qakbot | a496166b093b8b09a59f952e7a9a2196aa7754dd3485b4412ec0334cd59714a3

General

Target
a496166b093b8b09a59f952e7a9a2196aa7754dd3485b4412ec0334cd59714a3.exe
Size 339KB
Sample201106-jmjk2gnbhe
SHA256 a496166b093b8b09a59f952e7a9a2196aa7754dd3485b4412ec0334cd59714a3
MD5 56a7ace0b1044299be1934f68b87dbd5
SHA1 273a90149bf7f28bafcdaa63bd69ef30c2290819
SHA512 6c2e37837389ed8f80100c83baa76e1e3dfab113fe11c20fc9543faa13e1eb90e44a4ec66099318bfefcba82b03f90cb11cfbe563f181edfade7c26082c781d1
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	a496166b093b8b09a59f952e7a9a2196aa7754dd3485b4412ec0334cd59714a3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	a496166b093b8b09a59f952e7a9a2196aa7754dd3485b4412ec0334cd59714a3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	a496166b093b8b09a59f952e7a9a2196aa7754dd3485b4412ec0334cd59714a3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	a496166b093b8b09a59f952e7a9a2196aa7754dd3485b4412ec0334cd59714a3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	a496166b093b8b09a59f952e7a9a2196aa7754dd3485b4412ec0334cd59714a3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	a496166b093b8b09a59f952e7a9a2196aa7754dd3485b4412ec0334cd59714a3.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
1888	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3408 wrote to memory of 4024	3408	a496166b093b8b09a59f952e7a9a2196aa7754dd3485b4412ec0334cd59714a3.exe	76
PID 3408 wrote to memory of 4024	3408	a496166b093b8b09a59f952e7a9a2196aa7754dd3485b4412ec0334cd59714a3.exe	76
PID 3408 wrote to memory of 4024	3408	a496166b093b8b09a59f952e7a9a2196aa7754dd3485b4412ec0334cd59714a3.exe	76
PID 3408 wrote to memory of 4044	3408	a496166b093b8b09a59f952e7a9a2196aa7754dd3485b4412ec0334cd59714a3.exe	80
PID 3408 wrote to memory of 4044	3408	a496166b093b8b09a59f952e7a9a2196aa7754dd3485b4412ec0334cd59714a3.exe	80
PID 3408 wrote to memory of 4044	3408	a496166b093b8b09a59f952e7a9a2196aa7754dd3485b4412ec0334cd59714a3.exe	80
PID 4044 wrote to memory of 1888	4044	cmd.exe	82
PID 4044 wrote to memory of 1888	4044	cmd.exe	82
PID 4044 wrote to memory of 1888	4044	cmd.exe	82