qakbot | ecec0ebd08871111525c12e3464e5be8d45bab1f0e40c281b75388d5e8e5798e

Analysis

max time kernel
9s
max time network
71s
platform
windows10_x64
resource
win10v20201028
submitted
17/11/2020, 12:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
91968bf321637c36e32c3c369d8cb8dc.exe
Size 348KB
Sample201117-6672hcq9fa
SHA256 ecec0ebd08871111525c12e3464e5be8d45bab1f0e40c281b75388d5e8e5798e
MD5 de8c03c16fd77a83c52478d601d2aa06
SHA1 599c3c3693683eb067cb30543dca20683a6c33dd
SHA512 a6b915f20ae9ec553aae34b92fa768d58e6380e6def10a9faf21c671806f4a4d8e2753f670573e9a08873aaab710ae45e4c26ee5db7caea5ea55c58f311cc3cb
MD5 SHA1 SHA512

Score

10^/10

qakbot banker stealer trojan

Malware Config

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4168	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4768	91968bf321637c36e32c3c369d8cb8dc.exe
4768	91968bf321637c36e32c3c369d8cb8dc.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4768 wrote to memory of 752	4768	91968bf321637c36e32c3c369d8cb8dc.exe	76
PID 4768 wrote to memory of 752	4768	91968bf321637c36e32c3c369d8cb8dc.exe	76
PID 4768 wrote to memory of 752	4768	91968bf321637c36e32c3c369d8cb8dc.exe	76
PID 752 wrote to memory of 4168	752	cmd.exe	78
PID 752 wrote to memory of 4168	752	cmd.exe	78
PID 752 wrote to memory of 4168	752	cmd.exe	78

C:\Users\Admin\AppData\Local\Temp\91968bf321637c36e32c3c369d8cb8dc.exe
"C:\Users\Admin\AppData\Local\Temp\91968bf321637c36e32c3c369d8cb8dc.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\91968bf321637c36e32c3c369d8cb8dc.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:752
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:4168

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads