8868b93bd8fbe6d01b5132e51ddcd07e4ee.exe	29
PID 300 wrote to memory of 2032	300	65469fb02cadcc7e78158404a781b8868b93bd8fbe6d01b5132e51ddcd07e4ee.exe	29
PID 300 wrote to memory of 2032	300	65469fb02cadcc7e78158404a781b8868b93bd8fbe6d01b5132e51ddcd07e4ee.exe	29
PID 300 wrote to memory of 1100	300	65469fb02cadcc7e78158404a781b8868b93bd8fbe6d01b5132e51ddcd07e4ee.exe	30
PID 300 wrote to memory of 1100	300	65469fb02cadcc7e78158404a781b8868b93bd8fbe6d01b5132e51ddcd07e4ee.exe	30
PID 300 wrote to memory of 1100	300	65469fb02cadcc7e78158404a781b8868b93bd8fbe6d01b5132e51ddcd07e4ee.exe	30
PID 300 wrote to memory of 1100	300	65469fb02cadcc7e78158404a781b8868b93bd8fbe6d01b5132e51ddcd07e4ee.exe	30
PID 1100 wrote to memory of 804	1100	cmd.exe	32
PID 1100 wrote to memory of 804	1100	cmd.exe	32
PID 1100 wrote to memory of 804	1100	cmd.exe	32
PID 1100 wrote to memory of 804	1100	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\65469fb02cadcc7e78158404a781b8868b93bd8fbe6d01b5132e51ddcd07e4ee.exe
"C:\Users\Admin\AppData\Local\Temp\65469fb02cadcc7e78158404a781b8868b93bd8fbe6d01b5132e51ddcd07e4ee.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:300
- C:\Users\Admin\AppData\Local\Temp\65469fb02cadcc7e78158404a781b8868b93bd8fbe6d01b5132e51ddcd07e4ee.exe
  C:\Users\Admin\AppData\Local\Temp\65469fb02cadcc7e78158404a781b8868b93bd8fbe6d01b5132e51ddcd07e4ee.exe /C
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2032
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\65469fb02cadcc7e78158404a781b8868b93bd8fbe6d01b5132e51ddcd07e4ee.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1100
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:804

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2032-1-0x0000000002580000-0x0000000002591000-memory.dmp

Download