qakbot | 5ecdd71445e956bb7a697a845fffb70da92d5bb168a9c182f5ba15dd5647cd3d

General

Target
5ecdd71445e956bb7a697a845fffb70da92d5bb168a9c182f5ba15dd5647cd3d.exe
Size 270KB
Sample201113-r8djc13e9x
SHA256 5ecdd71445e956bb7a697a845fffb70da92d5bb168a9c182f5ba15dd5647cd3d
MD5 9966f480185210f67c1df284a456246e
SHA1 ad527ae90eabe842d197f24f8d2b9fa9542db4eb
SHA512 239412e67296dc0ad83fc4aec4e957c4d57e84c05933ee6a788cb808b00208cf85b49bb076bebbf8eff8fe5606f483d8595fe57be2e69214b0bb50f8a79489b4
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	5ecdd71445e956bb7a697a845fffb70da92d5bb168a9c182f5ba15dd5647cd3d.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	5ecdd71445e956bb7a697a845fffb70da92d5bb168a9c182f5ba15dd5647cd3d.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	5ecdd71445e956bb7a697a845fffb70da92d5bb168a9c182f5ba15dd5647cd3d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	5ecdd71445e956bb7a697a845fffb70da92d5bb168a9c182f5ba15dd5647cd3d.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	5ecdd71445e956bb7a697a845fffb70da92d5bb168a9c182f5ba15dd5647cd3d.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	5ecdd71445e956bb7a697a845fffb70da92d5bb168a9c182f5ba15dd5647cd3d.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
4064	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4760	5ecdd71445e956bb7a697a845fffb70da92d5bb168a9c182f5ba15dd5647cd3d.exe
4760	5ecdd71445e956bb7a697a845fffb70da92d5bb168a9c182f5ba15dd5647cd3d.exe
3960	5ecdd71445e956bb7a697a845fffb70da92d5bb168a9c182f5ba15dd5647cd3d.exe
3960	5ecdd71445e956bb7a697a845fffb70da92d5bb168a9c182f5ba15dd5647cd3d.exe
3960	5ecdd71445e956bb7a697a845fffb70da92d5bb168a9c182f5ba15dd5647cd3d.exe
3960	5ecdd71445e956bb7a697a845fffb70da92d5bb168a9c182f5ba15dd5647cd3d.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4760 wrote to memory of 3960	4760	5ecdd71445e956bb7a697a845fffb70da92d5bb168a9c182f5ba15dd5647cd3d.exe	79
PID 4760 wrote to memory of 3960	4760	5ecdd71445e956bb7a697a845fffb70da92d5bb168a9c182f5ba15dd5647cd3d.exe	79
PID 4760 wrote to memory of 3960	4760	5ecdd71445e956bb7a697a845fffb70da92d5bb168a9c182f5ba15dd5647cd3d.exe	79
PID 4760 wrote to memory of 4432	4760	5ecdd71445e956bb7a697a845fffb70da92d5bb168a9c182f5ba15dd5647cd3d.exe	80
PID 4760 wrote to memory of 4432	4760	5ecdd71445e956bb7a697a845fffb70da92d5bb168a9c182f5ba15dd5647cd3d.exe	80
PID 4760 wrote to memory of 4432	4760	5ecdd71445e956bb7a697a845fffb70da92d5bb168a9c182f5ba15dd5647cd3d.exe	80
PID 4432 wrote to memory of 4064	4432	cmd.exe	82
PID 4432 wrote to memory of 4064	4432	cmd.exe	82
PID 4432 wrote to memory of 4064	4432	cmd.exe	82