qakbot | e7c6ac96cda9b3e6b30ed6e828885a9a9d128afa25e2d2eff0b24cd141bd89dc

Analysis

Target
7bdbe4f261c19281798a076aed974d43.exe
Size 265KB
Sample201117-d8zae2mrya
SHA256 e7c6ac96cda9b3e6b30ed6e828885a9a9d128afa25e2d2eff0b24cd141bd89dc
MD5 af5f9df6426d9ed7351a2e6785e66ffe
SHA1 045ce9e7f3de92f7e7a90b18f1b1b1700f937d98
SHA512 86c65edecd9f3529531cddebc4f562e34cffd0a90cce84e484c7e6f490c943fa8f38961fe80d2e64895f30f98f8028c237d3e76061834a366b91bd68a94e1956
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
1420	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 1328	1700	7bdbe4f261c19281798a076aed974d43.exe	29
PID 1700 wrote to memory of 1328	1700	7bdbe4f261c19281798a076aed974d43.exe	29
PID 1700 wrote to memory of 1328	1700	7bdbe4f261c19281798a076aed974d43.exe	29
PID 1700 wrote to memory of 1328	1700	7bdbe4f261c19281798a076aed974d43.exe	29
PID 1700 wrote to memory of 1296	1700	7bdbe4f261c19281798a076aed974d43.exe	30
PID 1700 wrote to memory of 1296	1700	7bdbe4f261c19281798a076aed974d43.exe	30
PID 1700 wrote to memory of 1296	1700	7bdbe4f261c19281798a076aed974d43.exe	30
PID 1700 wrote to memory of 1296	1700	7bdbe4f261c19281798a076aed974d43.exe	30
PID 1296 wrote to memory of 1420	1296	cmd.exe	32
PID 1296 wrote to memory of 1420	1296	cmd.exe	32
PID 1296 wrote to memory of 1420	1296	cmd.exe	32
PID 1296 wrote to memory of 1420	1296	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\7bdbe4f261c19281798a076aed974d43.exe
"C:\Users\Admin\AppData\Local\Temp\7bdbe4f261c19281798a076aed974d43.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Users\Admin\AppData\Local\Temp\7bdbe4f261c19281798a076aed974d43.exe
  C:\Users\Admin\AppData\Local\Temp\7bdbe4f261c19281798a076aed974d43.exe /C
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1328
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\7bdbe4f261c19281798a076aed974d43.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1296
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1420

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1328-1-0x0000000002420000-0x0000000002431000-memory.dmp

Download