qakbot | 1620749c2e2d50aa0412c42c1f2e93f4899a7aa5b846f67dfcf267eaa89aca6a

Analysis

max time kernel
100s
max time network
101s
platform
windows10_x64
resource
win10v20201028
submitted
17/11/2020, 11:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9c61e411c76a5aafa9bced55b0538897.exe
Size 348KB
Sample201117-pznle123cn
SHA256 1620749c2e2d50aa0412c42c1f2e93f4899a7aa5b846f67dfcf267eaa89aca6a
MD5 a8b870746e95c2d3dbc5dc377dfab2a8
SHA1 f0ba0f7053045a7d6ae21fb54110cdea52343c70
SHA512 c716e0456b31fd860c08fba02c95eb162efe4257cca36e7e0d271db24c0c17ed70fd713dea5e53fcaa7a569b84c02511ea8b7a69e61a7131499bdcbae6ba26af
MD5 SHA1 SHA512

Score

10^/10

qakbot banker stealer trojan

Malware Config

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2944	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1272	9c61e411c76a5aafa9bced55b0538897.exe
1272	9c61e411c76a5aafa9bced55b0538897.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1272 wrote to memory of 2596	1272	9c61e411c76a5aafa9bced55b0538897.exe	75
PID 1272 wrote to memory of 2596	1272	9c61e411c76a5aafa9bced55b0538897.exe	75
PID 1272 wrote to memory of 2596	1272	9c61e411c76a5aafa9bced55b0538897.exe	75
PID 2596 wrote to memory of 2944	2596	cmd.exe	77
PID 2596 wrote to memory of 2944	2596	cmd.exe	77
PID 2596 wrote to memory of 2944	2596	cmd.exe	77

C:\Users\Admin\AppData\Local\Temp\9c61e411c76a5aafa9bced55b0538897.exe
"C:\Users\Admin\AppData\Local\Temp\9c61e411c76a5aafa9bced55b0538897.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1272
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\9c61e411c76a5aafa9bced55b0538897.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2596
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:2944

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads