qakbot | 6ca8c7e8acaec97b05aa175a11e2e474621706a320eca4b1b0096d6a150c162c

General

Target
6ca8c7e8acaec97b05aa175a11e2e474621706a320eca4b1b0096d6a150c162c.exe
Size 265KB
Sample201110-46jw72xccj
SHA256 6ca8c7e8acaec97b05aa175a11e2e474621706a320eca4b1b0096d6a150c162c
MD5 21494f5e3d02e15bdcc09f5777520d71
SHA1 84bf3b6cbfb862946a0afc7613cd5a9f96eb650e
SHA512 27d621ef96b4053ce5e560a6e5b36791639208cf048e3806110b8a3ecb274c2221ac3a7b4749f0bab56bc146d1fcd962a65f1550c465077eb0cc7281e83baafe
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	6ca8c7e8acaec97b05aa175a11e2e474621706a320eca4b1b0096d6a150c162c.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	6ca8c7e8acaec97b05aa175a11e2e474621706a320eca4b1b0096d6a150c162c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	6ca8c7e8acaec97b05aa175a11e2e474621706a320eca4b1b0096d6a150c162c.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	6ca8c7e8acaec97b05aa175a11e2e474621706a320eca4b1b0096d6a150c162c.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	6ca8c7e8acaec97b05aa175a11e2e474621706a320eca4b1b0096d6a150c162c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	6ca8c7e8acaec97b05aa175a11e2e474621706a320eca4b1b0096d6a150c162c.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
3576	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3284	6ca8c7e8acaec97b05aa175a11e2e474621706a320eca4b1b0096d6a150c162c.exe
3284	6ca8c7e8acaec97b05aa175a11e2e474621706a320eca4b1b0096d6a150c162c.exe
184	6ca8c7e8acaec97b05aa175a11e2e474621706a320eca4b1b0096d6a150c162c.exe
184	6ca8c7e8acaec97b05aa175a11e2e474621706a320eca4b1b0096d6a150c162c.exe
184	6ca8c7e8acaec97b05aa175a11e2e474621706a320eca4b1b0096d6a150c162c.exe
184	6ca8c7e8acaec97b05aa175a11e2e474621706a320eca4b1b0096d6a150c162c.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3284 wrote to memory of 184	3284	6ca8c7e8acaec97b05aa175a11e2e474621706a320eca4b1b0096d6a150c162c.exe	78
PID 3284 wrote to memory of 184	3284	6ca8c7e8acaec97b05aa175a11e2e474621706a320eca4b1b0096d6a150c162c.exe	78
PID 3284 wrote to memory of 184	3284	6ca8c7e8acaec97b05aa175a11e2e474621706a320eca4b1b0096d6a150c162c.exe	78
PID 3284 wrote to memory of 1064	3284	6ca8c7e8acaec97b05aa175a11e2e474621706a320eca4b1b0096d6a150c162c.exe	79
PID 3284 wrote to memory of 1064	3284	6ca8c7e8acaec97b05aa175a11e2e474621706a320eca4b1b0096d6a150c162c.exe	79
PID 3284 wrote to memory of 1064	3284	6ca8c7e8acaec97b05aa175a11e2e474621706a320eca4b1b0096d6a150c162c.exe	79
PID 1064 wrote to memory of 3576	1064	cmd.exe	81
PID 1064 wrote to memory of 3576	1064	cmd.exe	81
PID 1064 wrote to memory of 3576	1064	cmd.exe	81