qakbot | b2fb733a15fc2f349791445afb1da59701f952f4a866e627d1c2f4ca40fef87b

Analysis

Target
b2fb733a15fc2f349791445afb1da59701f952f4a866e627d1c2f4ca40fef87b.exe
Size 270KB
Sample201115-dnbmkdxfre
SHA256 b2fb733a15fc2f349791445afb1da59701f952f4a866e627d1c2f4ca40fef87b
MD5 28b21880327f5f085ffc8fb52358a16c
SHA1 b56e71dbb72a686332a0dc2cf39155a721e48048
SHA512 58b9f7ec77b9538b8b3ecc7cf81685a8f58cd93f50740c5d790e16c71c800d0112710d5654228a87989c3114a7c8303a55b7ae0ae35c0b581dac4e1a2fa1f3a3
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
1548	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1876	b2fb733a15fc2f349791445afb1da59701f952f4a866e627d1c2f4ca40fef87b.exe
1756	b2fb733a15fc2f349791445afb1da59701f952f4a866e627d1c2f4ca40fef87b.exe
1756	b2fb733a15fc2f349791445afb1da59701f952f4a866e627d1c2f4ca40fef87b.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 1756	1876	b2fb733a15fc2f349791445afb1da59701f952f4a866e627d1c2f4ca40fef87b.exe	29
PID 1876 wrote to memory of 1756	1876	b2fb733a15fc2f349791445afb1da59701f952f4a866e627d1c2f4ca40fef87b.exe	29
PID 1876 wrote to memory of 1756	1876	b2fb733a15fc2f349791445afb1da59701f952f4a866e627d1c2f4ca40fef87b.exe	29
PID 1876 wrote to memory of 1756	1876	b2fb733a15fc2f349791445afb1da59701f952f4a866e627d1c2f4ca40fef87b.exe	29
PID 1876 wrote to memory of 1720	1876	b2fb733a15fc2f349791445afb1da59701f952f4a866e627d1c2f4ca40fef87b.exe	30
PID 1876 wrote to memory of 1720	1876	b2fb733a15fc2f349791445afb1da59701f952f4a866e627d1c2f4ca40fef87b.exe	30
PID 1876 wrote to memory of 1720	1876	b2fb733a15fc2f349791445afb1da59701f952f4a866e627d1c2f4ca40fef87b.exe	30
PID 1876 wrote to memory of 1720	1876	b2fb733a15fc2f349791445afb1da59701f952f4a866e627d1c2f4ca40fef87b.exe	30
PID 1720 wrote to memory of 1548	1720	cmd.exe	32
PID 1720 wrote to memory of 1548	1720	cmd.exe	32
PID 1720 wrote to memory of 1548	1720	cmd.exe	32
PID 1720 wrote to memory of 1548	1720	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\b2fb733a15fc2f349791445afb1da59701f952f4a866e627d1c2f4ca40fef87b.exe
"C:\Users\Admin\AppData\Local\Temp\b2fb733a15fc2f349791445afb1da59701f952f4a866e627d1c2f4ca40fef87b.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Users\Admin\AppData\Local\Temp\b2fb733a15fc2f349791445afb1da59701f952f4a866e627d1c2f4ca40fef87b.exe
  C:\Users\Admin\AppData\Local\Temp\b2fb733a15fc2f349791445afb1da59701f952f4a866e627d1c2f4ca40fef87b.exe /C
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1756
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\b2fb733a15fc2f349791445afb1da59701f952f4a866e627d1c2f4ca40fef87b.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1720
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1548

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1756-1-0x00000000024E0000-0x00000000024F1000-memory.dmp

Download