qakbot | a5ea620ccaed96ec29fa41d6218256d9651bd5005c0c4af33cbdd1769a98058d

General

Target
a5ea620ccaed96ec29fa41d6218256d9651bd5005c0c4af33cbdd1769a98058d.exe
Size 270KB
Sample201110-q72hbs7ajs
SHA256 a5ea620ccaed96ec29fa41d6218256d9651bd5005c0c4af33cbdd1769a98058d
MD5 5b7ab46047f17ff618fb7f3e578fe832
SHA1 c417fe1ae33eb2978bdb092828d5709b46d268c3
SHA512 3d59e904954ae0bfa1ad0d33ef48b276c72a5bc6ab0bd570adae7c8a59070de00f0861feef46fc67f6efa523b7a45953f9054ee67d402261b47cba5a944f57dc
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	a5ea620ccaed96ec29fa41d6218256d9651bd5005c0c4af33cbdd1769a98058d.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	a5ea620ccaed96ec29fa41d6218256d9651bd5005c0c4af33cbdd1769a98058d.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	a5ea620ccaed96ec29fa41d6218256d9651bd5005c0c4af33cbdd1769a98058d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	a5ea620ccaed96ec29fa41d6218256d9651bd5005c0c4af33cbdd1769a98058d.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	a5ea620ccaed96ec29fa41d6218256d9651bd5005c0c4af33cbdd1769a98058d.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	a5ea620ccaed96ec29fa41d6218256d9651bd5005c0c4af33cbdd1769a98058d.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
3524	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
728	a5ea620ccaed96ec29fa41d6218256d9651bd5005c0c4af33cbdd1769a98058d.exe
728	a5ea620ccaed96ec29fa41d6218256d9651bd5005c0c4af33cbdd1769a98058d.exe
1952	a5ea620ccaed96ec29fa41d6218256d9651bd5005c0c4af33cbdd1769a98058d.exe
1952	a5ea620ccaed96ec29fa41d6218256d9651bd5005c0c4af33cbdd1769a98058d.exe
1952	a5ea620ccaed96ec29fa41d6218256d9651bd5005c0c4af33cbdd1769a98058d.exe
1952	a5ea620ccaed96ec29fa41d6218256d9651bd5005c0c4af33cbdd1769a98058d.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 728 wrote to memory of 1952	728	a5ea620ccaed96ec29fa41d6218256d9651bd5005c0c4af33cbdd1769a98058d.exe	78
PID 728 wrote to memory of 1952	728	a5ea620ccaed96ec29fa41d6218256d9651bd5005c0c4af33cbdd1769a98058d.exe	78
PID 728 wrote to memory of 1952	728	a5ea620ccaed96ec29fa41d6218256d9651bd5005c0c4af33cbdd1769a98058d.exe	78
PID 728 wrote to memory of 3916	728	a5ea620ccaed96ec29fa41d6218256d9651bd5005c0c4af33cbdd1769a98058d.exe	79
PID 728 wrote to memory of 3916	728	a5ea620ccaed96ec29fa41d6218256d9651bd5005c0c4af33cbdd1769a98058d.exe	79
PID 728 wrote to memory of 3916	728	a5ea620ccaed96ec29fa41d6218256d9651bd5005c0c4af33cbdd1769a98058d.exe	79
PID 3916 wrote to memory of 3524	3916	cmd.exe	81
PID 3916 wrote to memory of 3524	3916	cmd.exe	81
PID 3916 wrote to memory of 3524	3916	cmd.exe	81