qakbot | 5fa56852b41b7178f70569cd15c6f41fe3c4f353ac0cb992ba7a0ff527c4dfc8

Analysis

Target
5fa56852b41b7178f70569cd15c6f41fe3c4f353ac0cb992ba7a0ff527c4dfc8.exe
Size 270KB
Sample201115-4m5pkyeef2
SHA256 5fa56852b41b7178f70569cd15c6f41fe3c4f353ac0cb992ba7a0ff527c4dfc8
MD5 e01c8ab89558b9c87029fec345cac450
SHA1 6b7c3d903dd4ed0af92dd8885dd67cac8e59a90b
SHA512 15fd3408b43351faae55369d8a0491abc8476151ef8db0367e81cfc8fa17c2a793603db65702dce4eefe2f79b7017c2f17d0c4550225c3b69f40811b5245ebbd
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
1088	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1900	5fa56852b41b7178f70569cd15c6f41fe3c4f353ac0cb992ba7a0ff527c4dfc8.exe
1584	5fa56852b41b7178f70569cd15c6f41fe3c4f353ac0cb992ba7a0ff527c4dfc8.exe
1584	5fa56852b41b7178f70569cd15c6f41fe3c4f353ac0cb992ba7a0ff527c4dfc8.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 1584	1900	5fa56852b41b7178f70569cd15c6f41fe3c4f353ac0cb992ba7a0ff527c4dfc8.exe	29
PID 1900 wrote to memory of 1584	1900	5fa56852b41b7178f70569cd15c6f41fe3c4f353ac0cb992ba7a0ff527c4dfc8.exe	29
PID 1900 wrote to memory of 1584	1900	5fa56852b41b7178f70569cd15c6f41fe3c4f353ac0cb992ba7a0ff527c4dfc8.exe	29
PID 1900 wrote to memory of 1584	1900	5fa56852b41b7178f70569cd15c6f41fe3c4f353ac0cb992ba7a0ff527c4dfc8.exe	29
PID 1900 wrote to memory of 800	1900	5fa56852b41b7178f70569cd15c6f41fe3c4f353ac0cb992ba7a0ff527c4dfc8.exe	30
PID 1900 wrote to memory of 800	1900	5fa56852b41b7178f70569cd15c6f41fe3c4f353ac0cb992ba7a0ff527c4dfc8.exe	30
PID 1900 wrote to memory of 800	1900	5fa56852b41b7178f70569cd15c6f41fe3c4f353ac0cb992ba7a0ff527c4dfc8.exe	30
PID 1900 wrote to memory of 800	1900	5fa56852b41b7178f70569cd15c6f41fe3c4f353ac0cb992ba7a0ff527c4dfc8.exe	30
PID 800 wrote to memory of 1088	800	cmd.exe	32
PID 800 wrote to memory of 1088	800	cmd.exe	32
PID 800 wrote to memory of 1088	800	cmd.exe	32
PID 800 wrote to memory of 1088	800	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\5fa56852b41b7178f70569cd15c6f41fe3c4f353ac0cb992ba7a0ff527c4dfc8.exe
"C:\Users\Admin\AppData\Local\Temp\5fa56852b41b7178f70569cd15c6f41fe3c4f353ac0cb992ba7a0ff527c4dfc8.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Users\Admin\AppData\Local\Temp\5fa56852b41b7178f70569cd15c6f41fe3c4f353ac0cb992ba7a0ff527c4dfc8.exe
  C:\Users\Admin\AppData\Local\Temp\5fa56852b41b7178f70569cd15c6f41fe3c4f353ac0cb992ba7a0ff527c4dfc8.exe /C
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1584
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\5fa56852b41b7178f70569cd15c6f41fe3c4f353ac0cb992ba7a0ff527c4dfc8.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:800
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1088

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1584-1-0x0000000002590000-0x00000000025A1000-memory.dmp

Download