qakbot | 602e3bb5ec0030f2cb578370bc0a8e5c50b1dbbe0cc5e2039aa804a76264e554

Analysis

Target
602e3bb5ec0030f2cb578370bc0a8e5c50b1dbbe0cc5e2039aa804a76264e554.exe
Size 270KB
Sample201115-s35s2mapze
SHA256 602e3bb5ec0030f2cb578370bc0a8e5c50b1dbbe0cc5e2039aa804a76264e554
MD5 5337a99921e42f8f0f9fc847fc33b4a9
SHA1 a2818395b870b2b6e475f9cd01cfa1df03a0f7b5
SHA512 db2c9b21a69d29598f457192d54ed81275148420a0a143b771108aa4dc8994fa6b2be826af6d0f445745e2955fd7ea2d203b0b87db361b64e30ea92e5643c7c7
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
1440	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
752	602e3bb5ec0030f2cb578370bc0a8e5c50b1dbbe0cc5e2039aa804a76264e554.exe
1352	602e3bb5ec0030f2cb578370bc0a8e5c50b1dbbe0cc5e2039aa804a76264e554.exe
1352	602e3bb5ec0030f2cb578370bc0a8e5c50b1dbbe0cc5e2039aa804a76264e554.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 752 wrote to memory of 1352	752	602e3bb5ec0030f2cb578370bc0a8e5c50b1dbbe0cc5e2039aa804a76264e554.exe	29
PID 752 wrote to memory of 1352	752	602e3bb5ec0030f2cb578370bc0a8e5c50b1dbbe0cc5e2039aa804a76264e554.exe	29
PID 752 wrote to memory of 1352	752	602e3bb5ec0030f2cb578370bc0a8e5c50b1dbbe0cc5e2039aa804a76264e554.exe	29
PID 752 wrote to memory of 1352	752	602e3bb5ec0030f2cb578370bc0a8e5c50b1dbbe0cc5e2039aa804a76264e554.exe	29
PID 752 wrote to memory of 1612	752	602e3bb5ec0030f2cb578370bc0a8e5c50b1dbbe0cc5e2039aa804a76264e554.exe	30
PID 752 wrote to memory of 1612	752	602e3bb5ec0030f2cb578370bc0a8e5c50b1dbbe0cc5e2039aa804a76264e554.exe	30
PID 752 wrote to memory of 1612	752	602e3bb5ec0030f2cb578370bc0a8e5c50b1dbbe0cc5e2039aa804a76264e554.exe	30
PID 752 wrote to memory of 1612	752	602e3bb5ec0030f2cb578370bc0a8e5c50b1dbbe0cc5e2039aa804a76264e554.exe	30
PID 1612 wrote to memory of 1440	1612	cmd.exe	32
PID 1612 wrote to memory of 1440	1612	cmd.exe	32
PID 1612 wrote to memory of 1440	1612	cmd.exe	32
PID 1612 wrote to memory of 1440	1612	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\602e3bb5ec0030f2cb578370bc0a8e5c50b1dbbe0cc5e2039aa804a76264e554.exe
"C:\Users\Admin\AppData\Local\Temp\602e3bb5ec0030f2cb578370bc0a8e5c50b1dbbe0cc5e2039aa804a76264e554.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:752
- C:\Users\Admin\AppData\Local\Temp\602e3bb5ec0030f2cb578370bc0a8e5c50b1dbbe0cc5e2039aa804a76264e554.exe
  C:\Users\Admin\AppData\Local\Temp\602e3bb5ec0030f2cb578370bc0a8e5c50b1dbbe0cc5e2039aa804a76264e554.exe /C
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1352
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\602e3bb5ec0030f2cb578370bc0a8e5c50b1dbbe0cc5e2039aa804a76264e554.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1612
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1440

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1352-1-0x00000000024F0000-0x0000000002501000-memory.dmp

Download