qakbot | 97e016891e4666ec0efb01fd6fef60fb86b853c1e63c0e491c1a27d8f546c224

General

Target
97e016891e4666ec0efb01fd6fef60fb86b853c1e63c0e491c1a27d8f546c224.exe
Size 270KB
Sample201112-lgqqnadn1j
SHA256 97e016891e4666ec0efb01fd6fef60fb86b853c1e63c0e491c1a27d8f546c224
MD5 04547e6d3eabb14c7d839b6f573526af
SHA1 d0d5ea770306e0b03d68fbe51019d6987d867621
SHA512 94c993e75af6b8f2f676833bdc3a23f2d0dd269b59eab876ee63a9ff29ee1b70ce89d7bb4ca82445bffc56f0dc96b06cdb259aadb477d76c0dbe9f53a08fb88e
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	97e016891e4666ec0efb01fd6fef60fb86b853c1e63c0e491c1a27d8f546c224.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	97e016891e4666ec0efb01fd6fef60fb86b853c1e63c0e491c1a27d8f546c224.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	97e016891e4666ec0efb01fd6fef60fb86b853c1e63c0e491c1a27d8f546c224.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	97e016891e4666ec0efb01fd6fef60fb86b853c1e63c0e491c1a27d8f546c224.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	97e016891e4666ec0efb01fd6fef60fb86b853c1e63c0e491c1a27d8f546c224.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	97e016891e4666ec0efb01fd6fef60fb86b853c1e63c0e491c1a27d8f546c224.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
580	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4804	97e016891e4666ec0efb01fd6fef60fb86b853c1e63c0e491c1a27d8f546c224.exe
4804	97e016891e4666ec0efb01fd6fef60fb86b853c1e63c0e491c1a27d8f546c224.exe
4296	97e016891e4666ec0efb01fd6fef60fb86b853c1e63c0e491c1a27d8f546c224.exe
4296	97e016891e4666ec0efb01fd6fef60fb86b853c1e63c0e491c1a27d8f546c224.exe
4296	97e016891e4666ec0efb01fd6fef60fb86b853c1e63c0e491c1a27d8f546c224.exe
4296	97e016891e4666ec0efb01fd6fef60fb86b853c1e63c0e491c1a27d8f546c224.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4804 wrote to memory of 4296	4804	97e016891e4666ec0efb01fd6fef60fb86b853c1e63c0e491c1a27d8f546c224.exe	78
PID 4804 wrote to memory of 4296	4804	97e016891e4666ec0efb01fd6fef60fb86b853c1e63c0e491c1a27d8f546c224.exe	78
PID 4804 wrote to memory of 4296	4804	97e016891e4666ec0efb01fd6fef60fb86b853c1e63c0e491c1a27d8f546c224.exe	78
PID 4804 wrote to memory of 64	4804	97e016891e4666ec0efb01fd6fef60fb86b853c1e63c0e491c1a27d8f546c224.exe	79
PID 4804 wrote to memory of 64	4804	97e016891e4666ec0efb01fd6fef60fb86b853c1e63c0e491c1a27d8f546c224.exe	79
PID 4804 wrote to memory of 64	4804	97e016891e4666ec0efb01fd6fef60fb86b853c1e63c0e491c1a27d8f546c224.exe	79
PID 64 wrote to memory of 580	64	cmd.exe	81
PID 64 wrote to memory of 580	64	cmd.exe	81
PID 64 wrote to memory of 580	64	cmd.exe	81