qakbot | c16385afea68a9f5c02f6679a4c834e7e39b3cbb62d98d8e4a95b03ab5dcd875

General

Target
c16385afea68a9f5c02f6679a4c834e7e39b3cbb62d98d8e4a95b03ab5dcd875.exe
Size 270KB
Sample201112-af8fkm68he
SHA256 c16385afea68a9f5c02f6679a4c834e7e39b3cbb62d98d8e4a95b03ab5dcd875
MD5 0d9e588530ddcb99fc641f8104ff039b
SHA1 17f2f9fd71ac1e0c41bc1e95648981f002198151
SHA512 640b6d7097402c7351773d61a78606d87c87253da9c941ec533981af87fad3d6ae92783c84961f6d46064056a79f1d399d9496987027464c49a8954c3e94a500
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	c16385afea68a9f5c02f6679a4c834e7e39b3cbb62d98d8e4a95b03ab5dcd875.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	c16385afea68a9f5c02f6679a4c834e7e39b3cbb62d98d8e4a95b03ab5dcd875.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	c16385afea68a9f5c02f6679a4c834e7e39b3cbb62d98d8e4a95b03ab5dcd875.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	c16385afea68a9f5c02f6679a4c834e7e39b3cbb62d98d8e4a95b03ab5dcd875.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	c16385afea68a9f5c02f6679a4c834e7e39b3cbb62d98d8e4a95b03ab5dcd875.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	c16385afea68a9f5c02f6679a4c834e7e39b3cbb62d98d8e4a95b03ab5dcd875.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
3812	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
980	c16385afea68a9f5c02f6679a4c834e7e39b3cbb62d98d8e4a95b03ab5dcd875.exe
980	c16385afea68a9f5c02f6679a4c834e7e39b3cbb62d98d8e4a95b03ab5dcd875.exe
192	c16385afea68a9f5c02f6679a4c834e7e39b3cbb62d98d8e4a95b03ab5dcd875.exe
192	c16385afea68a9f5c02f6679a4c834e7e39b3cbb62d98d8e4a95b03ab5dcd875.exe
192	c16385afea68a9f5c02f6679a4c834e7e39b3cbb62d98d8e4a95b03ab5dcd875.exe
192	c16385afea68a9f5c02f6679a4c834e7e39b3cbb62d98d8e4a95b03ab5dcd875.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 980 wrote to memory of 192	980	c16385afea68a9f5c02f6679a4c834e7e39b3cbb62d98d8e4a95b03ab5dcd875.exe	78
PID 980 wrote to memory of 192	980	c16385afea68a9f5c02f6679a4c834e7e39b3cbb62d98d8e4a95b03ab5dcd875.exe	78
PID 980 wrote to memory of 192	980	c16385afea68a9f5c02f6679a4c834e7e39b3cbb62d98d8e4a95b03ab5dcd875.exe	78
PID 980 wrote to memory of 296	980	c16385afea68a9f5c02f6679a4c834e7e39b3cbb62d98d8e4a95b03ab5dcd875.exe	79
PID 980 wrote to memory of 296	980	c16385afea68a9f5c02f6679a4c834e7e39b3cbb62d98d8e4a95b03ab5dcd875.exe	79
PID 980 wrote to memory of 296	980	c16385afea68a9f5c02f6679a4c834e7e39b3cbb62d98d8e4a95b03ab5dcd875.exe	79
PID 296 wrote to memory of 3812	296	cmd.exe	81
PID 296 wrote to memory of 3812	296	cmd.exe	81
PID 296 wrote to memory of 3812	296	cmd.exe	81