qakbot | 602e3bb5ec0030f2cb578370bc0a8e5c50b1dbbe0cc5e2039aa804a76264e554

General

Target
602e3bb5ec0030f2cb578370bc0a8e5c50b1dbbe0cc5e2039aa804a76264e554.exe
Size 270KB
Sample201115-s35s2mapze
SHA256 602e3bb5ec0030f2cb578370bc0a8e5c50b1dbbe0cc5e2039aa804a76264e554
MD5 5337a99921e42f8f0f9fc847fc33b4a9
SHA1 a2818395b870b2b6e475f9cd01cfa1df03a0f7b5
SHA512 db2c9b21a69d29598f457192d54ed81275148420a0a143b771108aa4dc8994fa6b2be826af6d0f445745e2955fd7ea2d203b0b87db361b64e30ea92e5643c7c7
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	602e3bb5ec0030f2cb578370bc0a8e5c50b1dbbe0cc5e2039aa804a76264e554.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	602e3bb5ec0030f2cb578370bc0a8e5c50b1dbbe0cc5e2039aa804a76264e554.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	602e3bb5ec0030f2cb578370bc0a8e5c50b1dbbe0cc5e2039aa804a76264e554.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	602e3bb5ec0030f2cb578370bc0a8e5c50b1dbbe0cc5e2039aa804a76264e554.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	602e3bb5ec0030f2cb578370bc0a8e5c50b1dbbe0cc5e2039aa804a76264e554.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	602e3bb5ec0030f2cb578370bc0a8e5c50b1dbbe0cc5e2039aa804a76264e554.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
3636	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1036	602e3bb5ec0030f2cb578370bc0a8e5c50b1dbbe0cc5e2039aa804a76264e554.exe
1036	602e3bb5ec0030f2cb578370bc0a8e5c50b1dbbe0cc5e2039aa804a76264e554.exe
2236	602e3bb5ec0030f2cb578370bc0a8e5c50b1dbbe0cc5e2039aa804a76264e554.exe
2236	602e3bb5ec0030f2cb578370bc0a8e5c50b1dbbe0cc5e2039aa804a76264e554.exe
2236	602e3bb5ec0030f2cb578370bc0a8e5c50b1dbbe0cc5e2039aa804a76264e554.exe
2236	602e3bb5ec0030f2cb578370bc0a8e5c50b1dbbe0cc5e2039aa804a76264e554.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1036 wrote to memory of 2236	1036	602e3bb5ec0030f2cb578370bc0a8e5c50b1dbbe0cc5e2039aa804a76264e554.exe	79
PID 1036 wrote to memory of 2236	1036	602e3bb5ec0030f2cb578370bc0a8e5c50b1dbbe0cc5e2039aa804a76264e554.exe	79
PID 1036 wrote to memory of 2236	1036	602e3bb5ec0030f2cb578370bc0a8e5c50b1dbbe0cc5e2039aa804a76264e554.exe	79
PID 1036 wrote to memory of 1852	1036	602e3bb5ec0030f2cb578370bc0a8e5c50b1dbbe0cc5e2039aa804a76264e554.exe	80
PID 1036 wrote to memory of 1852	1036	602e3bb5ec0030f2cb578370bc0a8e5c50b1dbbe0cc5e2039aa804a76264e554.exe	80
PID 1036 wrote to memory of 1852	1036	602e3bb5ec0030f2cb578370bc0a8e5c50b1dbbe0cc5e2039aa804a76264e554.exe	80
PID 1852 wrote to memory of 3636	1852	cmd.exe	82
PID 1852 wrote to memory of 3636	1852	cmd.exe	82
PID 1852 wrote to memory of 3636	1852	cmd.exe	82