qakbot | 58f4e15c310e831660cceb0b7b0eb5196ed36e8e0e18d6965e6dbef6e46ead07

General

Target
58f4e15c310e831660cceb0b7b0eb5196ed36e8e0e18d6965e6dbef6e46ead07.exe
Size 270KB
Sample201112-16jvh7lbk2
SHA256 58f4e15c310e831660cceb0b7b0eb5196ed36e8e0e18d6965e6dbef6e46ead07
MD5 6a2096ee54d4ff1e327c90f48d0e213f
SHA1 ea9475e6667e2a4943c8817b25bf6a8100b947f7
SHA512 38422fe8133b5d2ce4e2ae7f5d0f9132edd4f12ee4922d864555ca426e65391db3443192b26e0a8a4a6c5853034f917f0484b70ed36e7b5b3b6bd52378b6e474
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	58f4e15c310e831660cceb0b7b0eb5196ed36e8e0e18d6965e6dbef6e46ead07.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	58f4e15c310e831660cceb0b7b0eb5196ed36e8e0e18d6965e6dbef6e46ead07.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	58f4e15c310e831660cceb0b7b0eb5196ed36e8e0e18d6965e6dbef6e46ead07.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	58f4e15c310e831660cceb0b7b0eb5196ed36e8e0e18d6965e6dbef6e46ead07.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	58f4e15c310e831660cceb0b7b0eb5196ed36e8e0e18d6965e6dbef6e46ead07.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	58f4e15c310e831660cceb0b7b0eb5196ed36e8e0e18d6965e6dbef6e46ead07.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
2992	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
508	58f4e15c310e831660cceb0b7b0eb5196ed36e8e0e18d6965e6dbef6e46ead07.exe
508	58f4e15c310e831660cceb0b7b0eb5196ed36e8e0e18d6965e6dbef6e46ead07.exe
184	58f4e15c310e831660cceb0b7b0eb5196ed36e8e0e18d6965e6dbef6e46ead07.exe
184	58f4e15c310e831660cceb0b7b0eb5196ed36e8e0e18d6965e6dbef6e46ead07.exe
184	58f4e15c310e831660cceb0b7b0eb5196ed36e8e0e18d6965e6dbef6e46ead07.exe
184	58f4e15c310e831660cceb0b7b0eb5196ed36e8e0e18d6965e6dbef6e46ead07.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 508 wrote to memory of 184	508	58f4e15c310e831660cceb0b7b0eb5196ed36e8e0e18d6965e6dbef6e46ead07.exe	78
PID 508 wrote to memory of 184	508	58f4e15c310e831660cceb0b7b0eb5196ed36e8e0e18d6965e6dbef6e46ead07.exe	78
PID 508 wrote to memory of 184	508	58f4e15c310e831660cceb0b7b0eb5196ed36e8e0e18d6965e6dbef6e46ead07.exe	78
PID 508 wrote to memory of 1336	508	58f4e15c310e831660cceb0b7b0eb5196ed36e8e0e18d6965e6dbef6e46ead07.exe	79
PID 508 wrote to memory of 1336	508	58f4e15c310e831660cceb0b7b0eb5196ed36e8e0e18d6965e6dbef6e46ead07.exe	79
PID 508 wrote to memory of 1336	508	58f4e15c310e831660cceb0b7b0eb5196ed36e8e0e18d6965e6dbef6e46ead07.exe	79
PID 1336 wrote to memory of 2992	1336	cmd.exe	81
PID 1336 wrote to memory of 2992	1336	cmd.exe	81
PID 1336 wrote to memory of 2992	1336	cmd.exe	81