qakbot | 8048dcf4bd4c2a6c61c7d5edff668d2bca7f2bb50ffc3202a270a973baaac2ce

Analysis

Target
8048dcf4bd4c2a6c61c7d5edff668d2bca7f2bb50ffc3202a270a973baaac2ce.exe
Size 838KB
Sample201115-ekejp8ddv6
SHA256 8048dcf4bd4c2a6c61c7d5edff668d2bca7f2bb50ffc3202a270a973baaac2ce
MD5 427305bdc08beb9b814959094375432c
SHA1 815f302611e17a8df5b20215d0b2c9d9b99b71e9
SHA512 d4271b913776a8b882a33643acc5b9fe4409477cf733bc8ff9d4874e9b32dc5f9afbe22696ff78c43ffa838b405bb750864b4ea0727bb87238f5abfd00cfc549
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
784	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1660	8048dcf4bd4c2a6c61c7d5edff668d2bca7f2bb50ffc3202a270a973baaac2ce.exe
1680	8048dcf4bd4c2a6c61c7d5edff668d2bca7f2bb50ffc3202a270a973baaac2ce.exe
1680	8048dcf4bd4c2a6c61c7d5edff668d2bca7f2bb50ffc3202a270a973baaac2ce.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 1680	1660	8048dcf4bd4c2a6c61c7d5edff668d2bca7f2bb50ffc3202a270a973baaac2ce.exe	29
PID 1660 wrote to memory of 1680	1660	8048dcf4bd4c2a6c61c7d5edff668d2bca7f2bb50ffc3202a270a973baaac2ce.exe	29
PID 1660 wrote to memory of 1680	1660	8048dcf4bd4c2a6c61c7d5edff668d2bca7f2bb50ffc3202a270a973baaac2ce.exe	29
PID 1660 wrote to memory of 1680	1660	8048dcf4bd4c2a6c61c7d5edff668d2bca7f2bb50ffc3202a270a973baaac2ce.exe	29
PID 1660 wrote to memory of 812	1660	8048dcf4bd4c2a6c61c7d5edff668d2bca7f2bb50ffc3202a270a973baaac2ce.exe	30
PID 1660 wrote to memory of 812	1660	8048dcf4bd4c2a6c61c7d5edff668d2bca7f2bb50ffc3202a270a973baaac2ce.exe	30
PID 1660 wrote to memory of 812	1660	8048dcf4bd4c2a6c61c7d5edff668d2bca7f2bb50ffc3202a270a973baaac2ce.exe	30
PID 1660 wrote to memory of 812	1660	8048dcf4bd4c2a6c61c7d5edff668d2bca7f2bb50ffc3202a270a973baaac2ce.exe	30
PID 812 wrote to memory of 784	812	cmd.exe	32
PID 812 wrote to memory of 784	812	cmd.exe	32
PID 812 wrote to memory of 784	812	cmd.exe	32
PID 812 wrote to memory of 784	812	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\8048dcf4bd4c2a6c61c7d5edff668d2bca7f2bb50ffc3202a270a973baaac2ce.exe
"C:\Users\Admin\AppData\Local\Temp\8048dcf4bd4c2a6c61c7d5edff668d2bca7f2bb50ffc3202a270a973baaac2ce.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Users\Admin\AppData\Local\Temp\8048dcf4bd4c2a6c61c7d5edff668d2bca7f2bb50ffc3202a270a973baaac2ce.exe
  C:\Users\Admin\AppData\Local\Temp\8048dcf4bd4c2a6c61c7d5edff668d2bca7f2bb50ffc3202a270a973baaac2ce.exe /C
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1680
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\8048dcf4bd4c2a6c61c7d5edff668d2bca7f2bb50ffc3202a270a973baaac2ce.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:812
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:784

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1680-1-0x00000000027D0000-0x00000000027E1000-memory.dmp

Download