qakbot | aefbe045b1c327617fb3f9b2ef72ae26702ed271d7d4a56617e6c688f173d4ed

Analysis

max time kernel
10s
max time network
102s
platform
windows10_x64
resource
win10v20201028
submitted
17/11/2020, 11:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3e6dcd7a88e028637254c5f57c5ff6a5.exe
Size 348KB
Sample201117-c8htws7llx
SHA256 aefbe045b1c327617fb3f9b2ef72ae26702ed271d7d4a56617e6c688f173d4ed
MD5 48cc4084d72a4c8512aad3df253f3406
SHA1 3107c4cd08557b20c8e3cd1bcd0e023cd036c197
SHA512 2dd382f17ee4ad34da3b1b817269d647ca358b8a072f3e60ad5f8558caf6eaecde509035faab33b3ac4d5dd620dbc552f2dd934797f0c0109372042d2d87bce1
MD5 SHA1 SHA512

Score

10^/10

qakbot banker stealer trojan

Malware Config

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3336	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4800	3e6dcd7a88e028637254c5f57c5ff6a5.exe
4800	3e6dcd7a88e028637254c5f57c5ff6a5.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 3308	4800	3e6dcd7a88e028637254c5f57c5ff6a5.exe	75
PID 4800 wrote to memory of 3308	4800	3e6dcd7a88e028637254c5f57c5ff6a5.exe	75
PID 4800 wrote to memory of 3308	4800	3e6dcd7a88e028637254c5f57c5ff6a5.exe	75
PID 3308 wrote to memory of 3336	3308	cmd.exe	77
PID 3308 wrote to memory of 3336	3308	cmd.exe	77
PID 3308 wrote to memory of 3336	3308	cmd.exe	77

C:\Users\Admin\AppData\Local\Temp\3e6dcd7a88e028637254c5f57c5ff6a5.exe
"C:\Users\Admin\AppData\Local\Temp\3e6dcd7a88e028637254c5f57c5ff6a5.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\3e6dcd7a88e028637254c5f57c5ff6a5.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3308
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:3336

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads