qakbot | 85565b8e7ad214183822f8d0190d189a09726db5ade31f225083d9fa4778ac02

Analysis

Target
2da0f7aafe9cf841a00dda8babc144e4.exe
Size 270KB
Sample201117-cppnkkyhtj
SHA256 85565b8e7ad214183822f8d0190d189a09726db5ade31f225083d9fa4778ac02
MD5 a63165d0a0418584d173459f9d27f146
SHA1 54be74b2e6f763a4aa63a758497b0b0d8dd6c3e9
SHA512 8f9933a38413a7a587c4e6213a96c60ec114f362ecce2af195bf57df6a9b585fe2acebe93313c230dd1d750ff47b17adbb67fb7abf261fbc65de952ef58fbfc5
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
1648	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1776 wrote to memory of 1608	1776	2da0f7aafe9cf841a00dda8babc144e4.exe	29
PID 1776 wrote to memory of 1608	1776	2da0f7aafe9cf841a00dda8babc144e4.exe	29
PID 1776 wrote to memory of 1608	1776	2da0f7aafe9cf841a00dda8babc144e4.exe	29
PID 1776 wrote to memory of 1608	1776	2da0f7aafe9cf841a00dda8babc144e4.exe	29
PID 1776 wrote to memory of 1428	1776	2da0f7aafe9cf841a00dda8babc144e4.exe	30
PID 1776 wrote to memory of 1428	1776	2da0f7aafe9cf841a00dda8babc144e4.exe	30
PID 1776 wrote to memory of 1428	1776	2da0f7aafe9cf841a00dda8babc144e4.exe	30
PID 1776 wrote to memory of 1428	1776	2da0f7aafe9cf841a00dda8babc144e4.exe	30
PID 1428 wrote to memory of 1648	1428	cmd.exe	32
PID 1428 wrote to memory of 1648	1428	cmd.exe	32
PID 1428 wrote to memory of 1648	1428	cmd.exe	32
PID 1428 wrote to memory of 1648	1428	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\2da0f7aafe9cf841a00dda8babc144e4.exe
"C:\Users\Admin\AppData\Local\Temp\2da0f7aafe9cf841a00dda8babc144e4.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1776
- C:\Users\Admin\AppData\Local\Temp\2da0f7aafe9cf841a00dda8babc144e4.exe
  C:\Users\Admin\AppData\Local\Temp\2da0f7aafe9cf841a00dda8babc144e4.exe /C
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1608
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\2da0f7aafe9cf841a00dda8babc144e4.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1428
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1648

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1608-1-0x0000000002450000-0x0000000002461000-memory.dmp

Download