qakbot | 82aa970db939b35c763e6afddcde7ad596a5dc6e931efb2f88e85afd840fa5c6

General

Target
82aa970db939b35c763e6afddcde7ad596a5dc6e931efb2f88e85afd840fa5c6.exe
Size 270KB
Sample201113-878m29dhvx
SHA256 82aa970db939b35c763e6afddcde7ad596a5dc6e931efb2f88e85afd840fa5c6
MD5 894e5eb4dd086c9fcd211d6325b21d92
SHA1 fab0f61fffe4a83adae43ef492572c76d8a5012d
SHA512 065f1ff364acc15f7b6e31c45ea0740d022c82d909a8ec92bbae6cea8f8336ac7296738a0fbd02eb7b03f733eab5e2b46643c1d4a20664327f463196be11686f
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	82aa970db939b35c763e6afddcde7ad596a5dc6e931efb2f88e85afd840fa5c6.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	82aa970db939b35c763e6afddcde7ad596a5dc6e931efb2f88e85afd840fa5c6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	82aa970db939b35c763e6afddcde7ad596a5dc6e931efb2f88e85afd840fa5c6.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	82aa970db939b35c763e6afddcde7ad596a5dc6e931efb2f88e85afd840fa5c6.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	82aa970db939b35c763e6afddcde7ad596a5dc6e931efb2f88e85afd840fa5c6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	82aa970db939b35c763e6afddcde7ad596a5dc6e931efb2f88e85afd840fa5c6.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
1020	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3932	82aa970db939b35c763e6afddcde7ad596a5dc6e931efb2f88e85afd840fa5c6.exe
3932	82aa970db939b35c763e6afddcde7ad596a5dc6e931efb2f88e85afd840fa5c6.exe
200	82aa970db939b35c763e6afddcde7ad596a5dc6e931efb2f88e85afd840fa5c6.exe
200	82aa970db939b35c763e6afddcde7ad596a5dc6e931efb2f88e85afd840fa5c6.exe
200	82aa970db939b35c763e6afddcde7ad596a5dc6e931efb2f88e85afd840fa5c6.exe
200	82aa970db939b35c763e6afddcde7ad596a5dc6e931efb2f88e85afd840fa5c6.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3932 wrote to memory of 200	3932	82aa970db939b35c763e6afddcde7ad596a5dc6e931efb2f88e85afd840fa5c6.exe	78
PID 3932 wrote to memory of 200	3932	82aa970db939b35c763e6afddcde7ad596a5dc6e931efb2f88e85afd840fa5c6.exe	78
PID 3932 wrote to memory of 200	3932	82aa970db939b35c763e6afddcde7ad596a5dc6e931efb2f88e85afd840fa5c6.exe	78
PID 3932 wrote to memory of 1324	3932	82aa970db939b35c763e6afddcde7ad596a5dc6e931efb2f88e85afd840fa5c6.exe	79
PID 3932 wrote to memory of 1324	3932	82aa970db939b35c763e6afddcde7ad596a5dc6e931efb2f88e85afd840fa5c6.exe	79
PID 3932 wrote to memory of 1324	3932	82aa970db939b35c763e6afddcde7ad596a5dc6e931efb2f88e85afd840fa5c6.exe	79
PID 1324 wrote to memory of 1020	1324	cmd.exe	81
PID 1324 wrote to memory of 1020	1324	cmd.exe	81
PID 1324 wrote to memory of 1020	1324	cmd.exe	81