qakbot | 7de12321d922b395a66a8df71ab11ec53ae3790a401a1237994dc09c3375d149

General

Target
7de12321d922b395a66a8df71ab11ec53ae3790a401a1237994dc09c3375d149.exe
Size 270KB
Sample201113-xe4pgkqsxx
SHA256 7de12321d922b395a66a8df71ab11ec53ae3790a401a1237994dc09c3375d149
MD5 7b8e5fd56c5542b9b723298fd9eae613
SHA1 d01cec4db2b3203f5d84ce0c2d1e06fbc670f675
SHA512 e0a55828e1d7e45626a71f21731f9eb9c90eda4c124e1fd5f61e56403c16d2f121f40ede94179178b63eba41ae6bb34bde26127382f3c34673f278dd5ea91c3f
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	7de12321d922b395a66a8df71ab11ec53ae3790a401a1237994dc09c3375d149.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	7de12321d922b395a66a8df71ab11ec53ae3790a401a1237994dc09c3375d149.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	7de12321d922b395a66a8df71ab11ec53ae3790a401a1237994dc09c3375d149.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	7de12321d922b395a66a8df71ab11ec53ae3790a401a1237994dc09c3375d149.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	7de12321d922b395a66a8df71ab11ec53ae3790a401a1237994dc09c3375d149.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	7de12321d922b395a66a8df71ab11ec53ae3790a401a1237994dc09c3375d149.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
1320	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 744 wrote to memory of 756	744	7de12321d922b395a66a8df71ab11ec53ae3790a401a1237994dc09c3375d149.exe	79
PID 744 wrote to memory of 756	744	7de12321d922b395a66a8df71ab11ec53ae3790a401a1237994dc09c3375d149.exe	79
PID 744 wrote to memory of 756	744	7de12321d922b395a66a8df71ab11ec53ae3790a401a1237994dc09c3375d149.exe	79
PID 744 wrote to memory of 1268	744	7de12321d922b395a66a8df71ab11ec53ae3790a401a1237994dc09c3375d149.exe	80
PID 744 wrote to memory of 1268	744	7de12321d922b395a66a8df71ab11ec53ae3790a401a1237994dc09c3375d149.exe	80
PID 744 wrote to memory of 1268	744	7de12321d922b395a66a8df71ab11ec53ae3790a401a1237994dc09c3375d149.exe	80
PID 1268 wrote to memory of 1320	1268	cmd.exe	82
PID 1268 wrote to memory of 1320	1268	cmd.exe	82
PID 1268 wrote to memory of 1320	1268	cmd.exe	82