qakbot | be0520fde8c2493e4cac98feb9f6a645dc6453d6a0d376a77e65d4dc5ba9db4e

Analysis

Target
be0520fde8c2493e4cac98feb9f6a645dc6453d6a0d376a77e65d4dc5ba9db4e.exe
Size 270KB
Sample201115-615ded6b7j
SHA256 be0520fde8c2493e4cac98feb9f6a645dc6453d6a0d376a77e65d4dc5ba9db4e
MD5 8943a7fbe93d094c636fb59992d04724
SHA1 dbb2b0ca9cc42b4fefaf6a5e1885f5092cb4f369
SHA512 13eba41f3fb1dd34d9905b86f906981270129eebd924453fdf0e280cb0915f4d61844f80fbaee9ad6a21f1c1dae780ba0e938c6b661defd660083b1969fde361
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
280	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
788	be0520fde8c2493e4cac98feb9f6a645dc6453d6a0d376a77e65d4dc5ba9db4e.exe
1368	be0520fde8c2493e4cac98feb9f6a645dc6453d6a0d376a77e65d4dc5ba9db4e.exe
1368	be0520fde8c2493e4cac98feb9f6a645dc6453d6a0d376a77e65d4dc5ba9db4e.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 788 wrote to memory of 1368	788	be0520fde8c2493e4cac98feb9f6a645dc6453d6a0d376a77e65d4dc5ba9db4e.exe	29
PID 788 wrote to memory of 1368	788	be0520fde8c2493e4cac98feb9f6a645dc6453d6a0d376a77e65d4dc5ba9db4e.exe	29
PID 788 wrote to memory of 1368	788	be0520fde8c2493e4cac98feb9f6a645dc6453d6a0d376a77e65d4dc5ba9db4e.exe	29
PID 788 wrote to memory of 1368	788	be0520fde8c2493e4cac98feb9f6a645dc6453d6a0d376a77e65d4dc5ba9db4e.exe	29
PID 788 wrote to memory of 624	788	be0520fde8c2493e4cac98feb9f6a645dc6453d6a0d376a77e65d4dc5ba9db4e.exe	30
PID 788 wrote to memory of 624	788	be0520fde8c2493e4cac98feb9f6a645dc6453d6a0d376a77e65d4dc5ba9db4e.exe	30
PID 788 wrote to memory of 624	788	be0520fde8c2493e4cac98feb9f6a645dc6453d6a0d376a77e65d4dc5ba9db4e.exe	30
PID 788 wrote to memory of 624	788	be0520fde8c2493e4cac98feb9f6a645dc6453d6a0d376a77e65d4dc5ba9db4e.exe	30
PID 624 wrote to memory of 280	624	cmd.exe	32
PID 624 wrote to memory of 280	624	cmd.exe	32
PID 624 wrote to memory of 280	624	cmd.exe	32
PID 624 wrote to memory of 280	624	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\be0520fde8c2493e4cac98feb9f6a645dc6453d6a0d376a77e65d4dc5ba9db4e.exe
"C:\Users\Admin\AppData\Local\Temp\be0520fde8c2493e4cac98feb9f6a645dc6453d6a0d376a77e65d4dc5ba9db4e.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:788
- C:\Users\Admin\AppData\Local\Temp\be0520fde8c2493e4cac98feb9f6a645dc6453d6a0d376a77e65d4dc5ba9db4e.exe
  C:\Users\Admin\AppData\Local\Temp\be0520fde8c2493e4cac98feb9f6a645dc6453d6a0d376a77e65d4dc5ba9db4e.exe /C
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1368
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\be0520fde8c2493e4cac98feb9f6a645dc6453d6a0d376a77e65d4dc5ba9db4e.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:624
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:280

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1368-1-0x0000000002500000-0x0000000002511000-memory.dmp

Download