qakbot | 7601edb9feedd3052966f1988a603ff7019ec4e7db98571b48a1de61483f21e2

Analysis

Target
7601edb9feedd3052966f1988a603ff7019ec4e7db98571b48a1de61483f21e2.exe
Size 993KB
Sample201114-6wsbys4ffe
SHA256 7601edb9feedd3052966f1988a603ff7019ec4e7db98571b48a1de61483f21e2
MD5 71fce232e6a876198c3605c441ca4962
SHA1 d0f2bcccbcd55826bdfef8c9fd90ace08667e625
SHA512 fc44f4ff3e0a6864ef7f4f6022884fc76a9d6f8fecd3f34b0740f6bccff46e60c28533284fe23d38e87a242dd65e4754b5f1cb11ebe7ee48e552fca4e432cc37
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
1456	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1004	7601edb9feedd3052966f1988a603ff7019ec4e7db98571b48a1de61483f21e2.exe
1100	7601edb9feedd3052966f1988a603ff7019ec4e7db98571b48a1de61483f21e2.exe
1100	7601edb9feedd3052966f1988a603ff7019ec4e7db98571b48a1de61483f21e2.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1004 wrote to memory of 1100	1004	7601edb9feedd3052966f1988a603ff7019ec4e7db98571b48a1de61483f21e2.exe	29
PID 1004 wrote to memory of 1100	1004	7601edb9feedd3052966f1988a603ff7019ec4e7db98571b48a1de61483f21e2.exe	29
PID 1004 wrote to memory of 1100	1004	7601edb9feedd3052966f1988a603ff7019ec4e7db98571b48a1de61483f21e2.exe	29
PID 1004 wrote to memory of 1100	1004	7601edb9feedd3052966f1988a603ff7019ec4e7db98571b48a1de61483f21e2.exe	29
PID 1004 wrote to memory of 1396	1004	7601edb9feedd3052966f1988a603ff7019ec4e7db98571b48a1de61483f21e2.exe	30
PID 1004 wrote to memory of 1396	1004	7601edb9feedd3052966f1988a603ff7019ec4e7db98571b48a1de61483f21e2.exe	30
PID 1004 wrote to memory of 1396	1004	7601edb9feedd3052966f1988a603ff7019ec4e7db98571b48a1de61483f21e2.exe	30
PID 1004 wrote to memory of 1396	1004	7601edb9feedd3052966f1988a603ff7019ec4e7db98571b48a1de61483f21e2.exe	30
PID 1396 wrote to memory of 1456	1396	cmd.exe	32
PID 1396 wrote to memory of 1456	1396	cmd.exe	32
PID 1396 wrote to memory of 1456	1396	cmd.exe	32
PID 1396 wrote to memory of 1456	1396	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\7601edb9feedd3052966f1988a603ff7019ec4e7db98571b48a1de61483f21e2.exe
"C:\Users\Admin\AppData\Local\Temp\7601edb9feedd3052966f1988a603ff7019ec4e7db98571b48a1de61483f21e2.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1004
- C:\Users\Admin\AppData\Local\Temp\7601edb9feedd3052966f1988a603ff7019ec4e7db98571b48a1de61483f21e2.exe
  C:\Users\Admin\AppData\Local\Temp\7601edb9feedd3052966f1988a603ff7019ec4e7db98571b48a1de61483f21e2.exe /C
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1100
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\7601edb9feedd3052966f1988a603ff7019ec4e7db98571b48a1de61483f21e2.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1396
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1456

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1100-1-0x0000000002770000-0x0000000002781000-memory.dmp

Download