qakbot | 7d81c98cddb925c3fd861efbf337b8df254c733d40b6c6572ec2154da28249fe

Analysis

Target
69b6878c674d4060bb57bd91bcd30271.exe
Size 838KB
Sample201117-2qc8cyclns
SHA256 7d81c98cddb925c3fd861efbf337b8df254c733d40b6c6572ec2154da28249fe
MD5 e52d409b67558a86cd2056735982f156
SHA1 6b9f696048922c1d30beb6159efc79d0947afceb
SHA512 2fcdfe01cca51c8e11cb3eb355c2a5f95dc4f20fdc7bad3d48c80280af025d1612619b1a989fc37588e0ed052ea56530ec468bf02c115a53edf9bd7368ff9253
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
368	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1804 wrote to memory of 1220	1804	69b6878c674d4060bb57bd91bcd30271.exe	29
PID 1804 wrote to memory of 1220	1804	69b6878c674d4060bb57bd91bcd30271.exe	29
PID 1804 wrote to memory of 1220	1804	69b6878c674d4060bb57bd91bcd30271.exe	29
PID 1804 wrote to memory of 1220	1804	69b6878c674d4060bb57bd91bcd30271.exe	29
PID 1804 wrote to memory of 1568	1804	69b6878c674d4060bb57bd91bcd30271.exe	30
PID 1804 wrote to memory of 1568	1804	69b6878c674d4060bb57bd91bcd30271.exe	30
PID 1804 wrote to memory of 1568	1804	69b6878c674d4060bb57bd91bcd30271.exe	30
PID 1804 wrote to memory of 1568	1804	69b6878c674d4060bb57bd91bcd30271.exe	30
PID 1568 wrote to memory of 368	1568	cmd.exe	32
PID 1568 wrote to memory of 368	1568	cmd.exe	32
PID 1568 wrote to memory of 368	1568	cmd.exe	32
PID 1568 wrote to memory of 368	1568	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\69b6878c674d4060bb57bd91bcd30271.exe
"C:\Users\Admin\AppData\Local\Temp\69b6878c674d4060bb57bd91bcd30271.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1804
- C:\Users\Admin\AppData\Local\Temp\69b6878c674d4060bb57bd91bcd30271.exe
  C:\Users\Admin\AppData\Local\Temp\69b6878c674d4060bb57bd91bcd30271.exe /C
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1220
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\69b6878c674d4060bb57bd91bcd30271.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1568
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:368

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1220-1-0x00000000027C0000-0x00000000027D1000-memory.dmp

Download