qakbot | 24665d1e407ccd8022fd91ac89baaa48604aa0fed1882d399fb0aef9703df7f4

General

Target
24665d1e407ccd8022fd91ac89baaa48604aa0fed1882d399fb0aef9703df7f4.exe
Size 270KB
Sample201114-e2wn7svqh2
SHA256 24665d1e407ccd8022fd91ac89baaa48604aa0fed1882d399fb0aef9703df7f4
MD5 555cf29bece3b947355a012ba4510741
SHA1 e2289d9362f6ebf7c82cf4dc96649e185100fd07
SHA512 d1ae3984597a682f9581f93256b0e65be6a757d49ea28538fc82ca64542467b4268722242331d25665095b6acf5f7e5c72d091d0ce46739657c3e2a4f489624c
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	24665d1e407ccd8022fd91ac89baaa48604aa0fed1882d399fb0aef9703df7f4.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	24665d1e407ccd8022fd91ac89baaa48604aa0fed1882d399fb0aef9703df7f4.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	24665d1e407ccd8022fd91ac89baaa48604aa0fed1882d399fb0aef9703df7f4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	24665d1e407ccd8022fd91ac89baaa48604aa0fed1882d399fb0aef9703df7f4.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	24665d1e407ccd8022fd91ac89baaa48604aa0fed1882d399fb0aef9703df7f4.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	24665d1e407ccd8022fd91ac89baaa48604aa0fed1882d399fb0aef9703df7f4.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
8	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4048	24665d1e407ccd8022fd91ac89baaa48604aa0fed1882d399fb0aef9703df7f4.exe
4048	24665d1e407ccd8022fd91ac89baaa48604aa0fed1882d399fb0aef9703df7f4.exe
3884	24665d1e407ccd8022fd91ac89baaa48604aa0fed1882d399fb0aef9703df7f4.exe
3884	24665d1e407ccd8022fd91ac89baaa48604aa0fed1882d399fb0aef9703df7f4.exe
3884	24665d1e407ccd8022fd91ac89baaa48604aa0fed1882d399fb0aef9703df7f4.exe
3884	24665d1e407ccd8022fd91ac89baaa48604aa0fed1882d399fb0aef9703df7f4.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4048 wrote to memory of 3884	4048	24665d1e407ccd8022fd91ac89baaa48604aa0fed1882d399fb0aef9703df7f4.exe	78
PID 4048 wrote to memory of 3884	4048	24665d1e407ccd8022fd91ac89baaa48604aa0fed1882d399fb0aef9703df7f4.exe	78
PID 4048 wrote to memory of 3884	4048	24665d1e407ccd8022fd91ac89baaa48604aa0fed1882d399fb0aef9703df7f4.exe	78
PID 4048 wrote to memory of 3176	4048	24665d1e407ccd8022fd91ac89baaa48604aa0fed1882d399fb0aef9703df7f4.exe	79
PID 4048 wrote to memory of 3176	4048	24665d1e407ccd8022fd91ac89baaa48604aa0fed1882d399fb0aef9703df7f4.exe	79
PID 4048 wrote to memory of 3176	4048	24665d1e407ccd8022fd91ac89baaa48604aa0fed1882d399fb0aef9703df7f4.exe	79
PID 3176 wrote to memory of 8	3176	cmd.exe	81
PID 3176 wrote to memory of 8	3176	cmd.exe	81
PID 3176 wrote to memory of 8	3176	cmd.exe	81