qakbot | 42d893342fa7ddf828c4c2ec81641fd5361c4684d981c8a261df78d55422745b

General

Target
42d893342fa7ddf828c4c2ec81641fd5361c4684d981c8a261df78d55422745b.exe
Size 270KB
Sample201111-s8y7g5pw4e
SHA256 42d893342fa7ddf828c4c2ec81641fd5361c4684d981c8a261df78d55422745b
MD5 698df80a079a46ac726f90d26c52cf1b
SHA1 82a580b3b49107daeb0a993bb8135690a1728723
SHA512 22ec2087d5c5a48fa55737087c050f4900755747a270a85e9e72b86c9887687eafa4691717921e64804a844ea3f8865e29095f55cffb4944956156afaf577f49
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	42d893342fa7ddf828c4c2ec81641fd5361c4684d981c8a261df78d55422745b.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	42d893342fa7ddf828c4c2ec81641fd5361c4684d981c8a261df78d55422745b.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	42d893342fa7ddf828c4c2ec81641fd5361c4684d981c8a261df78d55422745b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	42d893342fa7ddf828c4c2ec81641fd5361c4684d981c8a261df78d55422745b.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	42d893342fa7ddf828c4c2ec81641fd5361c4684d981c8a261df78d55422745b.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	42d893342fa7ddf828c4c2ec81641fd5361c4684d981c8a261df78d55422745b.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
2292	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3272 wrote to memory of 2976	3272	42d893342fa7ddf828c4c2ec81641fd5361c4684d981c8a261df78d55422745b.exe	78
PID 3272 wrote to memory of 2976	3272	42d893342fa7ddf828c4c2ec81641fd5361c4684d981c8a261df78d55422745b.exe	78
PID 3272 wrote to memory of 2976	3272	42d893342fa7ddf828c4c2ec81641fd5361c4684d981c8a261df78d55422745b.exe	78
PID 3272 wrote to memory of 192	3272	42d893342fa7ddf828c4c2ec81641fd5361c4684d981c8a261df78d55422745b.exe	79
PID 3272 wrote to memory of 192	3272	42d893342fa7ddf828c4c2ec81641fd5361c4684d981c8a261df78d55422745b.exe	79
PID 3272 wrote to memory of 192	3272	42d893342fa7ddf828c4c2ec81641fd5361c4684d981c8a261df78d55422745b.exe	79
PID 192 wrote to memory of 2292	192	cmd.exe	81
PID 192 wrote to memory of 2292	192	cmd.exe	81
PID 192 wrote to memory of 2292	192	cmd.exe	81