qakbot | 343cacc8bcad546c1320dfc9af431e4c24973cc5768d2f586bb4df470e20fb32

General

Target
343cacc8bcad546c1320dfc9af431e4c24973cc5768d2f586bb4df470e20fb32.exe
Size 270KB
Sample201112-la41vdns2x
SHA256 343cacc8bcad546c1320dfc9af431e4c24973cc5768d2f586bb4df470e20fb32
MD5 5091c4870ca1b7a8904b1033504070bb
SHA1 370c9b4ba54c2f7164901379bacdc22e5f2568bb
SHA512 4709e064eb8e6bcafc9786bf80ede856cd8826803987e64823c204b5bfaaf89442a17415315cd02918b32f19821d620940f462eaaa89e3027ec90773e263b1c0
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	343cacc8bcad546c1320dfc9af431e4c24973cc5768d2f586bb4df470e20fb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	343cacc8bcad546c1320dfc9af431e4c24973cc5768d2f586bb4df470e20fb32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	343cacc8bcad546c1320dfc9af431e4c24973cc5768d2f586bb4df470e20fb32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	343cacc8bcad546c1320dfc9af431e4c24973cc5768d2f586bb4df470e20fb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	343cacc8bcad546c1320dfc9af431e4c24973cc5768d2f586bb4df470e20fb32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	343cacc8bcad546c1320dfc9af431e4c24973cc5768d2f586bb4df470e20fb32.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
3008	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4000	343cacc8bcad546c1320dfc9af431e4c24973cc5768d2f586bb4df470e20fb32.exe
4000	343cacc8bcad546c1320dfc9af431e4c24973cc5768d2f586bb4df470e20fb32.exe
1928	343cacc8bcad546c1320dfc9af431e4c24973cc5768d2f586bb4df470e20fb32.exe
1928	343cacc8bcad546c1320dfc9af431e4c24973cc5768d2f586bb4df470e20fb32.exe
1928	343cacc8bcad546c1320dfc9af431e4c24973cc5768d2f586bb4df470e20fb32.exe
1928	343cacc8bcad546c1320dfc9af431e4c24973cc5768d2f586bb4df470e20fb32.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4000 wrote to memory of 1928	4000	343cacc8bcad546c1320dfc9af431e4c24973cc5768d2f586bb4df470e20fb32.exe	78
PID 4000 wrote to memory of 1928	4000	343cacc8bcad546c1320dfc9af431e4c24973cc5768d2f586bb4df470e20fb32.exe	78
PID 4000 wrote to memory of 1928	4000	343cacc8bcad546c1320dfc9af431e4c24973cc5768d2f586bb4df470e20fb32.exe	78
PID 4000 wrote to memory of 2908	4000	343cacc8bcad546c1320dfc9af431e4c24973cc5768d2f586bb4df470e20fb32.exe	79
PID 4000 wrote to memory of 2908	4000	343cacc8bcad546c1320dfc9af431e4c24973cc5768d2f586bb4df470e20fb32.exe	79
PID 4000 wrote to memory of 2908	4000	343cacc8bcad546c1320dfc9af431e4c24973cc5768d2f586bb4df470e20fb32.exe	79
PID 2908 wrote to memory of 3008	2908	cmd.exe	81
PID 2908 wrote to memory of 3008	2908	cmd.exe	81
PID 2908 wrote to memory of 3008	2908	cmd.exe	81