qakbot | c59ba650ef8d7f564152821ce2e85f81090817cd85ff99ae819dca8abca734ba

General

Target
c59ba650ef8d7f564152821ce2e85f81090817cd85ff99ae819dca8abca734ba.exe
Size 270KB
Sample201113-v56qvhp796
SHA256 c59ba650ef8d7f564152821ce2e85f81090817cd85ff99ae819dca8abca734ba
MD5 baba06660500a130089284e88fa95626
SHA1 242ce3de51e50f443529eadd5a264b370f84b93f
SHA512 bd9fa37ee9e5f4ec8e8d66eced4c086444754bafb0aaa183428fda539a1c8e043342ef941b5076259eb8c33a084bc96300fe74c1f3bf078b3d5dfb270a1c65b1
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	c59ba650ef8d7f564152821ce2e85f81090817cd85ff99ae819dca8abca734ba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	c59ba650ef8d7f564152821ce2e85f81090817cd85ff99ae819dca8abca734ba.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	c59ba650ef8d7f564152821ce2e85f81090817cd85ff99ae819dca8abca734ba.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	c59ba650ef8d7f564152821ce2e85f81090817cd85ff99ae819dca8abca734ba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	c59ba650ef8d7f564152821ce2e85f81090817cd85ff99ae819dca8abca734ba.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	c59ba650ef8d7f564152821ce2e85f81090817cd85ff99ae819dca8abca734ba.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
2724	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
580	c59ba650ef8d7f564152821ce2e85f81090817cd85ff99ae819dca8abca734ba.exe
580	c59ba650ef8d7f564152821ce2e85f81090817cd85ff99ae819dca8abca734ba.exe
188	c59ba650ef8d7f564152821ce2e85f81090817cd85ff99ae819dca8abca734ba.exe
188	c59ba650ef8d7f564152821ce2e85f81090817cd85ff99ae819dca8abca734ba.exe
188	c59ba650ef8d7f564152821ce2e85f81090817cd85ff99ae819dca8abca734ba.exe
188	c59ba650ef8d7f564152821ce2e85f81090817cd85ff99ae819dca8abca734ba.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 580 wrote to memory of 188	580	c59ba650ef8d7f564152821ce2e85f81090817cd85ff99ae819dca8abca734ba.exe	78
PID 580 wrote to memory of 188	580	c59ba650ef8d7f564152821ce2e85f81090817cd85ff99ae819dca8abca734ba.exe	78
PID 580 wrote to memory of 188	580	c59ba650ef8d7f564152821ce2e85f81090817cd85ff99ae819dca8abca734ba.exe	78
PID 580 wrote to memory of 1392	580	c59ba650ef8d7f564152821ce2e85f81090817cd85ff99ae819dca8abca734ba.exe	79
PID 580 wrote to memory of 1392	580	c59ba650ef8d7f564152821ce2e85f81090817cd85ff99ae819dca8abca734ba.exe	79
PID 580 wrote to memory of 1392	580	c59ba650ef8d7f564152821ce2e85f81090817cd85ff99ae819dca8abca734ba.exe	79
PID 1392 wrote to memory of 2724	1392	cmd.exe	81
PID 1392 wrote to memory of 2724	1392	cmd.exe	81
PID 1392 wrote to memory of 2724	1392	cmd.exe	81