qakbot | cc66d88343dcba412c4697d97cca6453b4e36ccd0723e92adb079e0f24e4cfc9

General

Target
cc66d88343dcba412c4697d97cca6453b4e36ccd0723e92adb079e0f24e4cfc9.exe
Size 257KB
Sample201112-ezb23yr4gx
SHA256 cc66d88343dcba412c4697d97cca6453b4e36ccd0723e92adb079e0f24e4cfc9
MD5 d6fb66f6c2cb49e3668eff3fc43fa3e6
SHA1 0ca2691fd684a5dc3ca7c8233c8577f76c59dffd
SHA512 1ed82161a994c8b430e7bfc326089582552a68657a61217cd0154a102a2ba3b8153d8e872716b9dfbb0d76f63ef1f1ca46f2faf7362f45cf20d86652c5da04f9
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	cc66d88343dcba412c4697d97cca6453b4e36ccd0723e92adb079e0f24e4cfc9.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	cc66d88343dcba412c4697d97cca6453b4e36ccd0723e92adb079e0f24e4cfc9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	cc66d88343dcba412c4697d97cca6453b4e36ccd0723e92adb079e0f24e4cfc9.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	cc66d88343dcba412c4697d97cca6453b4e36ccd0723e92adb079e0f24e4cfc9.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	cc66d88343dcba412c4697d97cca6453b4e36ccd0723e92adb079e0f24e4cfc9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	cc66d88343dcba412c4697d97cca6453b4e36ccd0723e92adb079e0f24e4cfc9.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
3636	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
508	cc66d88343dcba412c4697d97cca6453b4e36ccd0723e92adb079e0f24e4cfc9.exe
508	cc66d88343dcba412c4697d97cca6453b4e36ccd0723e92adb079e0f24e4cfc9.exe
2824	cc66d88343dcba412c4697d97cca6453b4e36ccd0723e92adb079e0f24e4cfc9.exe
2824	cc66d88343dcba412c4697d97cca6453b4e36ccd0723e92adb079e0f24e4cfc9.exe
2824	cc66d88343dcba412c4697d97cca6453b4e36ccd0723e92adb079e0f24e4cfc9.exe
2824	cc66d88343dcba412c4697d97cca6453b4e36ccd0723e92adb079e0f24e4cfc9.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 508 wrote to memory of 2824	508	cc66d88343dcba412c4697d97cca6453b4e36ccd0723e92adb079e0f24e4cfc9.exe	78
PID 508 wrote to memory of 2824	508	cc66d88343dcba412c4697d97cca6453b4e36ccd0723e92adb079e0f24e4cfc9.exe	78
PID 508 wrote to memory of 2824	508	cc66d88343dcba412c4697d97cca6453b4e36ccd0723e92adb079e0f24e4cfc9.exe	78
PID 508 wrote to memory of 2884	508	cc66d88343dcba412c4697d97cca6453b4e36ccd0723e92adb079e0f24e4cfc9.exe	79
PID 508 wrote to memory of 2884	508	cc66d88343dcba412c4697d97cca6453b4e36ccd0723e92adb079e0f24e4cfc9.exe	79
PID 508 wrote to memory of 2884	508	cc66d88343dcba412c4697d97cca6453b4e36ccd0723e92adb079e0f24e4cfc9.exe	79
PID 2884 wrote to memory of 3636	2884	cmd.exe	81
PID 2884 wrote to memory of 3636	2884	cmd.exe	81
PID 2884 wrote to memory of 3636	2884	cmd.exe	81