qakbot | ea2bab40e6ab19deb86a4d23c23ccf141873cfa0cb6d12c8697fbd7e238379b4

General

Target
ea2bab40e6ab19deb86a4d23c23ccf141873cfa0cb6d12c8697fbd7e238379b4.exe
Size 270KB
Sample201110-6l35dxd2xs
SHA256 ea2bab40e6ab19deb86a4d23c23ccf141873cfa0cb6d12c8697fbd7e238379b4
MD5 f8a8b36f89483021cf26cd4162cdc576
SHA1 d4b11d754603b45db1a4b93bd3a85b1b0185dd43
SHA512 4b42cd24ed879c0832b25e33d28733b5e7419868ac43a182216b3a89517b5c6b4fe439d43492afad077a16a5b100af88991c98173234406b1d3ac0779d43dff2
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	ea2bab40e6ab19deb86a4d23c23ccf141873cfa0cb6d12c8697fbd7e238379b4.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	ea2bab40e6ab19deb86a4d23c23ccf141873cfa0cb6d12c8697fbd7e238379b4.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	ea2bab40e6ab19deb86a4d23c23ccf141873cfa0cb6d12c8697fbd7e238379b4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	ea2bab40e6ab19deb86a4d23c23ccf141873cfa0cb6d12c8697fbd7e238379b4.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	ea2bab40e6ab19deb86a4d23c23ccf141873cfa0cb6d12c8697fbd7e238379b4.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	ea2bab40e6ab19deb86a4d23c23ccf141873cfa0cb6d12c8697fbd7e238379b4.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
4056	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3988	ea2bab40e6ab19deb86a4d23c23ccf141873cfa0cb6d12c8697fbd7e238379b4.exe
3988	ea2bab40e6ab19deb86a4d23c23ccf141873cfa0cb6d12c8697fbd7e238379b4.exe
3492	ea2bab40e6ab19deb86a4d23c23ccf141873cfa0cb6d12c8697fbd7e238379b4.exe
3492	ea2bab40e6ab19deb86a4d23c23ccf141873cfa0cb6d12c8697fbd7e238379b4.exe
3492	ea2bab40e6ab19deb86a4d23c23ccf141873cfa0cb6d12c8697fbd7e238379b4.exe
3492	ea2bab40e6ab19deb86a4d23c23ccf141873cfa0cb6d12c8697fbd7e238379b4.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3988 wrote to memory of 3492	3988	ea2bab40e6ab19deb86a4d23c23ccf141873cfa0cb6d12c8697fbd7e238379b4.exe	79
PID 3988 wrote to memory of 3492	3988	ea2bab40e6ab19deb86a4d23c23ccf141873cfa0cb6d12c8697fbd7e238379b4.exe	79
PID 3988 wrote to memory of 3492	3988	ea2bab40e6ab19deb86a4d23c23ccf141873cfa0cb6d12c8697fbd7e238379b4.exe	79
PID 3988 wrote to memory of 2224	3988	ea2bab40e6ab19deb86a4d23c23ccf141873cfa0cb6d12c8697fbd7e238379b4.exe	80
PID 3988 wrote to memory of 2224	3988	ea2bab40e6ab19deb86a4d23c23ccf141873cfa0cb6d12c8697fbd7e238379b4.exe	80
PID 3988 wrote to memory of 2224	3988	ea2bab40e6ab19deb86a4d23c23ccf141873cfa0cb6d12c8697fbd7e238379b4.exe	80
PID 2224 wrote to memory of 4056	2224	cmd.exe	82
PID 2224 wrote to memory of 4056	2224	cmd.exe	82
PID 2224 wrote to memory of 4056	2224	cmd.exe	82