qakbot | b2cc4637dbd26123d5401d4040ded43a618d8a719510692fc85ae87a4789173e

Analysis

Target
b2cc4637dbd26123d5401d4040ded43a618d8a719510692fc85ae87a4789173e.exe
Size 270KB
Sample201114-gp6pes2bla
SHA256 b2cc4637dbd26123d5401d4040ded43a618d8a719510692fc85ae87a4789173e
MD5 3028a88811e2e9ade4b2b6a6cf2046af
SHA1 1f74a4d4d4ff7d0872c3472340b7bc0652b6d68c
SHA512 d193741e7fc71372d1e13d75716467ed3deb46649d515882e32ae39b3d194c8b9b19e3afb18bf38ec7d12d3bb7a616e04f715ad25fb5873935a7cfd3735c22df
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
1648	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1056 wrote to memory of 836	1056	b2cc4637dbd26123d5401d4040ded43a618d8a719510692fc85ae87a4789173e.exe	29
PID 1056 wrote to memory of 836	1056	b2cc4637dbd26123d5401d4040ded43a618d8a719510692fc85ae87a4789173e.exe	29
PID 1056 wrote to memory of 836	1056	b2cc4637dbd26123d5401d4040ded43a618d8a719510692fc85ae87a4789173e.exe	29
PID 1056 wrote to memory of 836	1056	b2cc4637dbd26123d5401d4040ded43a618d8a719510692fc85ae87a4789173e.exe	29
PID 1056 wrote to memory of 1428	1056	b2cc4637dbd26123d5401d4040ded43a618d8a719510692fc85ae87a4789173e.exe	30
PID 1056 wrote to memory of 1428	1056	b2cc4637dbd26123d5401d4040ded43a618d8a719510692fc85ae87a4789173e.exe	30
PID 1056 wrote to memory of 1428	1056	b2cc4637dbd26123d5401d4040ded43a618d8a719510692fc85ae87a4789173e.exe	30
PID 1056 wrote to memory of 1428	1056	b2cc4637dbd26123d5401d4040ded43a618d8a719510692fc85ae87a4789173e.exe	30
PID 1428 wrote to memory of 1648	1428	cmd.exe	32
PID 1428 wrote to memory of 1648	1428	cmd.exe	32
PID 1428 wrote to memory of 1648	1428	cmd.exe	32
PID 1428 wrote to memory of 1648	1428	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\b2cc4637dbd26123d5401d4040ded43a618d8a719510692fc85ae87a4789173e.exe
"C:\Users\Admin\AppData\Local\Temp\b2cc4637dbd26123d5401d4040ded43a618d8a719510692fc85ae87a4789173e.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Users\Admin\AppData\Local\Temp\b2cc4637dbd26123d5401d4040ded43a618d8a719510692fc85ae87a4789173e.exe
  C:\Users\Admin\AppData\Local\Temp\b2cc4637dbd26123d5401d4040ded43a618d8a719510692fc85ae87a4789173e.exe /C
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:836
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\b2cc4637dbd26123d5401d4040ded43a618d8a719510692fc85ae87a4789173e.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1428
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1648

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/836-1-0x0000000002590000-0x00000000025A1000-memory.dmp

Download