qakbot | 9c32eca3e3d5ff8fce45671ffdaebc1b116dc1a01bc931b8c5b7dc2a9b8f4a1d

Analysis

max time kernel
10s
max time network
99s
platform
windows10_x64
resource
win10v20201028
submitted
17/11/2020, 12:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
18b959d25e4a3900fa3c33ecbc5320cf.exe
Size 348KB
Sample201117-rb43b4x7ks
SHA256 9c32eca3e3d5ff8fce45671ffdaebc1b116dc1a01bc931b8c5b7dc2a9b8f4a1d
MD5 8cfaabf377bfc12d3297d4f22326e1d4
SHA1 f594ce8270fa6f425314aa001c7fcd6962fc3826
SHA512 b699441bd678fb13adaed0976e612c8b3b27292891b4e587521e6097406af8a2d3fc732dd7d666d1cb2bfd39a514175ff73816d447944c87dc3b4e45a04632f1
MD5 SHA1 SHA512

Score

10^/10

qakbot banker stealer trojan

Malware Config

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2924	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1144	18b959d25e4a3900fa3c33ecbc5320cf.exe
1144	18b959d25e4a3900fa3c33ecbc5320cf.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1144 wrote to memory of 236	1144	18b959d25e4a3900fa3c33ecbc5320cf.exe	77
PID 1144 wrote to memory of 236	1144	18b959d25e4a3900fa3c33ecbc5320cf.exe	77
PID 1144 wrote to memory of 236	1144	18b959d25e4a3900fa3c33ecbc5320cf.exe	77
PID 236 wrote to memory of 2924	236	cmd.exe	79
PID 236 wrote to memory of 2924	236	cmd.exe	79
PID 236 wrote to memory of 2924	236	cmd.exe	79

C:\Users\Admin\AppData\Local\Temp\18b959d25e4a3900fa3c33ecbc5320cf.exe
"C:\Users\Admin\AppData\Local\Temp\18b959d25e4a3900fa3c33ecbc5320cf.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1144
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\18b959d25e4a3900fa3c33ecbc5320cf.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:236
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:2924

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads