qakbot | 2c85cb01a0ea4f7233faaf4460630685f9dcfaeb132adcbab1cd2e565e73ad59

Analysis

Target
2c85cb01a0ea4f7233faaf4460630685f9dcfaeb132adcbab1cd2e565e73ad59.exe
Size 270KB
Sample201115-d89zydwvts
SHA256 2c85cb01a0ea4f7233faaf4460630685f9dcfaeb132adcbab1cd2e565e73ad59
MD5 91c509b3c7bae1c44682f64e840ec577
SHA1 c8a501f966768238ce19bb22d05b8a885cf1c242
SHA512 670ae8ac5626f858df28d513cc95f60cdfccb21db9674681824391098e89e512f40fd5327e072864965de1dcd06b3d81c1c5e8f4a9a4de201201d653135001d7
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
684	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1900	2c85cb01a0ea4f7233faaf4460630685f9dcfaeb132adcbab1cd2e565e73ad59.exe
1768	2c85cb01a0ea4f7233faaf4460630685f9dcfaeb132adcbab1cd2e565e73ad59.exe
1768	2c85cb01a0ea4f7233faaf4460630685f9dcfaeb132adcbab1cd2e565e73ad59.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 1768	1900	2c85cb01a0ea4f7233faaf4460630685f9dcfaeb132adcbab1cd2e565e73ad59.exe	29
PID 1900 wrote to memory of 1768	1900	2c85cb01a0ea4f7233faaf4460630685f9dcfaeb132adcbab1cd2e565e73ad59.exe	29
PID 1900 wrote to memory of 1768	1900	2c85cb01a0ea4f7233faaf4460630685f9dcfaeb132adcbab1cd2e565e73ad59.exe	29
PID 1900 wrote to memory of 1768	1900	2c85cb01a0ea4f7233faaf4460630685f9dcfaeb132adcbab1cd2e565e73ad59.exe	29
PID 1900 wrote to memory of 756	1900	2c85cb01a0ea4f7233faaf4460630685f9dcfaeb132adcbab1cd2e565e73ad59.exe	30
PID 1900 wrote to memory of 756	1900	2c85cb01a0ea4f7233faaf4460630685f9dcfaeb132adcbab1cd2e565e73ad59.exe	30
PID 1900 wrote to memory of 756	1900	2c85cb01a0ea4f7233faaf4460630685f9dcfaeb132adcbab1cd2e565e73ad59.exe	30
PID 1900 wrote to memory of 756	1900	2c85cb01a0ea4f7233faaf4460630685f9dcfaeb132adcbab1cd2e565e73ad59.exe	30
PID 756 wrote to memory of 684	756	cmd.exe	32
PID 756 wrote to memory of 684	756	cmd.exe	32
PID 756 wrote to memory of 684	756	cmd.exe	32
PID 756 wrote to memory of 684	756	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\2c85cb01a0ea4f7233faaf4460630685f9dcfaeb132adcbab1cd2e565e73ad59.exe
"C:\Users\Admin\AppData\Local\Temp\2c85cb01a0ea4f7233faaf4460630685f9dcfaeb132adcbab1cd2e565e73ad59.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Users\Admin\AppData\Local\Temp\2c85cb01a0ea4f7233faaf4460630685f9dcfaeb132adcbab1cd2e565e73ad59.exe
  C:\Users\Admin\AppData\Local\Temp\2c85cb01a0ea4f7233faaf4460630685f9dcfaeb132adcbab1cd2e565e73ad59.exe /C
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1768
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\2c85cb01a0ea4f7233faaf4460630685f9dcfaeb132adcbab1cd2e565e73ad59.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:756
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:684

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1768-1-0x00000000024B0000-0x00000000024C1000-memory.dmp

Download