qakbot | 78e26491850cf0ba821d29c033ebd92888d213afe3af8b4e05ca34657c592646

General

Target
78e26491850cf0ba821d29c033ebd92888d213afe3af8b4e05ca34657c592646.exe
Size 270KB
Sample201113-ky48tg51ae
SHA256 78e26491850cf0ba821d29c033ebd92888d213afe3af8b4e05ca34657c592646
MD5 0a125837d71d14212d7c1bda65b26d91
SHA1 b50eb852bbeed2090bba8a4d55ff9fc373bcaa6c
SHA512 5eb689a21c75f77e6f23c286466f39da03db5ed72492eaa0e3127ceb81a33d1a92f48a74c0d5afe43db1c6b10d6050fad5ab9885967f77d9256317205583fc81
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	78e26491850cf0ba821d29c033ebd92888d213afe3af8b4e05ca34657c592646.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	78e26491850cf0ba821d29c033ebd92888d213afe3af8b4e05ca34657c592646.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	78e26491850cf0ba821d29c033ebd92888d213afe3af8b4e05ca34657c592646.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	78e26491850cf0ba821d29c033ebd92888d213afe3af8b4e05ca34657c592646.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	78e26491850cf0ba821d29c033ebd92888d213afe3af8b4e05ca34657c592646.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	78e26491850cf0ba821d29c033ebd92888d213afe3af8b4e05ca34657c592646.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
552	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4756 wrote to memory of 4224	4756	78e26491850cf0ba821d29c033ebd92888d213afe3af8b4e05ca34657c592646.exe	78
PID 4756 wrote to memory of 4224	4756	78e26491850cf0ba821d29c033ebd92888d213afe3af8b4e05ca34657c592646.exe	78
PID 4756 wrote to memory of 4224	4756	78e26491850cf0ba821d29c033ebd92888d213afe3af8b4e05ca34657c592646.exe	78
PID 4756 wrote to memory of 4348	4756	78e26491850cf0ba821d29c033ebd92888d213afe3af8b4e05ca34657c592646.exe	79
PID 4756 wrote to memory of 4348	4756	78e26491850cf0ba821d29c033ebd92888d213afe3af8b4e05ca34657c592646.exe	79
PID 4756 wrote to memory of 4348	4756	78e26491850cf0ba821d29c033ebd92888d213afe3af8b4e05ca34657c592646.exe	79
PID 4348 wrote to memory of 552	4348	cmd.exe	81
PID 4348 wrote to memory of 552	4348	cmd.exe	81
PID 4348 wrote to memory of 552	4348	cmd.exe	81