qakbot | 1e65359b8e8fd19bf4dddcb4ae64875e28fb3ddb3c7794e3c502778156c8f463

Analysis

Target
1e65359b8e8fd19bf4dddcb4ae64875e28fb3ddb3c7794e3c502778156c8f463.exe
Size 270KB
Sample201115-4jw4tx569e
SHA256 1e65359b8e8fd19bf4dddcb4ae64875e28fb3ddb3c7794e3c502778156c8f463
MD5 acbbf583aef777e62961d00d5ad7f26f
SHA1 27ee7895a12e5754753eb6ea75ba8f0bb94483ad
SHA512 765e2b11bba29090579d6c58808000992a1f4e8d46ffcb9be4d015a371e819676f1a6e0ecc0ffb3635ea48aa0efadcb967edfcb51e5c37c37956962d314aa32b
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
1076	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1068	1e65359b8e8fd19bf4dddcb4ae64875e28fb3ddb3c7794e3c502778156c8f463.exe
648	1e65359b8e8fd19bf4dddcb4ae64875e28fb3ddb3c7794e3c502778156c8f463.exe
648	1e65359b8e8fd19bf4dddcb4ae64875e28fb3ddb3c7794e3c502778156c8f463.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1068 wrote to memory of 648	1068	1e65359b8e8fd19bf4dddcb4ae64875e28fb3ddb3c7794e3c502778156c8f463.exe	29
PID 1068 wrote to memory of 648	1068	1e65359b8e8fd19bf4dddcb4ae64875e28fb3ddb3c7794e3c502778156c8f463.exe	29
PID 1068 wrote to memory of 648	1068	1e65359b8e8fd19bf4dddcb4ae64875e28fb3ddb3c7794e3c502778156c8f463.exe	29
PID 1068 wrote to memory of 648	1068	1e65359b8e8fd19bf4dddcb4ae64875e28fb3ddb3c7794e3c502778156c8f463.exe	29
PID 1068 wrote to memory of 1936	1068	1e65359b8e8fd19bf4dddcb4ae64875e28fb3ddb3c7794e3c502778156c8f463.exe	30
PID 1068 wrote to memory of 1936	1068	1e65359b8e8fd19bf4dddcb4ae64875e28fb3ddb3c7794e3c502778156c8f463.exe	30
PID 1068 wrote to memory of 1936	1068	1e65359b8e8fd19bf4dddcb4ae64875e28fb3ddb3c7794e3c502778156c8f463.exe	30
PID 1068 wrote to memory of 1936	1068	1e65359b8e8fd19bf4dddcb4ae64875e28fb3ddb3c7794e3c502778156c8f463.exe	30
PID 1936 wrote to memory of 1076	1936	cmd.exe	32
PID 1936 wrote to memory of 1076	1936	cmd.exe	32
PID 1936 wrote to memory of 1076	1936	cmd.exe	32
PID 1936 wrote to memory of 1076	1936	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\1e65359b8e8fd19bf4dddcb4ae64875e28fb3ddb3c7794e3c502778156c8f463.exe
"C:\Users\Admin\AppData\Local\Temp\1e65359b8e8fd19bf4dddcb4ae64875e28fb3ddb3c7794e3c502778156c8f463.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1068
- C:\Users\Admin\AppData\Local\Temp\1e65359b8e8fd19bf4dddcb4ae64875e28fb3ddb3c7794e3c502778156c8f463.exe
  C:\Users\Admin\AppData\Local\Temp\1e65359b8e8fd19bf4dddcb4ae64875e28fb3ddb3c7794e3c502778156c8f463.exe /C
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:648
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\1e65359b8e8fd19bf4dddcb4ae64875e28fb3ddb3c7794e3c502778156c8f463.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1936
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1076

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/648-1-0x0000000002530000-0x0000000002541000-memory.dmp

Download