qakbot | 9b228c6bf41cfeff91cfa445353c6a2ef95b1f27d274cc8b4e7abd9763771756

Analysis

Target

feddabe3be2ba16cc35b79cd28f3ad40.exe
Size

1.0MB
MD5

feddabe3be2ba16cc35b79cd28f3ad40
SHA1

c5f41c9abd14cebcd2f37c7ca55ce808d149f27e
SHA256

9b228c6bf41cfeff91cfa445353c6a2ef95b1f27d274cc8b4e7abd9763771756
SHA512

af14774f89d162517955108ebc68482851e648f2e13a5952068daa5e047504e5a023fc3c8a587c88170271b6cd01d84903cac4b92ea3d3ee8b4e169577dc14c9

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

384 PING.EXE
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

feddabe3be2ba16cc35b79cd28f3ad40.exefeddabe3be2ba16cc35b79cd28f3ad40.exe

pid process

1656 feddabe3be2ba16cc35b79cd28f3ad40.exe
1832 feddabe3be2ba16cc35b79cd28f3ad40.exe
1832 feddabe3be2ba16cc35b79cd28f3ad40.exe

pid	process
384	PING.EXE

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

feddabe3be2ba16cc35b79cd28f3ad40.execmd.exe

description	pid	process	target process
PID 1656 wrote to memory of 1832	1656	feddabe3be2ba16cc35b79cd28f3ad40.exe	feddabe3be2ba16cc35b79cd28f3ad40.exe
PID 1656 wrote to memory of 1832	1656	feddabe3be2ba16cc35b79cd28f3ad40.exe	feddabe3be2ba16cc35b79cd28f3ad40.exe
PID 1656 wrote to memory of 1832	1656	feddabe3be2ba16cc35b79cd28f3ad40.exe	feddabe3be2ba16cc35b79cd28f3ad40.exe
PID 1656 wrote to memory of 1832	1656	feddabe3be2ba16cc35b79cd28f3ad40.exe	feddabe3be2ba16cc35b79cd28f3ad40.exe
PID 1656 wrote to memory of 1640	1656	feddabe3be2ba16cc35b79cd28f3ad40.exe	cmd.exe
PID 1656 wrote to memory of 1640	1656	feddabe3be2ba16cc35b79cd28f3ad40.exe	cmd.exe
PID 1656 wrote to memory of 1640	1656	feddabe3be2ba16cc35b79cd28f3ad40.exe	cmd.exe
PID 1656 wrote to memory of 1640	1656	feddabe3be2ba16cc35b79cd28f3ad40.exe	cmd.exe
PID 1640 wrote to memory of 384	1640	cmd.exe	PING.EXE
PID 1640 wrote to memory of 384	1640	cmd.exe	PING.EXE
PID 1640 wrote to memory of 384	1640	cmd.exe	PING.EXE
PID 1640 wrote to memory of 384	1640	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\feddabe3be2ba16cc35b79cd28f3ad40.exe
C:\Users\Admin\AppData\Local\Temp\feddabe3be2ba16cc35b79cd28f3ad40.exe /C
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1832

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\feddabe3be2ba16cc35b79cd28f3ad40.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1640

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

memory/384-5-0x0000000000000000-mapping.dmp

Download
memory/1640-4-0x0000000000000000-mapping.dmp

Download
memory/1832-2-0x0000000000000000-mapping.dmp

Download
memory/1832-3-0x00000000025C0000-0x00000000025D1000-memory.dmp

Filesize
68KB

Download