qakbot | ef0fca103b1c4d53879e77d7e6d839c3c91dcadbf6878b241ea0da220fcb60f9

Analysis

Target
ef0fca103b1c4d53879e77d7e6d839c3c91dcadbf6878b241ea0da220fcb60f9.exe
Size 270KB
Sample201114-cpds666572
SHA256 ef0fca103b1c4d53879e77d7e6d839c3c91dcadbf6878b241ea0da220fcb60f9
MD5 23ebfdd4a2eb47a78c8494b5427ffd94
SHA1 3533ffb8031ea4c9ee104a56b90ccd57a8c2a4eb
SHA512 7d18a7589ccdf934638c4efe993644ff8b4d7a49490f598a59615ddc899f99fa787f05a2fd35d342e38b7e6b2faeebbc1bf3796cf565fbb62509b518b424b89f
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
816	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1764	ef0fca103b1c4d53879e77d7e6d839c3c91dcadbf6878b241ea0da220fcb60f9.exe
1772	ef0fca103b1c4d53879e77d7e6d839c3c91dcadbf6878b241ea0da220fcb60f9.exe
1772	ef0fca103b1c4d53879e77d7e6d839c3c91dcadbf6878b241ea0da220fcb60f9.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 1772	1764	ef0fca103b1c4d53879e77d7e6d839c3c91dcadbf6878b241ea0da220fcb60f9.exe	29
PID 1764 wrote to memory of 1772	1764	ef0fca103b1c4d53879e77d7e6d839c3c91dcadbf6878b241ea0da220fcb60f9.exe	29
PID 1764 wrote to memory of 1772	1764	ef0fca103b1c4d53879e77d7e6d839c3c91dcadbf6878b241ea0da220fcb60f9.exe	29
PID 1764 wrote to memory of 1772	1764	ef0fca103b1c4d53879e77d7e6d839c3c91dcadbf6878b241ea0da220fcb60f9.exe	29
PID 1764 wrote to memory of 1232	1764	ef0fca103b1c4d53879e77d7e6d839c3c91dcadbf6878b241ea0da220fcb60f9.exe	30
PID 1764 wrote to memory of 1232	1764	ef0fca103b1c4d53879e77d7e6d839c3c91dcadbf6878b241ea0da220fcb60f9.exe	30
PID 1764 wrote to memory of 1232	1764	ef0fca103b1c4d53879e77d7e6d839c3c91dcadbf6878b241ea0da220fcb60f9.exe	30
PID 1764 wrote to memory of 1232	1764	ef0fca103b1c4d53879e77d7e6d839c3c91dcadbf6878b241ea0da220fcb60f9.exe	30
PID 1232 wrote to memory of 816	1232	cmd.exe	32
PID 1232 wrote to memory of 816	1232	cmd.exe	32
PID 1232 wrote to memory of 816	1232	cmd.exe	32
PID 1232 wrote to memory of 816	1232	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\ef0fca103b1c4d53879e77d7e6d839c3c91dcadbf6878b241ea0da220fcb60f9.exe
"C:\Users\Admin\AppData\Local\Temp\ef0fca103b1c4d53879e77d7e6d839c3c91dcadbf6878b241ea0da220fcb60f9.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Users\Admin\AppData\Local\Temp\ef0fca103b1c4d53879e77d7e6d839c3c91dcadbf6878b241ea0da220fcb60f9.exe
  C:\Users\Admin\AppData\Local\Temp\ef0fca103b1c4d53879e77d7e6d839c3c91dcadbf6878b241ea0da220fcb60f9.exe /C
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1772
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\ef0fca103b1c4d53879e77d7e6d839c3c91dcadbf6878b241ea0da220fcb60f9.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1232
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:816

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1772-1-0x00000000024E0000-0x00000000024F1000-memory.dmp

Download