qakbot | e7cf480cec54bc49f94c8404ed14822d3d4eee3fd978d01b2aec1c0482b6532b

General

Target
e7cf480cec54bc49f94c8404ed14822d3d4eee3fd978d01b2aec1c0482b6532b.exe
Size 270KB
Sample201114-d8ksw8m7rx
SHA256 e7cf480cec54bc49f94c8404ed14822d3d4eee3fd978d01b2aec1c0482b6532b
MD5 ab0abb66ad6cb4daa092ce68a10676e1
SHA1 1c845297e71c58bfb8a5ce2da27d7940801b4e7d
SHA512 8467a324b1d430244aa81cd2b94490476a546c62564ecad6f068b33d9bc76421dd27111139ce11bb7b4209c06729e176fb47ee3236cf7588bc6b51ca49d803cb
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	e7cf480cec54bc49f94c8404ed14822d3d4eee3fd978d01b2aec1c0482b6532b.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	e7cf480cec54bc49f94c8404ed14822d3d4eee3fd978d01b2aec1c0482b6532b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	e7cf480cec54bc49f94c8404ed14822d3d4eee3fd978d01b2aec1c0482b6532b.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	e7cf480cec54bc49f94c8404ed14822d3d4eee3fd978d01b2aec1c0482b6532b.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	e7cf480cec54bc49f94c8404ed14822d3d4eee3fd978d01b2aec1c0482b6532b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	e7cf480cec54bc49f94c8404ed14822d3d4eee3fd978d01b2aec1c0482b6532b.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
3512	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3932	e7cf480cec54bc49f94c8404ed14822d3d4eee3fd978d01b2aec1c0482b6532b.exe
3932	e7cf480cec54bc49f94c8404ed14822d3d4eee3fd978d01b2aec1c0482b6532b.exe
188	e7cf480cec54bc49f94c8404ed14822d3d4eee3fd978d01b2aec1c0482b6532b.exe
188	e7cf480cec54bc49f94c8404ed14822d3d4eee3fd978d01b2aec1c0482b6532b.exe
188	e7cf480cec54bc49f94c8404ed14822d3d4eee3fd978d01b2aec1c0482b6532b.exe
188	e7cf480cec54bc49f94c8404ed14822d3d4eee3fd978d01b2aec1c0482b6532b.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3932 wrote to memory of 188	3932	e7cf480cec54bc49f94c8404ed14822d3d4eee3fd978d01b2aec1c0482b6532b.exe	78
PID 3932 wrote to memory of 188	3932	e7cf480cec54bc49f94c8404ed14822d3d4eee3fd978d01b2aec1c0482b6532b.exe	78
PID 3932 wrote to memory of 188	3932	e7cf480cec54bc49f94c8404ed14822d3d4eee3fd978d01b2aec1c0482b6532b.exe	78
PID 3932 wrote to memory of 3736	3932	e7cf480cec54bc49f94c8404ed14822d3d4eee3fd978d01b2aec1c0482b6532b.exe	79
PID 3932 wrote to memory of 3736	3932	e7cf480cec54bc49f94c8404ed14822d3d4eee3fd978d01b2aec1c0482b6532b.exe	79
PID 3932 wrote to memory of 3736	3932	e7cf480cec54bc49f94c8404ed14822d3d4eee3fd978d01b2aec1c0482b6532b.exe	79
PID 3736 wrote to memory of 3512	3736	cmd.exe	81
PID 3736 wrote to memory of 3512	3736	cmd.exe	81
PID 3736 wrote to memory of 3512	3736	cmd.exe	81