qakbot | 320516fbe5067baaf86036ec770f5bc0eb7c667c13da29cacb2e428a9bd199f6

General

Target
320516fbe5067baaf86036ec770f5bc0eb7c667c13da29cacb2e428a9bd199f6.exe
Size 270KB
Sample201112-w6le9j5e1x
SHA256 320516fbe5067baaf86036ec770f5bc0eb7c667c13da29cacb2e428a9bd199f6
MD5 40f00c9999a9b64a565a7d3b8900d7ab
SHA1 a36f1e3ce63e075ab09b4665ac519c9d85a7b61a
SHA512 cad20702baeb7b6f4230cb3a3792d75c40ce5bb0b2b73393d060ad914a41f96a323dd0cd1daabac2074b0aafd127100c29d57bac4a00afb518d507db1bc8b4cb
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	320516fbe5067baaf86036ec770f5bc0eb7c667c13da29cacb2e428a9bd199f6.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	320516fbe5067baaf86036ec770f5bc0eb7c667c13da29cacb2e428a9bd199f6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	320516fbe5067baaf86036ec770f5bc0eb7c667c13da29cacb2e428a9bd199f6.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	320516fbe5067baaf86036ec770f5bc0eb7c667c13da29cacb2e428a9bd199f6.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	320516fbe5067baaf86036ec770f5bc0eb7c667c13da29cacb2e428a9bd199f6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	320516fbe5067baaf86036ec770f5bc0eb7c667c13da29cacb2e428a9bd199f6.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
3616	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1180	320516fbe5067baaf86036ec770f5bc0eb7c667c13da29cacb2e428a9bd199f6.exe
1180	320516fbe5067baaf86036ec770f5bc0eb7c667c13da29cacb2e428a9bd199f6.exe
3624	320516fbe5067baaf86036ec770f5bc0eb7c667c13da29cacb2e428a9bd199f6.exe
3624	320516fbe5067baaf86036ec770f5bc0eb7c667c13da29cacb2e428a9bd199f6.exe
3624	320516fbe5067baaf86036ec770f5bc0eb7c667c13da29cacb2e428a9bd199f6.exe
3624	320516fbe5067baaf86036ec770f5bc0eb7c667c13da29cacb2e428a9bd199f6.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1180 wrote to memory of 3624	1180	320516fbe5067baaf86036ec770f5bc0eb7c667c13da29cacb2e428a9bd199f6.exe	79
PID 1180 wrote to memory of 3624	1180	320516fbe5067baaf86036ec770f5bc0eb7c667c13da29cacb2e428a9bd199f6.exe	79
PID 1180 wrote to memory of 3624	1180	320516fbe5067baaf86036ec770f5bc0eb7c667c13da29cacb2e428a9bd199f6.exe	79
PID 1180 wrote to memory of 3592	1180	320516fbe5067baaf86036ec770f5bc0eb7c667c13da29cacb2e428a9bd199f6.exe	80
PID 1180 wrote to memory of 3592	1180	320516fbe5067baaf86036ec770f5bc0eb7c667c13da29cacb2e428a9bd199f6.exe	80
PID 1180 wrote to memory of 3592	1180	320516fbe5067baaf86036ec770f5bc0eb7c667c13da29cacb2e428a9bd199f6.exe	80
PID 3592 wrote to memory of 3616	3592	cmd.exe	82
PID 3592 wrote to memory of 3616	3592	cmd.exe	82
PID 3592 wrote to memory of 3616	3592	cmd.exe	82