qakbot | c53e1bf27a23d7e2bf0d7f7e820d03409cf7020fd2b06fc53d12884766695dad

Analysis

Target
4a4b0804dc4c33840906537e75a59a83.exe
Size 339KB
Sample201117-539sdjftfa
SHA256 c53e1bf27a23d7e2bf0d7f7e820d03409cf7020fd2b06fc53d12884766695dad
MD5 207c05131fe75c72de0c0b6577c32256
SHA1 70e5a9b73d95785d1303334b9bcdd0eb617dc96d
SHA512 a37ae9e5256f39c4ce27a4385bb1bed42762fbac26af7bf1060e474097f0aa3f238cd4e5ba35ecb7bcb0f831c3a8139fb907b61146af498612bce552782ed0f3
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
1648	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1584 wrote to memory of 1284	1584	4a4b0804dc4c33840906537e75a59a83.exe	29
PID 1584 wrote to memory of 1284	1584	4a4b0804dc4c33840906537e75a59a83.exe	29
PID 1584 wrote to memory of 1284	1584	4a4b0804dc4c33840906537e75a59a83.exe	29
PID 1584 wrote to memory of 1284	1584	4a4b0804dc4c33840906537e75a59a83.exe	29
PID 1584 wrote to memory of 1392	1584	4a4b0804dc4c33840906537e75a59a83.exe	30
PID 1584 wrote to memory of 1392	1584	4a4b0804dc4c33840906537e75a59a83.exe	30
PID 1584 wrote to memory of 1392	1584	4a4b0804dc4c33840906537e75a59a83.exe	30
PID 1584 wrote to memory of 1392	1584	4a4b0804dc4c33840906537e75a59a83.exe	30
PID 1392 wrote to memory of 1648	1392	cmd.exe	32
PID 1392 wrote to memory of 1648	1392	cmd.exe	32
PID 1392 wrote to memory of 1648	1392	cmd.exe	32
PID 1392 wrote to memory of 1648	1392	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\4a4b0804dc4c33840906537e75a59a83.exe
"C:\Users\Admin\AppData\Local\Temp\4a4b0804dc4c33840906537e75a59a83.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Users\Admin\AppData\Local\Temp\4a4b0804dc4c33840906537e75a59a83.exe
  C:\Users\Admin\AppData\Local\Temp\4a4b0804dc4c33840906537e75a59a83.exe /C
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1284
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\4a4b0804dc4c33840906537e75a59a83.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1392
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1648

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1284-1-0x00000000024B0000-0x00000000024C1000-memory.dmp

Download