qakbot | a5c2f4d07e0b73981fb4e759217fc05a761e2aac6b47f0c5c1872ef02f0504e7

General

Target
a5c2f4d07e0b73981fb4e759217fc05a761e2aac6b47f0c5c1872ef02f0504e7.exe
Size 270KB
Sample201111-9xvb6j65xn
SHA256 a5c2f4d07e0b73981fb4e759217fc05a761e2aac6b47f0c5c1872ef02f0504e7
MD5 c612e8306d34c1fd0836d16feee6fec4
SHA1 8777188e634719e571160077bb4412d00e03631d
SHA512 8359ae8a9831187a11925ecae829703187d83011ca736e92378718860c10034c56837af281ed0effb5b171491f612117378c623f1a56310e0eb3e632766e4fd4
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	a5c2f4d07e0b73981fb4e759217fc05a761e2aac6b47f0c5c1872ef02f0504e7.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	a5c2f4d07e0b73981fb4e759217fc05a761e2aac6b47f0c5c1872ef02f0504e7.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	a5c2f4d07e0b73981fb4e759217fc05a761e2aac6b47f0c5c1872ef02f0504e7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	a5c2f4d07e0b73981fb4e759217fc05a761e2aac6b47f0c5c1872ef02f0504e7.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	a5c2f4d07e0b73981fb4e759217fc05a761e2aac6b47f0c5c1872ef02f0504e7.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	a5c2f4d07e0b73981fb4e759217fc05a761e2aac6b47f0c5c1872ef02f0504e7.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
1952	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
632	a5c2f4d07e0b73981fb4e759217fc05a761e2aac6b47f0c5c1872ef02f0504e7.exe
632	a5c2f4d07e0b73981fb4e759217fc05a761e2aac6b47f0c5c1872ef02f0504e7.exe
3572	a5c2f4d07e0b73981fb4e759217fc05a761e2aac6b47f0c5c1872ef02f0504e7.exe
3572	a5c2f4d07e0b73981fb4e759217fc05a761e2aac6b47f0c5c1872ef02f0504e7.exe
3572	a5c2f4d07e0b73981fb4e759217fc05a761e2aac6b47f0c5c1872ef02f0504e7.exe
3572	a5c2f4d07e0b73981fb4e759217fc05a761e2aac6b47f0c5c1872ef02f0504e7.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 632 wrote to memory of 3572	632	a5c2f4d07e0b73981fb4e759217fc05a761e2aac6b47f0c5c1872ef02f0504e7.exe	78
PID 632 wrote to memory of 3572	632	a5c2f4d07e0b73981fb4e759217fc05a761e2aac6b47f0c5c1872ef02f0504e7.exe	78
PID 632 wrote to memory of 3572	632	a5c2f4d07e0b73981fb4e759217fc05a761e2aac6b47f0c5c1872ef02f0504e7.exe	78
PID 632 wrote to memory of 4044	632	a5c2f4d07e0b73981fb4e759217fc05a761e2aac6b47f0c5c1872ef02f0504e7.exe	79
PID 632 wrote to memory of 4044	632	a5c2f4d07e0b73981fb4e759217fc05a761e2aac6b47f0c5c1872ef02f0504e7.exe	79
PID 632 wrote to memory of 4044	632	a5c2f4d07e0b73981fb4e759217fc05a761e2aac6b47f0c5c1872ef02f0504e7.exe	79
PID 4044 wrote to memory of 1952	4044	cmd.exe	81
PID 4044 wrote to memory of 1952	4044	cmd.exe	81
PID 4044 wrote to memory of 1952	4044	cmd.exe	81