qakbot | 6e7d7aaffc0ea688d7e6e7442f874e839b9cb12b9edacb8f8b0b88caef98fa25

Analysis

Target
6e7d7aaffc0ea688d7e6e7442f874e839b9cb12b9edacb8f8b0b88caef98fa25.exe
Size 270KB
Sample201115-dlb5k4tra6
SHA256 6e7d7aaffc0ea688d7e6e7442f874e839b9cb12b9edacb8f8b0b88caef98fa25
MD5 493763017882ebe20deb5eeadd231d9e
SHA1 3b6f5f89e5197038c529e56d7e47eb5ea99488d1
SHA512 6c2cd0a2ebafe20289ee36bc3f3aa2062cf9bc2db39a202f6444ef20e0dba8528610632264fb9a9aa12180e0b346e38462bada7fc0f61a2f5f23b6b2239d83da
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
1344	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
684	6e7d7aaffc0ea688d7e6e7442f874e839b9cb12b9edacb8f8b0b88caef98fa25.exe
1096	6e7d7aaffc0ea688d7e6e7442f874e839b9cb12b9edacb8f8b0b88caef98fa25.exe
1096	6e7d7aaffc0ea688d7e6e7442f874e839b9cb12b9edacb8f8b0b88caef98fa25.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 684 wrote to memory of 1096	684	6e7d7aaffc0ea688d7e6e7442f874e839b9cb12b9edacb8f8b0b88caef98fa25.exe	29
PID 684 wrote to memory of 1096	684	6e7d7aaffc0ea688d7e6e7442f874e839b9cb12b9edacb8f8b0b88caef98fa25.exe	29
PID 684 wrote to memory of 1096	684	6e7d7aaffc0ea688d7e6e7442f874e839b9cb12b9edacb8f8b0b88caef98fa25.exe	29
PID 684 wrote to memory of 1096	684	6e7d7aaffc0ea688d7e6e7442f874e839b9cb12b9edacb8f8b0b88caef98fa25.exe	29
PID 684 wrote to memory of 884	684	6e7d7aaffc0ea688d7e6e7442f874e839b9cb12b9edacb8f8b0b88caef98fa25.exe	30
PID 684 wrote to memory of 884	684	6e7d7aaffc0ea688d7e6e7442f874e839b9cb12b9edacb8f8b0b88caef98fa25.exe	30
PID 684 wrote to memory of 884	684	6e7d7aaffc0ea688d7e6e7442f874e839b9cb12b9edacb8f8b0b88caef98fa25.exe	30
PID 684 wrote to memory of 884	684	6e7d7aaffc0ea688d7e6e7442f874e839b9cb12b9edacb8f8b0b88caef98fa25.exe	30
PID 884 wrote to memory of 1344	884	cmd.exe	32
PID 884 wrote to memory of 1344	884	cmd.exe	32
PID 884 wrote to memory of 1344	884	cmd.exe	32
PID 884 wrote to memory of 1344	884	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\6e7d7aaffc0ea688d7e6e7442f874e839b9cb12b9edacb8f8b0b88caef98fa25.exe
"C:\Users\Admin\AppData\Local\Temp\6e7d7aaffc0ea688d7e6e7442f874e839b9cb12b9edacb8f8b0b88caef98fa25.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:684
- C:\Users\Admin\AppData\Local\Temp\6e7d7aaffc0ea688d7e6e7442f874e839b9cb12b9edacb8f8b0b88caef98fa25.exe
  C:\Users\Admin\AppData\Local\Temp\6e7d7aaffc0ea688d7e6e7442f874e839b9cb12b9edacb8f8b0b88caef98fa25.exe /C
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1096
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\6e7d7aaffc0ea688d7e6e7442f874e839b9cb12b9edacb8f8b0b88caef98fa25.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:884
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1344

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1096-1-0x0000000002530000-0x0000000002541000-memory.dmp

Download