qakbot | 42eeb4d661dfebac7e841847c4ae0b9643e0b77324e9ef10be4df4159520f3be

Analysis

Target
42eeb4d661dfebac7e841847c4ae0b9643e0b77324e9ef10be4df4159520f3be.exe
Size 339KB
Sample201114-mtphb7b716
SHA256 42eeb4d661dfebac7e841847c4ae0b9643e0b77324e9ef10be4df4159520f3be
MD5 6ab3eb3ba149d9cce2a335d5a630f325
SHA1 dd527e44b24e8389665482915b2b71ddc472e7e7
SHA512 aa44eead9ecf28828d4767fa82902e3b34b0b54a51ab5ccb399b254a8a20404ac60655d259ab1f558d3741958fdee611b281dc87e700166a93acc65e0c1a342d
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
316	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
344	42eeb4d661dfebac7e841847c4ae0b9643e0b77324e9ef10be4df4159520f3be.exe
1760	42eeb4d661dfebac7e841847c4ae0b9643e0b77324e9ef10be4df4159520f3be.exe
1760	42eeb4d661dfebac7e841847c4ae0b9643e0b77324e9ef10be4df4159520f3be.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 344 wrote to memory of 1760	344	42eeb4d661dfebac7e841847c4ae0b9643e0b77324e9ef10be4df4159520f3be.exe	29
PID 344 wrote to memory of 1760	344	42eeb4d661dfebac7e841847c4ae0b9643e0b77324e9ef10be4df4159520f3be.exe	29
PID 344 wrote to memory of 1760	344	42eeb4d661dfebac7e841847c4ae0b9643e0b77324e9ef10be4df4159520f3be.exe	29
PID 344 wrote to memory of 1760	344	42eeb4d661dfebac7e841847c4ae0b9643e0b77324e9ef10be4df4159520f3be.exe	29
PID 344 wrote to memory of 1504	344	42eeb4d661dfebac7e841847c4ae0b9643e0b77324e9ef10be4df4159520f3be.exe	30
PID 344 wrote to memory of 1504	344	42eeb4d661dfebac7e841847c4ae0b9643e0b77324e9ef10be4df4159520f3be.exe	30
PID 344 wrote to memory of 1504	344	42eeb4d661dfebac7e841847c4ae0b9643e0b77324e9ef10be4df4159520f3be.exe	30
PID 344 wrote to memory of 1504	344	42eeb4d661dfebac7e841847c4ae0b9643e0b77324e9ef10be4df4159520f3be.exe	30
PID 1504 wrote to memory of 316	1504	cmd.exe	32
PID 1504 wrote to memory of 316	1504	cmd.exe	32
PID 1504 wrote to memory of 316	1504	cmd.exe	32
PID 1504 wrote to memory of 316	1504	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\42eeb4d661dfebac7e841847c4ae0b9643e0b77324e9ef10be4df4159520f3be.exe
"C:\Users\Admin\AppData\Local\Temp\42eeb4d661dfebac7e841847c4ae0b9643e0b77324e9ef10be4df4159520f3be.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:344
- C:\Users\Admin\AppData\Local\Temp\42eeb4d661dfebac7e841847c4ae0b9643e0b77324e9ef10be4df4159520f3be.exe
  C:\Users\Admin\AppData\Local\Temp\42eeb4d661dfebac7e841847c4ae0b9643e0b77324e9ef10be4df4159520f3be.exe /C
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1760
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\42eeb4d661dfebac7e841847c4ae0b9643e0b77324e9ef10be4df4159520f3be.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1504
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:316

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1760-1-0x0000000002580000-0x0000000002591000-memory.dmp

Download