qakbot | c2a2b15511540cbd80959ab66fa78e5903f4db9c1a0eaebda593cb03f1e9a991

General

Target
c2a2b15511540cbd80959ab66fa78e5903f4db9c1a0eaebda593cb03f1e9a991.exe
Size 270KB
Sample201110-t7exw65mwx
SHA256 c2a2b15511540cbd80959ab66fa78e5903f4db9c1a0eaebda593cb03f1e9a991
MD5 2e46e021f46a7f8c1aaa2e2b9ac172ce
SHA1 58484caed719adf31cc7d12c6b82ffb20fdfb958
SHA512 8050f9dcee1052289be82163cb83070fb2f27ad957031169d2aee23e1eca69ec863ea0ef62308a9a9d5d7b3df471e26905d2c07c8f78364ec0ec64fe6216a4af
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	c2a2b15511540cbd80959ab66fa78e5903f4db9c1a0eaebda593cb03f1e9a991.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	c2a2b15511540cbd80959ab66fa78e5903f4db9c1a0eaebda593cb03f1e9a991.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	c2a2b15511540cbd80959ab66fa78e5903f4db9c1a0eaebda593cb03f1e9a991.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	c2a2b15511540cbd80959ab66fa78e5903f4db9c1a0eaebda593cb03f1e9a991.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	c2a2b15511540cbd80959ab66fa78e5903f4db9c1a0eaebda593cb03f1e9a991.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	c2a2b15511540cbd80959ab66fa78e5903f4db9c1a0eaebda593cb03f1e9a991.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
2548	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
648	c2a2b15511540cbd80959ab66fa78e5903f4db9c1a0eaebda593cb03f1e9a991.exe
648	c2a2b15511540cbd80959ab66fa78e5903f4db9c1a0eaebda593cb03f1e9a991.exe
212	c2a2b15511540cbd80959ab66fa78e5903f4db9c1a0eaebda593cb03f1e9a991.exe
212	c2a2b15511540cbd80959ab66fa78e5903f4db9c1a0eaebda593cb03f1e9a991.exe
212	c2a2b15511540cbd80959ab66fa78e5903f4db9c1a0eaebda593cb03f1e9a991.exe
212	c2a2b15511540cbd80959ab66fa78e5903f4db9c1a0eaebda593cb03f1e9a991.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 648 wrote to memory of 212	648	c2a2b15511540cbd80959ab66fa78e5903f4db9c1a0eaebda593cb03f1e9a991.exe	78
PID 648 wrote to memory of 212	648	c2a2b15511540cbd80959ab66fa78e5903f4db9c1a0eaebda593cb03f1e9a991.exe	78
PID 648 wrote to memory of 212	648	c2a2b15511540cbd80959ab66fa78e5903f4db9c1a0eaebda593cb03f1e9a991.exe	78
PID 648 wrote to memory of 1424	648	c2a2b15511540cbd80959ab66fa78e5903f4db9c1a0eaebda593cb03f1e9a991.exe	79
PID 648 wrote to memory of 1424	648	c2a2b15511540cbd80959ab66fa78e5903f4db9c1a0eaebda593cb03f1e9a991.exe	79
PID 648 wrote to memory of 1424	648	c2a2b15511540cbd80959ab66fa78e5903f4db9c1a0eaebda593cb03f1e9a991.exe	79
PID 1424 wrote to memory of 2548	1424	cmd.exe	81
PID 1424 wrote to memory of 2548	1424	cmd.exe	81
PID 1424 wrote to memory of 2548	1424	cmd.exe	81