qakbot | cc21d7b59d8d36a5f2e5af127468ff7eeb37d6a331b36e1b62db260d920a811f

General

Target
cc21d7b59d8d36a5f2e5af127468ff7eeb37d6a331b36e1b62db260d920a811f.exe
Size 270KB
Sample201112-6d648jl5kx
SHA256 cc21d7b59d8d36a5f2e5af127468ff7eeb37d6a331b36e1b62db260d920a811f
MD5 5b1de5178428b494571b7c61f8b08d31
SHA1 a0b3749fbf948581abbfc05404c749a235dfd4b4
SHA512 7dee7778b3fd8cd03ddb5c2aa7ace2188dab994105da3ac89b5d1367122ffc2a8e2862d3d9a9c9ab10f0f3fb972e70e0c799037a834c56b2284be73cfb51b018
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	cc21d7b59d8d36a5f2e5af127468ff7eeb37d6a331b36e1b62db260d920a811f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	cc21d7b59d8d36a5f2e5af127468ff7eeb37d6a331b36e1b62db260d920a811f.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	cc21d7b59d8d36a5f2e5af127468ff7eeb37d6a331b36e1b62db260d920a811f.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	cc21d7b59d8d36a5f2e5af127468ff7eeb37d6a331b36e1b62db260d920a811f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	cc21d7b59d8d36a5f2e5af127468ff7eeb37d6a331b36e1b62db260d920a811f.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	cc21d7b59d8d36a5f2e5af127468ff7eeb37d6a331b36e1b62db260d920a811f.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
1196	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
728	cc21d7b59d8d36a5f2e5af127468ff7eeb37d6a331b36e1b62db260d920a811f.exe
728	cc21d7b59d8d36a5f2e5af127468ff7eeb37d6a331b36e1b62db260d920a811f.exe
3604	cc21d7b59d8d36a5f2e5af127468ff7eeb37d6a331b36e1b62db260d920a811f.exe
3604	cc21d7b59d8d36a5f2e5af127468ff7eeb37d6a331b36e1b62db260d920a811f.exe
3604	cc21d7b59d8d36a5f2e5af127468ff7eeb37d6a331b36e1b62db260d920a811f.exe
3604	cc21d7b59d8d36a5f2e5af127468ff7eeb37d6a331b36e1b62db260d920a811f.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 728 wrote to memory of 3604	728	cc21d7b59d8d36a5f2e5af127468ff7eeb37d6a331b36e1b62db260d920a811f.exe	78
PID 728 wrote to memory of 3604	728	cc21d7b59d8d36a5f2e5af127468ff7eeb37d6a331b36e1b62db260d920a811f.exe	78
PID 728 wrote to memory of 3604	728	cc21d7b59d8d36a5f2e5af127468ff7eeb37d6a331b36e1b62db260d920a811f.exe	78
PID 728 wrote to memory of 2628	728	cc21d7b59d8d36a5f2e5af127468ff7eeb37d6a331b36e1b62db260d920a811f.exe	79
PID 728 wrote to memory of 2628	728	cc21d7b59d8d36a5f2e5af127468ff7eeb37d6a331b36e1b62db260d920a811f.exe	79
PID 728 wrote to memory of 2628	728	cc21d7b59d8d36a5f2e5af127468ff7eeb37d6a331b36e1b62db260d920a811f.exe	79
PID 2628 wrote to memory of 1196	2628	cmd.exe	81
PID 2628 wrote to memory of 1196	2628	cmd.exe	81
PID 2628 wrote to memory of 1196	2628	cmd.exe	81