qakbot | 76abda9df345a813d02af71536094068af8a8cb18f39f684033fad0f83d5337d

General

Target
76abda9df345a813d02af71536094068af8a8cb18f39f684033fad0f83d5337d.exe
Size 254KB
Sample201112-sj3pv1kbdx
SHA256 76abda9df345a813d02af71536094068af8a8cb18f39f684033fad0f83d5337d
MD5 23313ebe198c06ff18e150e74912a838
SHA1 2052a34fcda929e6b216e288194fe700f968a52e
SHA512 987bfdb6e81231240245ae84ad91af23eff178bbc4c5cf13762ff4ded83410f43b7f782d385c3ebd2aa8007a25f717c7fe27e4dc2c8a69b02fde1dff511b222c
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	76abda9df345a813d02af71536094068af8a8cb18f39f684033fad0f83d5337d.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	76abda9df345a813d02af71536094068af8a8cb18f39f684033fad0f83d5337d.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	76abda9df345a813d02af71536094068af8a8cb18f39f684033fad0f83d5337d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	76abda9df345a813d02af71536094068af8a8cb18f39f684033fad0f83d5337d.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	76abda9df345a813d02af71536094068af8a8cb18f39f684033fad0f83d5337d.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	76abda9df345a813d02af71536094068af8a8cb18f39f684033fad0f83d5337d.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
4240	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4696	76abda9df345a813d02af71536094068af8a8cb18f39f684033fad0f83d5337d.exe
4696	76abda9df345a813d02af71536094068af8a8cb18f39f684033fad0f83d5337d.exe
788	76abda9df345a813d02af71536094068af8a8cb18f39f684033fad0f83d5337d.exe
788	76abda9df345a813d02af71536094068af8a8cb18f39f684033fad0f83d5337d.exe
788	76abda9df345a813d02af71536094068af8a8cb18f39f684033fad0f83d5337d.exe
788	76abda9df345a813d02af71536094068af8a8cb18f39f684033fad0f83d5337d.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4696 wrote to memory of 788	4696	76abda9df345a813d02af71536094068af8a8cb18f39f684033fad0f83d5337d.exe	77
PID 4696 wrote to memory of 788	4696	76abda9df345a813d02af71536094068af8a8cb18f39f684033fad0f83d5337d.exe	77
PID 4696 wrote to memory of 788	4696	76abda9df345a813d02af71536094068af8a8cb18f39f684033fad0f83d5337d.exe	77
PID 4696 wrote to memory of 3904	4696	76abda9df345a813d02af71536094068af8a8cb18f39f684033fad0f83d5337d.exe	78
PID 4696 wrote to memory of 3904	4696	76abda9df345a813d02af71536094068af8a8cb18f39f684033fad0f83d5337d.exe	78
PID 4696 wrote to memory of 3904	4696	76abda9df345a813d02af71536094068af8a8cb18f39f684033fad0f83d5337d.exe	78
PID 3904 wrote to memory of 4240	3904	cmd.exe	80
PID 3904 wrote to memory of 4240	3904	cmd.exe	80
PID 3904 wrote to memory of 4240	3904	cmd.exe	80