qakbot | 70f4afc3fd63a2ee62cdb0a20e83981899895f1b8104dc94c35d8aad9e7a0b88

Analysis

Target
70f4afc3fd63a2ee62cdb0a20e83981899895f1b8104dc94c35d8aad9e7a0b88.exe
Size 270KB
Sample201115-4c8wg2alg6
SHA256 70f4afc3fd63a2ee62cdb0a20e83981899895f1b8104dc94c35d8aad9e7a0b88
MD5 3289d660a3c81164a17c1609f0ae060f
SHA1 76270d6da613c4f6fd1c1ab825ff780bef4b563f
SHA512 15fa5f9a90a3178b5611460b3668f057f448439cadb28812a2b95e7cb8836c104ef021f81fdfa5b28495014f84bcf41e42c2eac43da84eba4f1c6b4a54d15eb1
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
284	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1924	70f4afc3fd63a2ee62cdb0a20e83981899895f1b8104dc94c35d8aad9e7a0b88.exe
1764	70f4afc3fd63a2ee62cdb0a20e83981899895f1b8104dc94c35d8aad9e7a0b88.exe
1764	70f4afc3fd63a2ee62cdb0a20e83981899895f1b8104dc94c35d8aad9e7a0b88.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 1764	1924	70f4afc3fd63a2ee62cdb0a20e83981899895f1b8104dc94c35d8aad9e7a0b88.exe	29
PID 1924 wrote to memory of 1764	1924	70f4afc3fd63a2ee62cdb0a20e83981899895f1b8104dc94c35d8aad9e7a0b88.exe	29
PID 1924 wrote to memory of 1764	1924	70f4afc3fd63a2ee62cdb0a20e83981899895f1b8104dc94c35d8aad9e7a0b88.exe	29
PID 1924 wrote to memory of 1764	1924	70f4afc3fd63a2ee62cdb0a20e83981899895f1b8104dc94c35d8aad9e7a0b88.exe	29
PID 1924 wrote to memory of 1676	1924	70f4afc3fd63a2ee62cdb0a20e83981899895f1b8104dc94c35d8aad9e7a0b88.exe	30
PID 1924 wrote to memory of 1676	1924	70f4afc3fd63a2ee62cdb0a20e83981899895f1b8104dc94c35d8aad9e7a0b88.exe	30
PID 1924 wrote to memory of 1676	1924	70f4afc3fd63a2ee62cdb0a20e83981899895f1b8104dc94c35d8aad9e7a0b88.exe	30
PID 1924 wrote to memory of 1676	1924	70f4afc3fd63a2ee62cdb0a20e83981899895f1b8104dc94c35d8aad9e7a0b88.exe	30
PID 1676 wrote to memory of 284	1676	cmd.exe	32
PID 1676 wrote to memory of 284	1676	cmd.exe	32
PID 1676 wrote to memory of 284	1676	cmd.exe	32
PID 1676 wrote to memory of 284	1676	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\70f4afc3fd63a2ee62cdb0a20e83981899895f1b8104dc94c35d8aad9e7a0b88.exe
"C:\Users\Admin\AppData\Local\Temp\70f4afc3fd63a2ee62cdb0a20e83981899895f1b8104dc94c35d8aad9e7a0b88.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Users\Admin\AppData\Local\Temp\70f4afc3fd63a2ee62cdb0a20e83981899895f1b8104dc94c35d8aad9e7a0b88.exe
  C:\Users\Admin\AppData\Local\Temp\70f4afc3fd63a2ee62cdb0a20e83981899895f1b8104dc94c35d8aad9e7a0b88.exe /C
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1764
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\70f4afc3fd63a2ee62cdb0a20e83981899895f1b8104dc94c35d8aad9e7a0b88.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1676
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:284

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1764-1-0x0000000002520000-0x0000000002531000-memory.dmp

Download