qakbot | b433d37dee81f3bca6220435a9738b837c67f96eccf0c76fb45c251441bbf1b1

Analysis

Target
75b7dede067af1236963d592d3caf7fc.exe
Size 339KB
Sample201117-753cv2agrn
SHA256 b433d37dee81f3bca6220435a9738b837c67f96eccf0c76fb45c251441bbf1b1
MD5 a042ef68c149bc54b391d09d1f5d2378
SHA1 d24feb592b735f2f3cc62ab1dd8389bd7036ded7
SHA512 22e91641231319ef9658d1ef9b18b930d4e1476880cf1d5dd33f3ec92f5dd66649828f81ba523559a4154b093a04c522868144a7bad012c5218e070104541048
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
1188	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 2028	1668	75b7dede067af1236963d592d3caf7fc.exe	29
PID 1668 wrote to memory of 2028	1668	75b7dede067af1236963d592d3caf7fc.exe	29
PID 1668 wrote to memory of 2028	1668	75b7dede067af1236963d592d3caf7fc.exe	29
PID 1668 wrote to memory of 2028	1668	75b7dede067af1236963d592d3caf7fc.exe	29
PID 1668 wrote to memory of 1340	1668	75b7dede067af1236963d592d3caf7fc.exe	30
PID 1668 wrote to memory of 1340	1668	75b7dede067af1236963d592d3caf7fc.exe	30
PID 1668 wrote to memory of 1340	1668	75b7dede067af1236963d592d3caf7fc.exe	30
PID 1668 wrote to memory of 1340	1668	75b7dede067af1236963d592d3caf7fc.exe	30
PID 1340 wrote to memory of 1188	1340	cmd.exe	32
PID 1340 wrote to memory of 1188	1340	cmd.exe	32
PID 1340 wrote to memory of 1188	1340	cmd.exe	32
PID 1340 wrote to memory of 1188	1340	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\75b7dede067af1236963d592d3caf7fc.exe
"C:\Users\Admin\AppData\Local\Temp\75b7dede067af1236963d592d3caf7fc.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Users\Admin\AppData\Local\Temp\75b7dede067af1236963d592d3caf7fc.exe
  C:\Users\Admin\AppData\Local\Temp\75b7dede067af1236963d592d3caf7fc.exe /C
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2028
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\75b7dede067af1236963d592d3caf7fc.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1340
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1188

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2028-1-0x0000000002540000-0x0000000002551000-memory.dmp

Download