qakbot | 972fb4092f04ba1bbdc82d137f36ac43bcc66375fa3d6dabf33197e61c8ff9d8

General

Target
972fb4092f04ba1bbdc82d137f36ac43bcc66375fa3d6dabf33197e61c8ff9d8.exe
Size 257KB
Sample201110-6pa71dss8e
SHA256 972fb4092f04ba1bbdc82d137f36ac43bcc66375fa3d6dabf33197e61c8ff9d8
MD5 d60dfb70d88f04ac05791588cfb70e7f
SHA1 9ef08c1888f352ca259b67062dd44b8211954aee
SHA512 477f9db2ccc7e52c5c00817eb71981f9705887013264a19de187f75bca2999fdf78ccc817e479383f0f1187dbc5178917786ebf674dc6a04a65ffbf595697350
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	972fb4092f04ba1bbdc82d137f36ac43bcc66375fa3d6dabf33197e61c8ff9d8.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	972fb4092f04ba1bbdc82d137f36ac43bcc66375fa3d6dabf33197e61c8ff9d8.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	972fb4092f04ba1bbdc82d137f36ac43bcc66375fa3d6dabf33197e61c8ff9d8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	972fb4092f04ba1bbdc82d137f36ac43bcc66375fa3d6dabf33197e61c8ff9d8.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	972fb4092f04ba1bbdc82d137f36ac43bcc66375fa3d6dabf33197e61c8ff9d8.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	972fb4092f04ba1bbdc82d137f36ac43bcc66375fa3d6dabf33197e61c8ff9d8.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
3176	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4684	972fb4092f04ba1bbdc82d137f36ac43bcc66375fa3d6dabf33197e61c8ff9d8.exe
4684	972fb4092f04ba1bbdc82d137f36ac43bcc66375fa3d6dabf33197e61c8ff9d8.exe
3280	972fb4092f04ba1bbdc82d137f36ac43bcc66375fa3d6dabf33197e61c8ff9d8.exe
3280	972fb4092f04ba1bbdc82d137f36ac43bcc66375fa3d6dabf33197e61c8ff9d8.exe
3280	972fb4092f04ba1bbdc82d137f36ac43bcc66375fa3d6dabf33197e61c8ff9d8.exe
3280	972fb4092f04ba1bbdc82d137f36ac43bcc66375fa3d6dabf33197e61c8ff9d8.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4684 wrote to memory of 3280	4684	972fb4092f04ba1bbdc82d137f36ac43bcc66375fa3d6dabf33197e61c8ff9d8.exe	78
PID 4684 wrote to memory of 3280	4684	972fb4092f04ba1bbdc82d137f36ac43bcc66375fa3d6dabf33197e61c8ff9d8.exe	78
PID 4684 wrote to memory of 3280	4684	972fb4092f04ba1bbdc82d137f36ac43bcc66375fa3d6dabf33197e61c8ff9d8.exe	78
PID 4684 wrote to memory of 3892	4684	972fb4092f04ba1bbdc82d137f36ac43bcc66375fa3d6dabf33197e61c8ff9d8.exe	79
PID 4684 wrote to memory of 3892	4684	972fb4092f04ba1bbdc82d137f36ac43bcc66375fa3d6dabf33197e61c8ff9d8.exe	79
PID 4684 wrote to memory of 3892	4684	972fb4092f04ba1bbdc82d137f36ac43bcc66375fa3d6dabf33197e61c8ff9d8.exe	79
PID 3892 wrote to memory of 3176	3892	cmd.exe	81
PID 3892 wrote to memory of 3176	3892	cmd.exe	81
PID 3892 wrote to memory of 3176	3892	cmd.exe	81