qakbot | 22ce25a80feee78dd5edca17e4d5a5e29cadb9f023922393ef051ec22d6f2ca3

General

Target
22ce25a80feee78dd5edca17e4d5a5e29cadb9f023922393ef051ec22d6f2ca3.exe
Size 270KB
Sample201110-kvfavfvzas
SHA256 22ce25a80feee78dd5edca17e4d5a5e29cadb9f023922393ef051ec22d6f2ca3
MD5 3d4c524e722c78e0c1ddffee87b42773
SHA1 a130b3326bf13ea643d5b96e0ba3bdf6621b6ffa
SHA512 b4c291f8f110cd8431a9c5b5d985d00bd6871b1b244673890875b57439441be68511daa83dcc5c6bf6a4093d9ed1cf600d348355b2d9ea79cb411e12b647250a
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	22ce25a80feee78dd5edca17e4d5a5e29cadb9f023922393ef051ec22d6f2ca3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	22ce25a80feee78dd5edca17e4d5a5e29cadb9f023922393ef051ec22d6f2ca3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	22ce25a80feee78dd5edca17e4d5a5e29cadb9f023922393ef051ec22d6f2ca3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	22ce25a80feee78dd5edca17e4d5a5e29cadb9f023922393ef051ec22d6f2ca3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	22ce25a80feee78dd5edca17e4d5a5e29cadb9f023922393ef051ec22d6f2ca3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	22ce25a80feee78dd5edca17e4d5a5e29cadb9f023922393ef051ec22d6f2ca3.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
4076	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
972	22ce25a80feee78dd5edca17e4d5a5e29cadb9f023922393ef051ec22d6f2ca3.exe
972	22ce25a80feee78dd5edca17e4d5a5e29cadb9f023922393ef051ec22d6f2ca3.exe
2296	22ce25a80feee78dd5edca17e4d5a5e29cadb9f023922393ef051ec22d6f2ca3.exe
2296	22ce25a80feee78dd5edca17e4d5a5e29cadb9f023922393ef051ec22d6f2ca3.exe
2296	22ce25a80feee78dd5edca17e4d5a5e29cadb9f023922393ef051ec22d6f2ca3.exe
2296	22ce25a80feee78dd5edca17e4d5a5e29cadb9f023922393ef051ec22d6f2ca3.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 972 wrote to memory of 2296	972	22ce25a80feee78dd5edca17e4d5a5e29cadb9f023922393ef051ec22d6f2ca3.exe	79
PID 972 wrote to memory of 2296	972	22ce25a80feee78dd5edca17e4d5a5e29cadb9f023922393ef051ec22d6f2ca3.exe	79
PID 972 wrote to memory of 2296	972	22ce25a80feee78dd5edca17e4d5a5e29cadb9f023922393ef051ec22d6f2ca3.exe	79
PID 972 wrote to memory of 3536	972	22ce25a80feee78dd5edca17e4d5a5e29cadb9f023922393ef051ec22d6f2ca3.exe	80
PID 972 wrote to memory of 3536	972	22ce25a80feee78dd5edca17e4d5a5e29cadb9f023922393ef051ec22d6f2ca3.exe	80
PID 972 wrote to memory of 3536	972	22ce25a80feee78dd5edca17e4d5a5e29cadb9f023922393ef051ec22d6f2ca3.exe	80
PID 3536 wrote to memory of 4076	3536	cmd.exe	82
PID 3536 wrote to memory of 4076	3536	cmd.exe	82
PID 3536 wrote to memory of 4076	3536	cmd.exe	82