qakbot | cd0ca3838c6cafc46b0c8c2fc281cdc096e6a0a305cd3ccb10d38986202c177f

Analysis

max time kernel
9s
max time network
102s
platform
windows10_x64
resource
win10v20201028
submitted
17/11/2020, 12:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
230daf017706f841cefb768eeeb9bebd.exe
Size 348KB
Sample201117-r6e2klrz12
SHA256 cd0ca3838c6cafc46b0c8c2fc281cdc096e6a0a305cd3ccb10d38986202c177f
MD5 24b5bdb64d394a983b24cdbd78e99650
SHA1 7ca03429038470f04b33b03214c37dd16c405f4a
SHA512 b4d4a4e0391478d55cb15ce25f87b5428eb09f0cefd2a12ba922d325b319b1ed0461aed826ea11e5d9e48bc0cace3e77e54d71576a4e5c1a49943447242d7d99
MD5 SHA1 SHA512

Score

10^/10

qakbot banker stealer trojan

Malware Config

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3376	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4800	230daf017706f841cefb768eeeb9bebd.exe
4800	230daf017706f841cefb768eeeb9bebd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 3316	4800	230daf017706f841cefb768eeeb9bebd.exe	75
PID 4800 wrote to memory of 3316	4800	230daf017706f841cefb768eeeb9bebd.exe	75
PID 4800 wrote to memory of 3316	4800	230daf017706f841cefb768eeeb9bebd.exe	75
PID 3316 wrote to memory of 3376	3316	cmd.exe	77
PID 3316 wrote to memory of 3376	3316	cmd.exe	77
PID 3316 wrote to memory of 3376	3316	cmd.exe	77

C:\Users\Admin\AppData\Local\Temp\230daf017706f841cefb768eeeb9bebd.exe
"C:\Users\Admin\AppData\Local\Temp\230daf017706f841cefb768eeeb9bebd.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\230daf017706f841cefb768eeeb9bebd.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3316
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:3376

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads