qakbot | e587322c098bb48e9a9bd10a12b1dc53bfd55915dec951f3697188387fedbbbf

General

Target
e587322c098bb48e9a9bd10a12b1dc53bfd55915dec951f3697188387fedbbbf.exe
Size 270KB
Sample201112-rmh2ddq9za
SHA256 e587322c098bb48e9a9bd10a12b1dc53bfd55915dec951f3697188387fedbbbf
MD5 1a46871bd3283a25423d7242f1a8b480
SHA1 b0263d2c2472cd550d398d6684eb8e1c90c2da12
SHA512 1fd7fda3222579ee20a5f64b8bd1ad6841f3cfb9f6aa400f04305dd7b495cd9383316c14361ef3c660ca62d46dd4ea564f5d6cf0a923d11c0d74e0218dc15cb7
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	e587322c098bb48e9a9bd10a12b1dc53bfd55915dec951f3697188387fedbbbf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	e587322c098bb48e9a9bd10a12b1dc53bfd55915dec951f3697188387fedbbbf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	e587322c098bb48e9a9bd10a12b1dc53bfd55915dec951f3697188387fedbbbf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	e587322c098bb48e9a9bd10a12b1dc53bfd55915dec951f3697188387fedbbbf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	e587322c098bb48e9a9bd10a12b1dc53bfd55915dec951f3697188387fedbbbf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	e587322c098bb48e9a9bd10a12b1dc53bfd55915dec951f3697188387fedbbbf.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
3496	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2268	e587322c098bb48e9a9bd10a12b1dc53bfd55915dec951f3697188387fedbbbf.exe
2268	e587322c098bb48e9a9bd10a12b1dc53bfd55915dec951f3697188387fedbbbf.exe
1404	e587322c098bb48e9a9bd10a12b1dc53bfd55915dec951f3697188387fedbbbf.exe
1404	e587322c098bb48e9a9bd10a12b1dc53bfd55915dec951f3697188387fedbbbf.exe
1404	e587322c098bb48e9a9bd10a12b1dc53bfd55915dec951f3697188387fedbbbf.exe
1404	e587322c098bb48e9a9bd10a12b1dc53bfd55915dec951f3697188387fedbbbf.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 1404	2268	e587322c098bb48e9a9bd10a12b1dc53bfd55915dec951f3697188387fedbbbf.exe	78
PID 2268 wrote to memory of 1404	2268	e587322c098bb48e9a9bd10a12b1dc53bfd55915dec951f3697188387fedbbbf.exe	78
PID 2268 wrote to memory of 1404	2268	e587322c098bb48e9a9bd10a12b1dc53bfd55915dec951f3697188387fedbbbf.exe	78
PID 2268 wrote to memory of 2380	2268	e587322c098bb48e9a9bd10a12b1dc53bfd55915dec951f3697188387fedbbbf.exe	79
PID 2268 wrote to memory of 2380	2268	e587322c098bb48e9a9bd10a12b1dc53bfd55915dec951f3697188387fedbbbf.exe	79
PID 2268 wrote to memory of 2380	2268	e587322c098bb48e9a9bd10a12b1dc53bfd55915dec951f3697188387fedbbbf.exe	79
PID 2380 wrote to memory of 3496	2380	cmd.exe	81
PID 2380 wrote to memory of 3496	2380	cmd.exe	81
PID 2380 wrote to memory of 3496	2380	cmd.exe	81