qakbot | dba559e14645fcb6b2a807751b4975b7fdfb0f9c9ea940e32a6359dfd9347fcd

General

Target
dba559e14645fcb6b2a807751b4975b7fdfb0f9c9ea940e32a6359dfd9347fcd.exe
Size 270KB
Sample201112-5yjymj4ncj
SHA256 dba559e14645fcb6b2a807751b4975b7fdfb0f9c9ea940e32a6359dfd9347fcd
MD5 7a2afc7fe4da94cb3c9cb49701210ae6
SHA1 f7c215fa62fe09998b71c4b38aab915d5fa28f7b
SHA512 9fc8ff25831df60ec3d13d7561692fc7934ceb4b85c9c95a7e10095d52bd601cf441533cdaa3d6a900f31c83ed18991fbfa76fc8377c360b86d1cfb585a2bc9a
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	dba559e14645fcb6b2a807751b4975b7fdfb0f9c9ea940e32a6359dfd9347fcd.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	dba559e14645fcb6b2a807751b4975b7fdfb0f9c9ea940e32a6359dfd9347fcd.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	dba559e14645fcb6b2a807751b4975b7fdfb0f9c9ea940e32a6359dfd9347fcd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	dba559e14645fcb6b2a807751b4975b7fdfb0f9c9ea940e32a6359dfd9347fcd.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	dba559e14645fcb6b2a807751b4975b7fdfb0f9c9ea940e32a6359dfd9347fcd.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	dba559e14645fcb6b2a807751b4975b7fdfb0f9c9ea940e32a6359dfd9347fcd.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
3172	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3976	dba559e14645fcb6b2a807751b4975b7fdfb0f9c9ea940e32a6359dfd9347fcd.exe
3976	dba559e14645fcb6b2a807751b4975b7fdfb0f9c9ea940e32a6359dfd9347fcd.exe
2964	dba559e14645fcb6b2a807751b4975b7fdfb0f9c9ea940e32a6359dfd9347fcd.exe
2964	dba559e14645fcb6b2a807751b4975b7fdfb0f9c9ea940e32a6359dfd9347fcd.exe
2964	dba559e14645fcb6b2a807751b4975b7fdfb0f9c9ea940e32a6359dfd9347fcd.exe
2964	dba559e14645fcb6b2a807751b4975b7fdfb0f9c9ea940e32a6359dfd9347fcd.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3976 wrote to memory of 2964	3976	dba559e14645fcb6b2a807751b4975b7fdfb0f9c9ea940e32a6359dfd9347fcd.exe	79
PID 3976 wrote to memory of 2964	3976	dba559e14645fcb6b2a807751b4975b7fdfb0f9c9ea940e32a6359dfd9347fcd.exe	79
PID 3976 wrote to memory of 2964	3976	dba559e14645fcb6b2a807751b4975b7fdfb0f9c9ea940e32a6359dfd9347fcd.exe	79
PID 3976 wrote to memory of 3980	3976	dba559e14645fcb6b2a807751b4975b7fdfb0f9c9ea940e32a6359dfd9347fcd.exe	80
PID 3976 wrote to memory of 3980	3976	dba559e14645fcb6b2a807751b4975b7fdfb0f9c9ea940e32a6359dfd9347fcd.exe	80
PID 3976 wrote to memory of 3980	3976	dba559e14645fcb6b2a807751b4975b7fdfb0f9c9ea940e32a6359dfd9347fcd.exe	80
PID 3980 wrote to memory of 3172	3980	cmd.exe	82
PID 3980 wrote to memory of 3172	3980	cmd.exe	82
PID 3980 wrote to memory of 3172	3980	cmd.exe	82