qakbot | a188e7eaa2d0626dbf0e9508bfb51ecdfba256d18ff82a58ebc823a2fa46e286

General

Target
a188e7eaa2d0626dbf0e9508bfb51ecdfba256d18ff82a58ebc823a2fa46e286.exe
Size 270KB
Sample201115-egnek895fs
SHA256 a188e7eaa2d0626dbf0e9508bfb51ecdfba256d18ff82a58ebc823a2fa46e286
MD5 a12ea980a0b50585848ad0114df544c8
SHA1 d08cf7be60b095638ca7356b881e65653b77fd3a
SHA512 a78e99aadbae1d758f9fedac7296bcf6c09f5a35f37031f126d880e46b0afc7bf2368cf089e1bdae82393f39190458eae59022bc7f54d663e3ca199fd439c750
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	a188e7eaa2d0626dbf0e9508bfb51ecdfba256d18ff82a58ebc823a2fa46e286.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	a188e7eaa2d0626dbf0e9508bfb51ecdfba256d18ff82a58ebc823a2fa46e286.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	a188e7eaa2d0626dbf0e9508bfb51ecdfba256d18ff82a58ebc823a2fa46e286.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	a188e7eaa2d0626dbf0e9508bfb51ecdfba256d18ff82a58ebc823a2fa46e286.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	a188e7eaa2d0626dbf0e9508bfb51ecdfba256d18ff82a58ebc823a2fa46e286.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	a188e7eaa2d0626dbf0e9508bfb51ecdfba256d18ff82a58ebc823a2fa46e286.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
752	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
796	a188e7eaa2d0626dbf0e9508bfb51ecdfba256d18ff82a58ebc823a2fa46e286.exe
796	a188e7eaa2d0626dbf0e9508bfb51ecdfba256d18ff82a58ebc823a2fa46e286.exe
2208	a188e7eaa2d0626dbf0e9508bfb51ecdfba256d18ff82a58ebc823a2fa46e286.exe
2208	a188e7eaa2d0626dbf0e9508bfb51ecdfba256d18ff82a58ebc823a2fa46e286.exe
2208	a188e7eaa2d0626dbf0e9508bfb51ecdfba256d18ff82a58ebc823a2fa46e286.exe
2208	a188e7eaa2d0626dbf0e9508bfb51ecdfba256d18ff82a58ebc823a2fa46e286.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 796 wrote to memory of 2208	796	a188e7eaa2d0626dbf0e9508bfb51ecdfba256d18ff82a58ebc823a2fa46e286.exe	78
PID 796 wrote to memory of 2208	796	a188e7eaa2d0626dbf0e9508bfb51ecdfba256d18ff82a58ebc823a2fa46e286.exe	78
PID 796 wrote to memory of 2208	796	a188e7eaa2d0626dbf0e9508bfb51ecdfba256d18ff82a58ebc823a2fa46e286.exe	78
PID 796 wrote to memory of 2848	796	a188e7eaa2d0626dbf0e9508bfb51ecdfba256d18ff82a58ebc823a2fa46e286.exe	79
PID 796 wrote to memory of 2848	796	a188e7eaa2d0626dbf0e9508bfb51ecdfba256d18ff82a58ebc823a2fa46e286.exe	79
PID 796 wrote to memory of 2848	796	a188e7eaa2d0626dbf0e9508bfb51ecdfba256d18ff82a58ebc823a2fa46e286.exe	79
PID 2848 wrote to memory of 752	2848	cmd.exe	81
PID 2848 wrote to memory of 752	2848	cmd.exe	81
PID 2848 wrote to memory of 752	2848	cmd.exe	81