qakbot | 154bb70ce4102c04094ec6076d61fcdbb53bdb01e8e401fbeeab42e667cc7778

Analysis

Target
70fea7d5e2aee066022e34afd14fe251.dll
Size 1.4MB
Sample210505-2d2lts76s6
SHA256 154bb70ce4102c04094ec6076d61fcdbb53bdb01e8e401fbeeab42e667cc7778
MD5 70fea7d5e2aee066022e34afd14fe251
SHA1 f129ba34313f97f973d1ed7df6df69e383428d5c
SHA512 84b0994895ed695838a800e6b991cdd0357cb7ba159f47daa8846482902cea07d50653d7ae525e9b291b457f193f59ab05ae55c9bd26367413a44591572306fc
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 784 wrote to memory of 408	784	rundll32.exe	71
PID 784 wrote to memory of 408	784	rundll32.exe	71
PID 784 wrote to memory of 408	784	rundll32.exe	71

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\70fea7d5e2aee066022e34afd14fe251.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:784
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\70fea7d5e2aee066022e34afd14fe251.dll,#1
  2⤵
  PID:408

memory/408-115-0x0000000003FF0000-0x000000000415C000-memory.dmp

Download

memory/408-116-0x0000000000540000-0x000000000068A000-memory.dmp

Download

memory/408-117-0x00000000042A0000-0x00000000042CD000-memory.dmp

Download