qakbot | 1205eaee01fe8e2bb603ef2ae49e53f2071b73da6e401e1f87574f938ebb94d3

General

Target
1205eaee01fe8e2bb603ef2ae49e53f2071b73da6e401e1f87574f938ebb94d3.exe
Size 270KB
Sample201112-7l3wjvycex
SHA256 1205eaee01fe8e2bb603ef2ae49e53f2071b73da6e401e1f87574f938ebb94d3
MD5 6a6918f7d06b9838f7c7e973c654904c
SHA1 3f8e72ebc1472900c4e54f1abfd916c971e2670d
SHA512 8c2a396cdb8225a6760a177070b51033ae4c8a42fb414ea34e7977cebd61261c4a54db14d34ae9d39b4099af958a83eee055bf1fce2ada059feba3e5624789b9
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	1205eaee01fe8e2bb603ef2ae49e53f2071b73da6e401e1f87574f938ebb94d3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	1205eaee01fe8e2bb603ef2ae49e53f2071b73da6e401e1f87574f938ebb94d3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	1205eaee01fe8e2bb603ef2ae49e53f2071b73da6e401e1f87574f938ebb94d3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	1205eaee01fe8e2bb603ef2ae49e53f2071b73da6e401e1f87574f938ebb94d3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	1205eaee01fe8e2bb603ef2ae49e53f2071b73da6e401e1f87574f938ebb94d3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	1205eaee01fe8e2bb603ef2ae49e53f2071b73da6e401e1f87574f938ebb94d3.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
3920	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
984	1205eaee01fe8e2bb603ef2ae49e53f2071b73da6e401e1f87574f938ebb94d3.exe
984	1205eaee01fe8e2bb603ef2ae49e53f2071b73da6e401e1f87574f938ebb94d3.exe
184	1205eaee01fe8e2bb603ef2ae49e53f2071b73da6e401e1f87574f938ebb94d3.exe
184	1205eaee01fe8e2bb603ef2ae49e53f2071b73da6e401e1f87574f938ebb94d3.exe
184	1205eaee01fe8e2bb603ef2ae49e53f2071b73da6e401e1f87574f938ebb94d3.exe
184	1205eaee01fe8e2bb603ef2ae49e53f2071b73da6e401e1f87574f938ebb94d3.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 984 wrote to memory of 184	984	1205eaee01fe8e2bb603ef2ae49e53f2071b73da6e401e1f87574f938ebb94d3.exe	78
PID 984 wrote to memory of 184	984	1205eaee01fe8e2bb603ef2ae49e53f2071b73da6e401e1f87574f938ebb94d3.exe	78
PID 984 wrote to memory of 184	984	1205eaee01fe8e2bb603ef2ae49e53f2071b73da6e401e1f87574f938ebb94d3.exe	78
PID 984 wrote to memory of 1896	984	1205eaee01fe8e2bb603ef2ae49e53f2071b73da6e401e1f87574f938ebb94d3.exe	79
PID 984 wrote to memory of 1896	984	1205eaee01fe8e2bb603ef2ae49e53f2071b73da6e401e1f87574f938ebb94d3.exe	79
PID 984 wrote to memory of 1896	984	1205eaee01fe8e2bb603ef2ae49e53f2071b73da6e401e1f87574f938ebb94d3.exe	79
PID 1896 wrote to memory of 3920	1896	cmd.exe	81
PID 1896 wrote to memory of 3920	1896	cmd.exe	81
PID 1896 wrote to memory of 3920	1896	cmd.exe	81