qakbot | 019ee92930a43708fc5a80af84e21cb45321e4fe3fcd49667863476c25922c08

General

Target
019ee92930a43708fc5a80af84e21cb45321e4fe3fcd49667863476c25922c08.exe
Size 838KB
Sample201112-c3deaf6p4a
SHA256 019ee92930a43708fc5a80af84e21cb45321e4fe3fcd49667863476c25922c08
MD5 02e631cf80b2944d4f178bf9a45a181e
SHA1 c59c0b52ca14b13ca993f57df4c2182f942c9bbf
SHA512 2ebefd82c7f12d9c74d360569cd1928dca347017a24a35063606c9b2120cbc9b8b2797bf58720e19d097349b50a900996fbde6257af143139d36a264f2ec4162
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	019ee92930a43708fc5a80af84e21cb45321e4fe3fcd49667863476c25922c08.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	019ee92930a43708fc5a80af84e21cb45321e4fe3fcd49667863476c25922c08.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	019ee92930a43708fc5a80af84e21cb45321e4fe3fcd49667863476c25922c08.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	019ee92930a43708fc5a80af84e21cb45321e4fe3fcd49667863476c25922c08.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	019ee92930a43708fc5a80af84e21cb45321e4fe3fcd49667863476c25922c08.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	019ee92930a43708fc5a80af84e21cb45321e4fe3fcd49667863476c25922c08.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
1404	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 648 wrote to memory of 2568	648	019ee92930a43708fc5a80af84e21cb45321e4fe3fcd49667863476c25922c08.exe	78
PID 648 wrote to memory of 2568	648	019ee92930a43708fc5a80af84e21cb45321e4fe3fcd49667863476c25922c08.exe	78
PID 648 wrote to memory of 2568	648	019ee92930a43708fc5a80af84e21cb45321e4fe3fcd49667863476c25922c08.exe	78
PID 648 wrote to memory of 3560	648	019ee92930a43708fc5a80af84e21cb45321e4fe3fcd49667863476c25922c08.exe	79
PID 648 wrote to memory of 3560	648	019ee92930a43708fc5a80af84e21cb45321e4fe3fcd49667863476c25922c08.exe	79
PID 648 wrote to memory of 3560	648	019ee92930a43708fc5a80af84e21cb45321e4fe3fcd49667863476c25922c08.exe	79
PID 3560 wrote to memory of 1404	3560	cmd.exe	81
PID 3560 wrote to memory of 1404	3560	cmd.exe	81
PID 3560 wrote to memory of 1404	3560	cmd.exe	81