qakbot | cc41b210a03dfc8b30515a1a7c86853541af2776defc2d2fce59efe53b2fe755

General

Target
cc41b210a03dfc8b30515a1a7c86853541af2776defc2d2fce59efe53b2fe755.exe
Size 270KB
Sample201111-mvd6jffj3n
SHA256 cc41b210a03dfc8b30515a1a7c86853541af2776defc2d2fce59efe53b2fe755
MD5 4195bd45e77a9f90d801622ddd60b139
SHA1 500aba9073e1dd35a9c86415a7027bf4f54259aa
SHA512 08c41f6498353f283ada66a03eb444512cc21976651360e4fe6b8eedcecc95c52e516f0f9b1f10d3781b65f17e91c93b9e31afe5bd2defba1179dd778e5540a2
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	cc41b210a03dfc8b30515a1a7c86853541af2776defc2d2fce59efe53b2fe755.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	cc41b210a03dfc8b30515a1a7c86853541af2776defc2d2fce59efe53b2fe755.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	cc41b210a03dfc8b30515a1a7c86853541af2776defc2d2fce59efe53b2fe755.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	cc41b210a03dfc8b30515a1a7c86853541af2776defc2d2fce59efe53b2fe755.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	cc41b210a03dfc8b30515a1a7c86853541af2776defc2d2fce59efe53b2fe755.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	cc41b210a03dfc8b30515a1a7c86853541af2776defc2d2fce59efe53b2fe755.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
1288	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3968	cc41b210a03dfc8b30515a1a7c86853541af2776defc2d2fce59efe53b2fe755.exe
3968	cc41b210a03dfc8b30515a1a7c86853541af2776defc2d2fce59efe53b2fe755.exe
3684	cc41b210a03dfc8b30515a1a7c86853541af2776defc2d2fce59efe53b2fe755.exe
3684	cc41b210a03dfc8b30515a1a7c86853541af2776defc2d2fce59efe53b2fe755.exe
3684	cc41b210a03dfc8b30515a1a7c86853541af2776defc2d2fce59efe53b2fe755.exe
3684	cc41b210a03dfc8b30515a1a7c86853541af2776defc2d2fce59efe53b2fe755.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3968 wrote to memory of 3684	3968	cc41b210a03dfc8b30515a1a7c86853541af2776defc2d2fce59efe53b2fe755.exe	79
PID 3968 wrote to memory of 3684	3968	cc41b210a03dfc8b30515a1a7c86853541af2776defc2d2fce59efe53b2fe755.exe	79
PID 3968 wrote to memory of 3684	3968	cc41b210a03dfc8b30515a1a7c86853541af2776defc2d2fce59efe53b2fe755.exe	79
PID 3968 wrote to memory of 2248	3968	cc41b210a03dfc8b30515a1a7c86853541af2776defc2d2fce59efe53b2fe755.exe	80
PID 3968 wrote to memory of 2248	3968	cc41b210a03dfc8b30515a1a7c86853541af2776defc2d2fce59efe53b2fe755.exe	80
PID 3968 wrote to memory of 2248	3968	cc41b210a03dfc8b30515a1a7c86853541af2776defc2d2fce59efe53b2fe755.exe	80
PID 2248 wrote to memory of 1288	2248	cmd.exe	82
PID 2248 wrote to memory of 1288	2248	cmd.exe	82
PID 2248 wrote to memory of 1288	2248	cmd.exe	82