qakbot | 62aedb588c4c8afb74f218b971d8b8c4ba8c27d0404ea8a2e09b4a40048cc6c5

General

Target
62aedb588c4c8afb74f218b971d8b8c4ba8c27d0404ea8a2e09b4a40048cc6c5.exe
Size 270KB
Sample201113-b5p76n7ace
SHA256 62aedb588c4c8afb74f218b971d8b8c4ba8c27d0404ea8a2e09b4a40048cc6c5
MD5 1ecdde1e4aba955630e98771f64d1834
SHA1 12ba30c3c33e2bd8e8c2dc21d325304be5ccba2e
SHA512 b4f24036ade3c255469ebe844118b21f947cf64708733651950ccf952397a40d4dba8e3bac458a009e1027119567aab5d2e35a6868f8dff9c88dc316187dd4e4
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	62aedb588c4c8afb74f218b971d8b8c4ba8c27d0404ea8a2e09b4a40048cc6c5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	62aedb588c4c8afb74f218b971d8b8c4ba8c27d0404ea8a2e09b4a40048cc6c5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	62aedb588c4c8afb74f218b971d8b8c4ba8c27d0404ea8a2e09b4a40048cc6c5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	62aedb588c4c8afb74f218b971d8b8c4ba8c27d0404ea8a2e09b4a40048cc6c5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	62aedb588c4c8afb74f218b971d8b8c4ba8c27d0404ea8a2e09b4a40048cc6c5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	62aedb588c4c8afb74f218b971d8b8c4ba8c27d0404ea8a2e09b4a40048cc6c5.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
3932	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3988	62aedb588c4c8afb74f218b971d8b8c4ba8c27d0404ea8a2e09b4a40048cc6c5.exe
3988	62aedb588c4c8afb74f218b971d8b8c4ba8c27d0404ea8a2e09b4a40048cc6c5.exe
3816	62aedb588c4c8afb74f218b971d8b8c4ba8c27d0404ea8a2e09b4a40048cc6c5.exe
3816	62aedb588c4c8afb74f218b971d8b8c4ba8c27d0404ea8a2e09b4a40048cc6c5.exe
3816	62aedb588c4c8afb74f218b971d8b8c4ba8c27d0404ea8a2e09b4a40048cc6c5.exe
3816	62aedb588c4c8afb74f218b971d8b8c4ba8c27d0404ea8a2e09b4a40048cc6c5.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3988 wrote to memory of 3816	3988	62aedb588c4c8afb74f218b971d8b8c4ba8c27d0404ea8a2e09b4a40048cc6c5.exe	79
PID 3988 wrote to memory of 3816	3988	62aedb588c4c8afb74f218b971d8b8c4ba8c27d0404ea8a2e09b4a40048cc6c5.exe	79
PID 3988 wrote to memory of 3816	3988	62aedb588c4c8afb74f218b971d8b8c4ba8c27d0404ea8a2e09b4a40048cc6c5.exe	79
PID 3988 wrote to memory of 996	3988	62aedb588c4c8afb74f218b971d8b8c4ba8c27d0404ea8a2e09b4a40048cc6c5.exe	80
PID 3988 wrote to memory of 996	3988	62aedb588c4c8afb74f218b971d8b8c4ba8c27d0404ea8a2e09b4a40048cc6c5.exe	80
PID 3988 wrote to memory of 996	3988	62aedb588c4c8afb74f218b971d8b8c4ba8c27d0404ea8a2e09b4a40048cc6c5.exe	80
PID 996 wrote to memory of 3932	996	cmd.exe	82
PID 996 wrote to memory of 3932	996	cmd.exe	82
PID 996 wrote to memory of 3932	996	cmd.exe	82