qakbot | ea930eca5a6f379663768ced609a217bfab8d0c5633e012855f16d848022232f

General

Target
ea930eca5a6f379663768ced609a217bfab8d0c5633e012855f16d848022232f.exe
Size 270KB
Sample201112-zz7te2akss
SHA256 ea930eca5a6f379663768ced609a217bfab8d0c5633e012855f16d848022232f
MD5 1b5d25bc4fc833423b76f037f1719103
SHA1 ea95e75117cd00a6b49cf015e567df7b4ec551bc
SHA512 3b7920722c427dfa2509d775cc45f9829577207e02858b4ed0cecf895a469f64dca837b7c37ddd65b6700c9e133bb18250ddb05eaf1498d48b415ca7993bf339
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	ea930eca5a6f379663768ced609a217bfab8d0c5633e012855f16d848022232f.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	ea930eca5a6f379663768ced609a217bfab8d0c5633e012855f16d848022232f.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	ea930eca5a6f379663768ced609a217bfab8d0c5633e012855f16d848022232f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	ea930eca5a6f379663768ced609a217bfab8d0c5633e012855f16d848022232f.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	ea930eca5a6f379663768ced609a217bfab8d0c5633e012855f16d848022232f.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	ea930eca5a6f379663768ced609a217bfab8d0c5633e012855f16d848022232f.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
3180	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4696 wrote to memory of 3160	4696	ea930eca5a6f379663768ced609a217bfab8d0c5633e012855f16d848022232f.exe	78
PID 4696 wrote to memory of 3160	4696	ea930eca5a6f379663768ced609a217bfab8d0c5633e012855f16d848022232f.exe	78
PID 4696 wrote to memory of 3160	4696	ea930eca5a6f379663768ced609a217bfab8d0c5633e012855f16d848022232f.exe	78
PID 4696 wrote to memory of 4208	4696	ea930eca5a6f379663768ced609a217bfab8d0c5633e012855f16d848022232f.exe	79
PID 4696 wrote to memory of 4208	4696	ea930eca5a6f379663768ced609a217bfab8d0c5633e012855f16d848022232f.exe	79
PID 4696 wrote to memory of 4208	4696	ea930eca5a6f379663768ced609a217bfab8d0c5633e012855f16d848022232f.exe	79
PID 4208 wrote to memory of 3180	4208	cmd.exe	81
PID 4208 wrote to memory of 3180	4208	cmd.exe	81
PID 4208 wrote to memory of 3180	4208	cmd.exe	81