qakbot | de37470f8eb759d09854d51863391e23c0ed5d46b29f2b437096fa63d3d50854

Analysis

Target
15623b7edde50f906f2a2386cf9c09a9.exe
Size 270KB
Sample201117-sdn5js6et6
SHA256 de37470f8eb759d09854d51863391e23c0ed5d46b29f2b437096fa63d3d50854
MD5 8eed2d251f4096ab09e5219753616b44
SHA1 9a8731f85cf5f536ff7700d39b61b1d9ad942977
SHA512 e2d456e1a86412a3ebabe1fe323e073508c550f2141094ce7a973b8eb18ee05fc829c4f210243c06cb9dcad2c0859b929fa2e351585a6bf014b5448d6201dec2
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
1580	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1080 wrote to memory of 1688	1080	15623b7edde50f906f2a2386cf9c09a9.exe	29
PID 1080 wrote to memory of 1688	1080	15623b7edde50f906f2a2386cf9c09a9.exe	29
PID 1080 wrote to memory of 1688	1080	15623b7edde50f906f2a2386cf9c09a9.exe	29
PID 1080 wrote to memory of 1688	1080	15623b7edde50f906f2a2386cf9c09a9.exe	29
PID 1080 wrote to memory of 1224	1080	15623b7edde50f906f2a2386cf9c09a9.exe	30
PID 1080 wrote to memory of 1224	1080	15623b7edde50f906f2a2386cf9c09a9.exe	30
PID 1080 wrote to memory of 1224	1080	15623b7edde50f906f2a2386cf9c09a9.exe	30
PID 1080 wrote to memory of 1224	1080	15623b7edde50f906f2a2386cf9c09a9.exe	30
PID 1224 wrote to memory of 1580	1224	cmd.exe	32
PID 1224 wrote to memory of 1580	1224	cmd.exe	32
PID 1224 wrote to memory of 1580	1224	cmd.exe	32
PID 1224 wrote to memory of 1580	1224	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\15623b7edde50f906f2a2386cf9c09a9.exe
"C:\Users\Admin\AppData\Local\Temp\15623b7edde50f906f2a2386cf9c09a9.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Users\Admin\AppData\Local\Temp\15623b7edde50f906f2a2386cf9c09a9.exe
  C:\Users\Admin\AppData\Local\Temp\15623b7edde50f906f2a2386cf9c09a9.exe /C
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1688
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\15623b7edde50f906f2a2386cf9c09a9.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1224
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1580

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1688-1-0x0000000002560000-0x0000000002571000-memory.dmp

Download