qakbot | fc093d0b28244d1efec61f428f6189918fce82a970e7594c2099c04d18daaa6d

Analysis

max time kernel
147s
max time network
147s
platform
windows10_x64
resource
win10v20201028
submitted
17/11/2020, 12:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9fa78f90b24772dc392f49ffa4656920.exe
Size 348KB
Sample201117-wncmsjrv9e
SHA256 fc093d0b28244d1efec61f428f6189918fce82a970e7594c2099c04d18daaa6d
MD5 4a37074a31ab0da738bf0351d0a98398
SHA1 20ab0b737a07573a64e896f15dc11b8a37d2d200
SHA512 0343a327a4524442c62635d5050d4c1a5eb8f299721bb765b829c1b10b371610e19b665b3e3b6874feefa43ba8497f67960f8d7ce48273eee39a9ac69483929e
MD5 SHA1 SHA512

Score

10^/10

qakbot banker stealer trojan

Malware Config

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4084	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
580	9fa78f90b24772dc392f49ffa4656920.exe
580	9fa78f90b24772dc392f49ffa4656920.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 580 wrote to memory of 3920	580	9fa78f90b24772dc392f49ffa4656920.exe	75
PID 580 wrote to memory of 3920	580	9fa78f90b24772dc392f49ffa4656920.exe	75
PID 580 wrote to memory of 3920	580	9fa78f90b24772dc392f49ffa4656920.exe	75
PID 3920 wrote to memory of 4084	3920	cmd.exe	77
PID 3920 wrote to memory of 4084	3920	cmd.exe	77
PID 3920 wrote to memory of 4084	3920	cmd.exe	77

C:\Users\Admin\AppData\Local\Temp\9fa78f90b24772dc392f49ffa4656920.exe
"C:\Users\Admin\AppData\Local\Temp\9fa78f90b24772dc392f49ffa4656920.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:580
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\9fa78f90b24772dc392f49ffa4656920.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3920
- - C:\Windows\SysWOW64\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:4084

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads