qakbot | b5be4d669e9045e4f4fc262ac19be932152f36e6e4629798d5a2b3b94a12e9a0

General

Target
b5be4d669e9045e4f4fc262ac19be932152f36e6e4629798d5a2b3b94a12e9a0.exe
Size 270KB
Sample201112-melksma3k6
SHA256 b5be4d669e9045e4f4fc262ac19be932152f36e6e4629798d5a2b3b94a12e9a0
MD5 f1cd16149b67c4bc2ecfeeec9fc80af1
SHA1 7b5da79993a30ad31e2b8a41673a5fd5c9a2b2f8
SHA512 6a753bce51f1947cbf37d3063361439215a8f55235fe193d2ca3954818083721bbaa8befe8aa08c17fcb6d06d2f95659efa8cc1dafd672650f8d13839a15be84
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	b5be4d669e9045e4f4fc262ac19be932152f36e6e4629798d5a2b3b94a12e9a0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	b5be4d669e9045e4f4fc262ac19be932152f36e6e4629798d5a2b3b94a12e9a0.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	b5be4d669e9045e4f4fc262ac19be932152f36e6e4629798d5a2b3b94a12e9a0.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	b5be4d669e9045e4f4fc262ac19be932152f36e6e4629798d5a2b3b94a12e9a0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	b5be4d669e9045e4f4fc262ac19be932152f36e6e4629798d5a2b3b94a12e9a0.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	b5be4d669e9045e4f4fc262ac19be932152f36e6e4629798d5a2b3b94a12e9a0.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
4076	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3372	b5be4d669e9045e4f4fc262ac19be932152f36e6e4629798d5a2b3b94a12e9a0.exe
3372	b5be4d669e9045e4f4fc262ac19be932152f36e6e4629798d5a2b3b94a12e9a0.exe
200	b5be4d669e9045e4f4fc262ac19be932152f36e6e4629798d5a2b3b94a12e9a0.exe
200	b5be4d669e9045e4f4fc262ac19be932152f36e6e4629798d5a2b3b94a12e9a0.exe
200	b5be4d669e9045e4f4fc262ac19be932152f36e6e4629798d5a2b3b94a12e9a0.exe
200	b5be4d669e9045e4f4fc262ac19be932152f36e6e4629798d5a2b3b94a12e9a0.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3372 wrote to memory of 200	3372	b5be4d669e9045e4f4fc262ac19be932152f36e6e4629798d5a2b3b94a12e9a0.exe	78
PID 3372 wrote to memory of 200	3372	b5be4d669e9045e4f4fc262ac19be932152f36e6e4629798d5a2b3b94a12e9a0.exe	78
PID 3372 wrote to memory of 200	3372	b5be4d669e9045e4f4fc262ac19be932152f36e6e4629798d5a2b3b94a12e9a0.exe	78
PID 3372 wrote to memory of 2244	3372	b5be4d669e9045e4f4fc262ac19be932152f36e6e4629798d5a2b3b94a12e9a0.exe	79
PID 3372 wrote to memory of 2244	3372	b5be4d669e9045e4f4fc262ac19be932152f36e6e4629798d5a2b3b94a12e9a0.exe	79
PID 3372 wrote to memory of 2244	3372	b5be4d669e9045e4f4fc262ac19be932152f36e6e4629798d5a2b3b94a12e9a0.exe	79
PID 2244 wrote to memory of 4076	2244	cmd.exe	81
PID 2244 wrote to memory of 4076	2244	cmd.exe	81
PID 2244 wrote to memory of 4076	2244	cmd.exe	81