qakbot | e7b7df6fe9f0350612f65ca98932a34b010e080fd460af6e134e554af1ea40ca

General

Target
e7b7df6fe9f0350612f65ca98932a34b010e080fd460af6e134e554af1ea40ca.exe
Size 270KB
Sample201111-y8wrms69q2
SHA256 e7b7df6fe9f0350612f65ca98932a34b010e080fd460af6e134e554af1ea40ca
MD5 592848da86d3e717f10d1bd4a429b0b0
SHA1 464a3b4fa31ae4bff5324b8412006b07259f3475
SHA512 a8832d33f35067faa053ba817e18ddddee00c1314d5eccf41a09073fe89be1f8443e85d8cb438f246fadfb901498cb84decf7ca9a65d538cb471c42bf7072490
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	e7b7df6fe9f0350612f65ca98932a34b010e080fd460af6e134e554af1ea40ca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	e7b7df6fe9f0350612f65ca98932a34b010e080fd460af6e134e554af1ea40ca.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	e7b7df6fe9f0350612f65ca98932a34b010e080fd460af6e134e554af1ea40ca.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	e7b7df6fe9f0350612f65ca98932a34b010e080fd460af6e134e554af1ea40ca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	e7b7df6fe9f0350612f65ca98932a34b010e080fd460af6e134e554af1ea40ca.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	e7b7df6fe9f0350612f65ca98932a34b010e080fd460af6e134e554af1ea40ca.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
2660	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
980	e7b7df6fe9f0350612f65ca98932a34b010e080fd460af6e134e554af1ea40ca.exe
980	e7b7df6fe9f0350612f65ca98932a34b010e080fd460af6e134e554af1ea40ca.exe
200	e7b7df6fe9f0350612f65ca98932a34b010e080fd460af6e134e554af1ea40ca.exe
200	e7b7df6fe9f0350612f65ca98932a34b010e080fd460af6e134e554af1ea40ca.exe
200	e7b7df6fe9f0350612f65ca98932a34b010e080fd460af6e134e554af1ea40ca.exe
200	e7b7df6fe9f0350612f65ca98932a34b010e080fd460af6e134e554af1ea40ca.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 980 wrote to memory of 200	980	e7b7df6fe9f0350612f65ca98932a34b010e080fd460af6e134e554af1ea40ca.exe	78
PID 980 wrote to memory of 200	980	e7b7df6fe9f0350612f65ca98932a34b010e080fd460af6e134e554af1ea40ca.exe	78
PID 980 wrote to memory of 200	980	e7b7df6fe9f0350612f65ca98932a34b010e080fd460af6e134e554af1ea40ca.exe	78
PID 980 wrote to memory of 728	980	e7b7df6fe9f0350612f65ca98932a34b010e080fd460af6e134e554af1ea40ca.exe	79
PID 980 wrote to memory of 728	980	e7b7df6fe9f0350612f65ca98932a34b010e080fd460af6e134e554af1ea40ca.exe	79
PID 980 wrote to memory of 728	980	e7b7df6fe9f0350612f65ca98932a34b010e080fd460af6e134e554af1ea40ca.exe	79
PID 728 wrote to memory of 2660	728	cmd.exe	81
PID 728 wrote to memory of 2660	728	cmd.exe	81
PID 728 wrote to memory of 2660	728	cmd.exe	81