qakbot | e5807c42644f2419009915ebb236828afc8296720f6250971131b1815aefbece

General

Target
e5807c42644f2419009915ebb236828afc8296720f6250971131b1815aefbece.exe
Size 213KB
Sample201112-mczcrc26wj
SHA256 e5807c42644f2419009915ebb236828afc8296720f6250971131b1815aefbece
MD5 02057a91fb129f172b0e8c37d7b5b817
SHA1 9712bdb3a66ecc6935017c74f6fbe712f8517adb
SHA512 f4c65be75144d482fdf20b0d13115452d84a8972059c9bd86d2b4a8e7235ab3f06b395caf560599065c9caf13a45e0a2e57e379abcb966caf8013abfd1a6e16b
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	e5807c42644f2419009915ebb236828afc8296720f6250971131b1815aefbece.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	e5807c42644f2419009915ebb236828afc8296720f6250971131b1815aefbece.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	e5807c42644f2419009915ebb236828afc8296720f6250971131b1815aefbece.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	e5807c42644f2419009915ebb236828afc8296720f6250971131b1815aefbece.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	e5807c42644f2419009915ebb236828afc8296720f6250971131b1815aefbece.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	e5807c42644f2419009915ebb236828afc8296720f6250971131b1815aefbece.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
3552	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3372 wrote to memory of 2712	3372	e5807c42644f2419009915ebb236828afc8296720f6250971131b1815aefbece.exe	75
PID 3372 wrote to memory of 2712	3372	e5807c42644f2419009915ebb236828afc8296720f6250971131b1815aefbece.exe	75
PID 3372 wrote to memory of 2712	3372	e5807c42644f2419009915ebb236828afc8296720f6250971131b1815aefbece.exe	75
PID 3372 wrote to memory of 4092	3372	e5807c42644f2419009915ebb236828afc8296720f6250971131b1815aefbece.exe	76
PID 3372 wrote to memory of 4092	3372	e5807c42644f2419009915ebb236828afc8296720f6250971131b1815aefbece.exe	76
PID 3372 wrote to memory of 4092	3372	e5807c42644f2419009915ebb236828afc8296720f6250971131b1815aefbece.exe	76
PID 4092 wrote to memory of 3552	4092	cmd.exe	78
PID 4092 wrote to memory of 3552	4092	cmd.exe	78
PID 4092 wrote to memory of 3552	4092	cmd.exe	78