qakbot | 34966045fd0c80b8a6ecaadab6d15de104b1e7dc9405c709db8271d213df42f5

General

Target
34966045fd0c80b8a6ecaadab6d15de104b1e7dc9405c709db8271d213df42f5.exe
Size 270KB
Sample201112-wkcbcka4hj
SHA256 34966045fd0c80b8a6ecaadab6d15de104b1e7dc9405c709db8271d213df42f5
MD5 5d8060427a8d8f8e9e537917cae91258
SHA1 23c8bfc44e335c895e5308f8166abdd005317c4a
SHA512 cdea1e0f1172483333d5113554c8695b66bccdcf7e8ed5395dea727d5f24331a95cb2a8456a7177e78c6b2460f9cdaab2aa2e0bdae58931b9b4f3afba8fb5db1
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	34966045fd0c80b8a6ecaadab6d15de104b1e7dc9405c709db8271d213df42f5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	34966045fd0c80b8a6ecaadab6d15de104b1e7dc9405c709db8271d213df42f5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	34966045fd0c80b8a6ecaadab6d15de104b1e7dc9405c709db8271d213df42f5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	34966045fd0c80b8a6ecaadab6d15de104b1e7dc9405c709db8271d213df42f5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	34966045fd0c80b8a6ecaadab6d15de104b1e7dc9405c709db8271d213df42f5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	34966045fd0c80b8a6ecaadab6d15de104b1e7dc9405c709db8271d213df42f5.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
3108	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1048	34966045fd0c80b8a6ecaadab6d15de104b1e7dc9405c709db8271d213df42f5.exe
1048	34966045fd0c80b8a6ecaadab6d15de104b1e7dc9405c709db8271d213df42f5.exe
3348	34966045fd0c80b8a6ecaadab6d15de104b1e7dc9405c709db8271d213df42f5.exe
3348	34966045fd0c80b8a6ecaadab6d15de104b1e7dc9405c709db8271d213df42f5.exe
3348	34966045fd0c80b8a6ecaadab6d15de104b1e7dc9405c709db8271d213df42f5.exe
3348	34966045fd0c80b8a6ecaadab6d15de104b1e7dc9405c709db8271d213df42f5.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 3348	1048	34966045fd0c80b8a6ecaadab6d15de104b1e7dc9405c709db8271d213df42f5.exe	79
PID 1048 wrote to memory of 3348	1048	34966045fd0c80b8a6ecaadab6d15de104b1e7dc9405c709db8271d213df42f5.exe	79
PID 1048 wrote to memory of 3348	1048	34966045fd0c80b8a6ecaadab6d15de104b1e7dc9405c709db8271d213df42f5.exe	79
PID 1048 wrote to memory of 3180	1048	34966045fd0c80b8a6ecaadab6d15de104b1e7dc9405c709db8271d213df42f5.exe	80
PID 1048 wrote to memory of 3180	1048	34966045fd0c80b8a6ecaadab6d15de104b1e7dc9405c709db8271d213df42f5.exe	80
PID 1048 wrote to memory of 3180	1048	34966045fd0c80b8a6ecaadab6d15de104b1e7dc9405c709db8271d213df42f5.exe	80
PID 3180 wrote to memory of 3108	3180	cmd.exe	82
PID 3180 wrote to memory of 3108	3180	cmd.exe	82
PID 3180 wrote to memory of 3108	3180	cmd.exe	82