qakbot | 36df136289e908fb4f37de40e48fddeee60136acf1e4cee7fa5f9f008dd894e1

General

Target
36df136289e908fb4f37de40e48fddeee60136acf1e4cee7fa5f9f008dd894e1.exe
Size 254KB
Sample201112-a7a6v5ymd2
SHA256 36df136289e908fb4f37de40e48fddeee60136acf1e4cee7fa5f9f008dd894e1
MD5 7399393f29a1417a5ce175c142ce1eed
SHA1 8ff543e5ec3b3ca54e545cf7a256554110053b39
SHA512 95e18637a69b900c844f3b92f080d2530f62d8a2ec18a9b585e5bb35ba54b8681453c5dddb45d8d860c576469157d205baec8febc0e40d9bcf7730b635cf6202
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	36df136289e908fb4f37de40e48fddeee60136acf1e4cee7fa5f9f008dd894e1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	36df136289e908fb4f37de40e48fddeee60136acf1e4cee7fa5f9f008dd894e1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	36df136289e908fb4f37de40e48fddeee60136acf1e4cee7fa5f9f008dd894e1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	36df136289e908fb4f37de40e48fddeee60136acf1e4cee7fa5f9f008dd894e1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	36df136289e908fb4f37de40e48fddeee60136acf1e4cee7fa5f9f008dd894e1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	36df136289e908fb4f37de40e48fddeee60136acf1e4cee7fa5f9f008dd894e1.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
644	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4760	36df136289e908fb4f37de40e48fddeee60136acf1e4cee7fa5f9f008dd894e1.exe
4760	36df136289e908fb4f37de40e48fddeee60136acf1e4cee7fa5f9f008dd894e1.exe
4208	36df136289e908fb4f37de40e48fddeee60136acf1e4cee7fa5f9f008dd894e1.exe
4208	36df136289e908fb4f37de40e48fddeee60136acf1e4cee7fa5f9f008dd894e1.exe
4208	36df136289e908fb4f37de40e48fddeee60136acf1e4cee7fa5f9f008dd894e1.exe
4208	36df136289e908fb4f37de40e48fddeee60136acf1e4cee7fa5f9f008dd894e1.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4760 wrote to memory of 4208	4760	36df136289e908fb4f37de40e48fddeee60136acf1e4cee7fa5f9f008dd894e1.exe	78
PID 4760 wrote to memory of 4208	4760	36df136289e908fb4f37de40e48fddeee60136acf1e4cee7fa5f9f008dd894e1.exe	78
PID 4760 wrote to memory of 4208	4760	36df136289e908fb4f37de40e48fddeee60136acf1e4cee7fa5f9f008dd894e1.exe	78
PID 4760 wrote to memory of 2156	4760	36df136289e908fb4f37de40e48fddeee60136acf1e4cee7fa5f9f008dd894e1.exe	79
PID 4760 wrote to memory of 2156	4760	36df136289e908fb4f37de40e48fddeee60136acf1e4cee7fa5f9f008dd894e1.exe	79
PID 4760 wrote to memory of 2156	4760	36df136289e908fb4f37de40e48fddeee60136acf1e4cee7fa5f9f008dd894e1.exe	79
PID 2156 wrote to memory of 644	2156	cmd.exe	81
PID 2156 wrote to memory of 644	2156	cmd.exe	81
PID 2156 wrote to memory of 644	2156	cmd.exe	81