qakbot | abe11f2865d00713d06abfc9c989e5dfbf9736b22470d4ba8440d7bc387d103d

General

Target
abe11f2865d00713d06abfc9c989e5dfbf9736b22470d4ba8440d7bc387d103d.exe
Size 270KB
Sample201114-1q3slede7x
SHA256 abe11f2865d00713d06abfc9c989e5dfbf9736b22470d4ba8440d7bc387d103d
MD5 9cd8f13513676f44b3f1251c1122f567
SHA1 610347138e3373d6b2408d5d640e2c95f41f1d45
SHA512 d78a0f58cae03d7e5940c398a5bcf4f9fcee49c8d2cf8340420a8de3e4830eaac3017626bae869a922c84c05ceb7fae2934430d7e738c80e3df0eb74db60309d
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	abe11f2865d00713d06abfc9c989e5dfbf9736b22470d4ba8440d7bc387d103d.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	abe11f2865d00713d06abfc9c989e5dfbf9736b22470d4ba8440d7bc387d103d.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	abe11f2865d00713d06abfc9c989e5dfbf9736b22470d4ba8440d7bc387d103d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	abe11f2865d00713d06abfc9c989e5dfbf9736b22470d4ba8440d7bc387d103d.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	abe11f2865d00713d06abfc9c989e5dfbf9736b22470d4ba8440d7bc387d103d.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	abe11f2865d00713d06abfc9c989e5dfbf9736b22470d4ba8440d7bc387d103d.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
2428	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3980	abe11f2865d00713d06abfc9c989e5dfbf9736b22470d4ba8440d7bc387d103d.exe
3980	abe11f2865d00713d06abfc9c989e5dfbf9736b22470d4ba8440d7bc387d103d.exe
2888	abe11f2865d00713d06abfc9c989e5dfbf9736b22470d4ba8440d7bc387d103d.exe
2888	abe11f2865d00713d06abfc9c989e5dfbf9736b22470d4ba8440d7bc387d103d.exe
2888	abe11f2865d00713d06abfc9c989e5dfbf9736b22470d4ba8440d7bc387d103d.exe
2888	abe11f2865d00713d06abfc9c989e5dfbf9736b22470d4ba8440d7bc387d103d.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3980 wrote to memory of 2888	3980	abe11f2865d00713d06abfc9c989e5dfbf9736b22470d4ba8440d7bc387d103d.exe	79
PID 3980 wrote to memory of 2888	3980	abe11f2865d00713d06abfc9c989e5dfbf9736b22470d4ba8440d7bc387d103d.exe	79
PID 3980 wrote to memory of 2888	3980	abe11f2865d00713d06abfc9c989e5dfbf9736b22470d4ba8440d7bc387d103d.exe	79
PID 3980 wrote to memory of 1504	3980	abe11f2865d00713d06abfc9c989e5dfbf9736b22470d4ba8440d7bc387d103d.exe	80
PID 3980 wrote to memory of 1504	3980	abe11f2865d00713d06abfc9c989e5dfbf9736b22470d4ba8440d7bc387d103d.exe	80
PID 3980 wrote to memory of 1504	3980	abe11f2865d00713d06abfc9c989e5dfbf9736b22470d4ba8440d7bc387d103d.exe	80
PID 1504 wrote to memory of 2428	1504	cmd.exe	82
PID 1504 wrote to memory of 2428	1504	cmd.exe	82
PID 1504 wrote to memory of 2428	1504	cmd.exe	82