qakbot | e00c9748bf093a39159ae6a13ab099c53850ef9af1f063eec8b84cb22da6036e

General

Target
e00c9748bf093a39159ae6a13ab099c53850ef9af1f063eec8b84cb22da6036e.exe
Size 270KB
Sample201110-wjhhldbt96
SHA256 e00c9748bf093a39159ae6a13ab099c53850ef9af1f063eec8b84cb22da6036e
MD5 0d4ff2b8b4fecff1cc0bdbb678bdf2e8
SHA1 ebc4e6118f19e0007de3f31911e27d424dbc9c31
SHA512 2e46de709ce1c093a105aafa1ee260d2096841fe0b1ad8ef765c672e56c6c5f1b81fe744e381e18930c20bada5f73453731cbf0645d8ed5add69d78f0e7cec29
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	e00c9748bf093a39159ae6a13ab099c53850ef9af1f063eec8b84cb22da6036e.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	e00c9748bf093a39159ae6a13ab099c53850ef9af1f063eec8b84cb22da6036e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	e00c9748bf093a39159ae6a13ab099c53850ef9af1f063eec8b84cb22da6036e.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	e00c9748bf093a39159ae6a13ab099c53850ef9af1f063eec8b84cb22da6036e.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	e00c9748bf093a39159ae6a13ab099c53850ef9af1f063eec8b84cb22da6036e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	e00c9748bf093a39159ae6a13ab099c53850ef9af1f063eec8b84cb22da6036e.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
4164	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4628	e00c9748bf093a39159ae6a13ab099c53850ef9af1f063eec8b84cb22da6036e.exe
4628	e00c9748bf093a39159ae6a13ab099c53850ef9af1f063eec8b84cb22da6036e.exe
716	e00c9748bf093a39159ae6a13ab099c53850ef9af1f063eec8b84cb22da6036e.exe
716	e00c9748bf093a39159ae6a13ab099c53850ef9af1f063eec8b84cb22da6036e.exe
716	e00c9748bf093a39159ae6a13ab099c53850ef9af1f063eec8b84cb22da6036e.exe
716	e00c9748bf093a39159ae6a13ab099c53850ef9af1f063eec8b84cb22da6036e.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4628 wrote to memory of 716	4628	e00c9748bf093a39159ae6a13ab099c53850ef9af1f063eec8b84cb22da6036e.exe	78
PID 4628 wrote to memory of 716	4628	e00c9748bf093a39159ae6a13ab099c53850ef9af1f063eec8b84cb22da6036e.exe	78
PID 4628 wrote to memory of 716	4628	e00c9748bf093a39159ae6a13ab099c53850ef9af1f063eec8b84cb22da6036e.exe	78
PID 4628 wrote to memory of 3912	4628	e00c9748bf093a39159ae6a13ab099c53850ef9af1f063eec8b84cb22da6036e.exe	79
PID 4628 wrote to memory of 3912	4628	e00c9748bf093a39159ae6a13ab099c53850ef9af1f063eec8b84cb22da6036e.exe	79
PID 4628 wrote to memory of 3912	4628	e00c9748bf093a39159ae6a13ab099c53850ef9af1f063eec8b84cb22da6036e.exe	79
PID 3912 wrote to memory of 4164	3912	cmd.exe	81
PID 3912 wrote to memory of 4164	3912	cmd.exe	81
PID 3912 wrote to memory of 4164	3912	cmd.exe	81