qakbot | 59299ab7deedb09945181f745ad3ecfc0f72c17037b402051843fa74b1d1c7dd

General

Target
59299ab7deedb09945181f745ad3ecfc0f72c17037b402051843fa74b1d1c7dd.exe
Size 270KB
Sample201112-3fb9c3eql6
SHA256 59299ab7deedb09945181f745ad3ecfc0f72c17037b402051843fa74b1d1c7dd
MD5 fe660047ce4aabd6bd840f304505e949
SHA1 8dd1d887bbb2055a40b7da984d68f06a0234ec79
SHA512 5cfd0fa3fa8c1da422327340b22264225b2494da08997b9644fb921daf9fdb07fb8f7647dcd7c9347638580460a1634d37c647a5c5257f4c9230218ef4863474
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	59299ab7deedb09945181f745ad3ecfc0f72c17037b402051843fa74b1d1c7dd.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	59299ab7deedb09945181f745ad3ecfc0f72c17037b402051843fa74b1d1c7dd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	59299ab7deedb09945181f745ad3ecfc0f72c17037b402051843fa74b1d1c7dd.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	59299ab7deedb09945181f745ad3ecfc0f72c17037b402051843fa74b1d1c7dd.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	59299ab7deedb09945181f745ad3ecfc0f72c17037b402051843fa74b1d1c7dd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	59299ab7deedb09945181f745ad3ecfc0f72c17037b402051843fa74b1d1c7dd.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
1280	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3988	59299ab7deedb09945181f745ad3ecfc0f72c17037b402051843fa74b1d1c7dd.exe
3988	59299ab7deedb09945181f745ad3ecfc0f72c17037b402051843fa74b1d1c7dd.exe
2756	59299ab7deedb09945181f745ad3ecfc0f72c17037b402051843fa74b1d1c7dd.exe
2756	59299ab7deedb09945181f745ad3ecfc0f72c17037b402051843fa74b1d1c7dd.exe
2756	59299ab7deedb09945181f745ad3ecfc0f72c17037b402051843fa74b1d1c7dd.exe
2756	59299ab7deedb09945181f745ad3ecfc0f72c17037b402051843fa74b1d1c7dd.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3988 wrote to memory of 2756	3988	59299ab7deedb09945181f745ad3ecfc0f72c17037b402051843fa74b1d1c7dd.exe	79
PID 3988 wrote to memory of 2756	3988	59299ab7deedb09945181f745ad3ecfc0f72c17037b402051843fa74b1d1c7dd.exe	79
PID 3988 wrote to memory of 2756	3988	59299ab7deedb09945181f745ad3ecfc0f72c17037b402051843fa74b1d1c7dd.exe	79
PID 3988 wrote to memory of 996	3988	59299ab7deedb09945181f745ad3ecfc0f72c17037b402051843fa74b1d1c7dd.exe	80
PID 3988 wrote to memory of 996	3988	59299ab7deedb09945181f745ad3ecfc0f72c17037b402051843fa74b1d1c7dd.exe	80
PID 3988 wrote to memory of 996	3988	59299ab7deedb09945181f745ad3ecfc0f72c17037b402051843fa74b1d1c7dd.exe	80
PID 996 wrote to memory of 1280	996	cmd.exe	82
PID 996 wrote to memory of 1280	996	cmd.exe	82
PID 996 wrote to memory of 1280	996	cmd.exe	82