qakbot | 1347ffea327367ff357fc9a184cfa741565012c03407bc6674093d7b4251da88

Analysis

Target
1347ffea327367ff357fc9a184cfa741565012c03407bc6674093d7b4251da88.exe
Size 270KB
Sample201114-b2mdcs392x
SHA256 1347ffea327367ff357fc9a184cfa741565012c03407bc6674093d7b4251da88
MD5 b7bbae5e80933fd4f504016745bbaf4d
SHA1 cdc88365a8da31cadef80c0b154f6bec8270b980
SHA512 bd120e988d7c689d7f3ca1a7ebd6366e8acde9340b66c60229f3bc73a3b30d438afed4a774e0316313c1aeccf9789f070d32e8713a3c4944be5e70c0c8729eb8
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
1088	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1892 wrote to memory of 1748	1892	1347ffea327367ff357fc9a184cfa741565012c03407bc6674093d7b4251da88.exe	29
PID 1892 wrote to memory of 1748	1892	1347ffea327367ff357fc9a184cfa741565012c03407bc6674093d7b4251da88.exe	29
PID 1892 wrote to memory of 1748	1892	1347ffea327367ff357fc9a184cfa741565012c03407bc6674093d7b4251da88.exe	29
PID 1892 wrote to memory of 1748	1892	1347ffea327367ff357fc9a184cfa741565012c03407bc6674093d7b4251da88.exe	29
PID 1892 wrote to memory of 920	1892	1347ffea327367ff357fc9a184cfa741565012c03407bc6674093d7b4251da88.exe	30
PID 1892 wrote to memory of 920	1892	1347ffea327367ff357fc9a184cfa741565012c03407bc6674093d7b4251da88.exe	30
PID 1892 wrote to memory of 920	1892	1347ffea327367ff357fc9a184cfa741565012c03407bc6674093d7b4251da88.exe	30
PID 1892 wrote to memory of 920	1892	1347ffea327367ff357fc9a184cfa741565012c03407bc6674093d7b4251da88.exe	30
PID 920 wrote to memory of 1088	920	cmd.exe	32
PID 920 wrote to memory of 1088	920	cmd.exe	32
PID 920 wrote to memory of 1088	920	cmd.exe	32
PID 920 wrote to memory of 1088	920	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\1347ffea327367ff357fc9a184cfa741565012c03407bc6674093d7b4251da88.exe
"C:\Users\Admin\AppData\Local\Temp\1347ffea327367ff357fc9a184cfa741565012c03407bc6674093d7b4251da88.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1892
- C:\Users\Admin\AppData\Local\Temp\1347ffea327367ff357fc9a184cfa741565012c03407bc6674093d7b4251da88.exe
  C:\Users\Admin\AppData\Local\Temp\1347ffea327367ff357fc9a184cfa741565012c03407bc6674093d7b4251da88.exe /C
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1748
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\1347ffea327367ff357fc9a184cfa741565012c03407bc6674093d7b4251da88.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:920
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1088

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1748-1-0x0000000002530000-0x0000000002541000-memory.dmp

Download