qakbot | 08e90e5390faf02068fb4ac6a2dcb9a886d7750e06b15a5c396fd7c8d6c3779a

Analysis

Target
08e90e5390faf02068fb4ac6a2dcb9a886d7750e06b15a5c396fd7c8d6c3779a.exe
Size 270KB
Sample201115-k7dfrtqnde
SHA256 08e90e5390faf02068fb4ac6a2dcb9a886d7750e06b15a5c396fd7c8d6c3779a
MD5 523bc6dc42a5d555169243f4ebff48ff
SHA1 05cec7dfb8ff33d27ad9ba2c42b3f149f34873e6
SHA512 1252e930005d4a6c8f107a6a5c4ef5c99db1412d9940fc7dfed184bec0dafd7fd66ad2652bd95549db4bba9f5408d2347a9a0515e4cb6a2c4c97ce3b5f3c7fa8
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
1908	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2036	08e90e5390faf02068fb4ac6a2dcb9a886d7750e06b15a5c396fd7c8d6c3779a.exe
744	08e90e5390faf02068fb4ac6a2dcb9a886d7750e06b15a5c396fd7c8d6c3779a.exe
744	08e90e5390faf02068fb4ac6a2dcb9a886d7750e06b15a5c396fd7c8d6c3779a.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 744	2036	08e90e5390faf02068fb4ac6a2dcb9a886d7750e06b15a5c396fd7c8d6c3779a.exe	29
PID 2036 wrote to memory of 744	2036	08e90e5390faf02068fb4ac6a2dcb9a886d7750e06b15a5c396fd7c8d6c3779a.exe	29
PID 2036 wrote to memory of 744	2036	08e90e5390faf02068fb4ac6a2dcb9a886d7750e06b15a5c396fd7c8d6c3779a.exe	29
PID 2036 wrote to memory of 744	2036	08e90e5390faf02068fb4ac6a2dcb9a886d7750e06b15a5c396fd7c8d6c3779a.exe	29
PID 2036 wrote to memory of 1652	2036	08e90e5390faf02068fb4ac6a2dcb9a886d7750e06b15a5c396fd7c8d6c3779a.exe	30
PID 2036 wrote to memory of 1652	2036	08e90e5390faf02068fb4ac6a2dcb9a886d7750e06b15a5c396fd7c8d6c3779a.exe	30
PID 2036 wrote to memory of 1652	2036	08e90e5390faf02068fb4ac6a2dcb9a886d7750e06b15a5c396fd7c8d6c3779a.exe	30
PID 2036 wrote to memory of 1652	2036	08e90e5390faf02068fb4ac6a2dcb9a886d7750e06b15a5c396fd7c8d6c3779a.exe	30
PID 1652 wrote to memory of 1908	1652	cmd.exe	32
PID 1652 wrote to memory of 1908	1652	cmd.exe	32
PID 1652 wrote to memory of 1908	1652	cmd.exe	32
PID 1652 wrote to memory of 1908	1652	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\08e90e5390faf02068fb4ac6a2dcb9a886d7750e06b15a5c396fd7c8d6c3779a.exe
"C:\Users\Admin\AppData\Local\Temp\08e90e5390faf02068fb4ac6a2dcb9a886d7750e06b15a5c396fd7c8d6c3779a.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Users\Admin\AppData\Local\Temp\08e90e5390faf02068fb4ac6a2dcb9a886d7750e06b15a5c396fd7c8d6c3779a.exe
  C:\Users\Admin\AppData\Local\Temp\08e90e5390faf02068fb4ac6a2dcb9a886d7750e06b15a5c396fd7c8d6c3779a.exe /C
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:744
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\08e90e5390faf02068fb4ac6a2dcb9a886d7750e06b15a5c396fd7c8d6c3779a.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1652
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1908

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/744-1-0x00000000025C0000-0x00000000025D1000-memory.dmp

Download