qakbot | c4037fed8c34a7e493cc90780c19fd03a56c091dec4be745786da55f62d5c826

General

Target
c4037fed8c34a7e493cc90780c19fd03a56c091dec4be745786da55f62d5c826.exe
Size 270KB
Sample201110-ypt2zpr9s6
SHA256 c4037fed8c34a7e493cc90780c19fd03a56c091dec4be745786da55f62d5c826
MD5 01d298780b99947e4b3cf852a12cda87
SHA1 77481ca08992a4874de02ba1c73008d30f90027e
SHA512 556260bc5a95ba9840ca946ab2fe222d4e8a2cf114614bddee0be074fac01c2b2da692bb900c412b9b59f1fe00202211316df3f9452c722e82e8f6a3b0e99389
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	c4037fed8c34a7e493cc90780c19fd03a56c091dec4be745786da55f62d5c826.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	c4037fed8c34a7e493cc90780c19fd03a56c091dec4be745786da55f62d5c826.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	c4037fed8c34a7e493cc90780c19fd03a56c091dec4be745786da55f62d5c826.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	c4037fed8c34a7e493cc90780c19fd03a56c091dec4be745786da55f62d5c826.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	c4037fed8c34a7e493cc90780c19fd03a56c091dec4be745786da55f62d5c826.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	c4037fed8c34a7e493cc90780c19fd03a56c091dec4be745786da55f62d5c826.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
3484	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2724	c4037fed8c34a7e493cc90780c19fd03a56c091dec4be745786da55f62d5c826.exe
2724	c4037fed8c34a7e493cc90780c19fd03a56c091dec4be745786da55f62d5c826.exe
2712	c4037fed8c34a7e493cc90780c19fd03a56c091dec4be745786da55f62d5c826.exe
2712	c4037fed8c34a7e493cc90780c19fd03a56c091dec4be745786da55f62d5c826.exe
2712	c4037fed8c34a7e493cc90780c19fd03a56c091dec4be745786da55f62d5c826.exe
2712	c4037fed8c34a7e493cc90780c19fd03a56c091dec4be745786da55f62d5c826.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2724 wrote to memory of 2712	2724	c4037fed8c34a7e493cc90780c19fd03a56c091dec4be745786da55f62d5c826.exe	78
PID 2724 wrote to memory of 2712	2724	c4037fed8c34a7e493cc90780c19fd03a56c091dec4be745786da55f62d5c826.exe	78
PID 2724 wrote to memory of 2712	2724	c4037fed8c34a7e493cc90780c19fd03a56c091dec4be745786da55f62d5c826.exe	78
PID 2724 wrote to memory of 2504	2724	c4037fed8c34a7e493cc90780c19fd03a56c091dec4be745786da55f62d5c826.exe	79
PID 2724 wrote to memory of 2504	2724	c4037fed8c34a7e493cc90780c19fd03a56c091dec4be745786da55f62d5c826.exe	79
PID 2724 wrote to memory of 2504	2724	c4037fed8c34a7e493cc90780c19fd03a56c091dec4be745786da55f62d5c826.exe	79
PID 2504 wrote to memory of 3484	2504	cmd.exe	81
PID 2504 wrote to memory of 3484	2504	cmd.exe	81
PID 2504 wrote to memory of 3484	2504	cmd.exe	81