qakbot | f5a1d3191732115861292ae376ed647f3665f384d45f2a3ab5ca32d9cfbbc310

Analysis

Target
f5a1d3191732115861292ae376ed647f3665f384d45f2a3ab5ca32d9cfbbc310.exe
Size 270KB
Sample201115-5dk1a5lqvs
SHA256 f5a1d3191732115861292ae376ed647f3665f384d45f2a3ab5ca32d9cfbbc310
MD5 24ae73909dc0d3b7fbaa5097427b8362
SHA1 bc36d0e2fe613a60e605d386e637cd3687cd6d32
SHA512 0cb52855b76a10819393a3ddd73d31f150301b9c468d198c0571fac1f4b243af97c220b087ee7d30262e1261d288d6871c5598b6391c3b484c8673b4a74c9091
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
1628	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1704	f5a1d3191732115861292ae376ed647f3665f384d45f2a3ab5ca32d9cfbbc310.exe
1240	f5a1d3191732115861292ae376ed647f3665f384d45f2a3ab5ca32d9cfbbc310.exe
1240	f5a1d3191732115861292ae376ed647f3665f384d45f2a3ab5ca32d9cfbbc310.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 1240	1704	f5a1d3191732115861292ae376ed647f3665f384d45f2a3ab5ca32d9cfbbc310.exe	29
PID 1704 wrote to memory of 1240	1704	f5a1d3191732115861292ae376ed647f3665f384d45f2a3ab5ca32d9cfbbc310.exe	29
PID 1704 wrote to memory of 1240	1704	f5a1d3191732115861292ae376ed647f3665f384d45f2a3ab5ca32d9cfbbc310.exe	29
PID 1704 wrote to memory of 1240	1704	f5a1d3191732115861292ae376ed647f3665f384d45f2a3ab5ca32d9cfbbc310.exe	29
PID 1704 wrote to memory of 1396	1704	f5a1d3191732115861292ae376ed647f3665f384d45f2a3ab5ca32d9cfbbc310.exe	30
PID 1704 wrote to memory of 1396	1704	f5a1d3191732115861292ae376ed647f3665f384d45f2a3ab5ca32d9cfbbc310.exe	30
PID 1704 wrote to memory of 1396	1704	f5a1d3191732115861292ae376ed647f3665f384d45f2a3ab5ca32d9cfbbc310.exe	30
PID 1704 wrote to memory of 1396	1704	f5a1d3191732115861292ae376ed647f3665f384d45f2a3ab5ca32d9cfbbc310.exe	30
PID 1396 wrote to memory of 1628	1396	cmd.exe	32
PID 1396 wrote to memory of 1628	1396	cmd.exe	32
PID 1396 wrote to memory of 1628	1396	cmd.exe	32
PID 1396 wrote to memory of 1628	1396	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\f5a1d3191732115861292ae376ed647f3665f384d45f2a3ab5ca32d9cfbbc310.exe
"C:\Users\Admin\AppData\Local\Temp\f5a1d3191732115861292ae376ed647f3665f384d45f2a3ab5ca32d9cfbbc310.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Users\Admin\AppData\Local\Temp\f5a1d3191732115861292ae376ed647f3665f384d45f2a3ab5ca32d9cfbbc310.exe
  C:\Users\Admin\AppData\Local\Temp\f5a1d3191732115861292ae376ed647f3665f384d45f2a3ab5ca32d9cfbbc310.exe /C
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1240
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\f5a1d3191732115861292ae376ed647f3665f384d45f2a3ab5ca32d9cfbbc310.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1396
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1628

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1240-1-0x0000000002550000-0x0000000002561000-memory.dmp

Download