qakbot | 53a41ea4cb7cd3ee7ba404015ed9808ef34adb1e53424a0aff78333184ff5115

General

Target
53a41ea4cb7cd3ee7ba404015ed9808ef34adb1e53424a0aff78333184ff5115.exe
Size 270KB
Sample201112-jbgpczx82x
SHA256 53a41ea4cb7cd3ee7ba404015ed9808ef34adb1e53424a0aff78333184ff5115
MD5 02cbe07beb6458f3b33aea64609855af
SHA1 4b7a006599d899921c3a6d58df331cc5b3c83d43
SHA512 1e01b06750a781294d45411c6678455e5c2c31146fc801f8ef4dab132bb4ee099de9717261e85d5bb71bc5220a7ddaefbc42bd60cc61edf2aedda26188c834fd
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	53a41ea4cb7cd3ee7ba404015ed9808ef34adb1e53424a0aff78333184ff5115.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	53a41ea4cb7cd3ee7ba404015ed9808ef34adb1e53424a0aff78333184ff5115.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	53a41ea4cb7cd3ee7ba404015ed9808ef34adb1e53424a0aff78333184ff5115.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	53a41ea4cb7cd3ee7ba404015ed9808ef34adb1e53424a0aff78333184ff5115.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	53a41ea4cb7cd3ee7ba404015ed9808ef34adb1e53424a0aff78333184ff5115.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	53a41ea4cb7cd3ee7ba404015ed9808ef34adb1e53424a0aff78333184ff5115.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
3100	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3408	53a41ea4cb7cd3ee7ba404015ed9808ef34adb1e53424a0aff78333184ff5115.exe
3408	53a41ea4cb7cd3ee7ba404015ed9808ef34adb1e53424a0aff78333184ff5115.exe
1376	53a41ea4cb7cd3ee7ba404015ed9808ef34adb1e53424a0aff78333184ff5115.exe
1376	53a41ea4cb7cd3ee7ba404015ed9808ef34adb1e53424a0aff78333184ff5115.exe
1376	53a41ea4cb7cd3ee7ba404015ed9808ef34adb1e53424a0aff78333184ff5115.exe
1376	53a41ea4cb7cd3ee7ba404015ed9808ef34adb1e53424a0aff78333184ff5115.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3408 wrote to memory of 1376	3408	53a41ea4cb7cd3ee7ba404015ed9808ef34adb1e53424a0aff78333184ff5115.exe	79
PID 3408 wrote to memory of 1376	3408	53a41ea4cb7cd3ee7ba404015ed9808ef34adb1e53424a0aff78333184ff5115.exe	79
PID 3408 wrote to memory of 1376	3408	53a41ea4cb7cd3ee7ba404015ed9808ef34adb1e53424a0aff78333184ff5115.exe	79
PID 3408 wrote to memory of 3412	3408	53a41ea4cb7cd3ee7ba404015ed9808ef34adb1e53424a0aff78333184ff5115.exe	80
PID 3408 wrote to memory of 3412	3408	53a41ea4cb7cd3ee7ba404015ed9808ef34adb1e53424a0aff78333184ff5115.exe	80
PID 3408 wrote to memory of 3412	3408	53a41ea4cb7cd3ee7ba404015ed9808ef34adb1e53424a0aff78333184ff5115.exe	80
PID 3412 wrote to memory of 3100	3412	cmd.exe	82
PID 3412 wrote to memory of 3100	3412	cmd.exe	82
PID 3412 wrote to memory of 3100	3412	cmd.exe	82