qakbot | dcfd14acb99df5f25600dad11d2cfdd65d5d19be90cb54642232a514eaa13687

Analysis

Target
2aa81ec88e0751318031ec83eb1cf27f.exe
Size 270KB
Sample201117-csttm7661n
SHA256 dcfd14acb99df5f25600dad11d2cfdd65d5d19be90cb54642232a514eaa13687
MD5 5dab2a4ce1f0114eae7d61ea8dfd72c4
SHA1 b8817d4221272df242a58f26f0fe5d22adddd31a
SHA512 c55059be685d542138912b0efd1dd208af6ebf59cdc2370f238fcdf810dca970e26f908a19f22f3fcd0f78b41901a042d66204f1571cdafe29b9b5907339d2e5
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
456	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 328	1960	2aa81ec88e0751318031ec83eb1cf27f.exe	29
PID 1960 wrote to memory of 328	1960	2aa81ec88e0751318031ec83eb1cf27f.exe	29
PID 1960 wrote to memory of 328	1960	2aa81ec88e0751318031ec83eb1cf27f.exe	29
PID 1960 wrote to memory of 328	1960	2aa81ec88e0751318031ec83eb1cf27f.exe	29
PID 1960 wrote to memory of 932	1960	2aa81ec88e0751318031ec83eb1cf27f.exe	30
PID 1960 wrote to memory of 932	1960	2aa81ec88e0751318031ec83eb1cf27f.exe	30
PID 1960 wrote to memory of 932	1960	2aa81ec88e0751318031ec83eb1cf27f.exe	30
PID 1960 wrote to memory of 932	1960	2aa81ec88e0751318031ec83eb1cf27f.exe	30
PID 932 wrote to memory of 456	932	cmd.exe	32
PID 932 wrote to memory of 456	932	cmd.exe	32
PID 932 wrote to memory of 456	932	cmd.exe	32
PID 932 wrote to memory of 456	932	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\2aa81ec88e0751318031ec83eb1cf27f.exe
"C:\Users\Admin\AppData\Local\Temp\2aa81ec88e0751318031ec83eb1cf27f.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Users\Admin\AppData\Local\Temp\2aa81ec88e0751318031ec83eb1cf27f.exe
  C:\Users\Admin\AppData\Local\Temp\2aa81ec88e0751318031ec83eb1cf27f.exe /C
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:328
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\2aa81ec88e0751318031ec83eb1cf27f.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:932
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:456

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/328-1-0x0000000002590000-0x00000000025A1000-memory.dmp

Download