qakbot | aaa7fcff7b19c59f14a6cee1ea723957b8a1dc9c54153e89599e610e40f022f2

General

Target
aaa7fcff7b19c59f14a6cee1ea723957b8a1dc9c54153e89599e610e40f022f2.exe
Size 270KB
Sample201113-gexhyrjhh2
SHA256 aaa7fcff7b19c59f14a6cee1ea723957b8a1dc9c54153e89599e610e40f022f2
MD5 85ef477b23ec26047f1585143eb0d08b
SHA1 ced36144579785685f23c9dbff0a90885bd7622d
SHA512 1df58986796d06c24a8b6127d92101c013a4cd02d77a04868f03c80d138ca10b5e96638a77a8dd332874b055e8b0951bcd4648d9e95e0036e7d66c644a3bed7f
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	aaa7fcff7b19c59f14a6cee1ea723957b8a1dc9c54153e89599e610e40f022f2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	aaa7fcff7b19c59f14a6cee1ea723957b8a1dc9c54153e89599e610e40f022f2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	aaa7fcff7b19c59f14a6cee1ea723957b8a1dc9c54153e89599e610e40f022f2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	aaa7fcff7b19c59f14a6cee1ea723957b8a1dc9c54153e89599e610e40f022f2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	aaa7fcff7b19c59f14a6cee1ea723957b8a1dc9c54153e89599e610e40f022f2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	aaa7fcff7b19c59f14a6cee1ea723957b8a1dc9c54153e89599e610e40f022f2.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
3780	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1028	aaa7fcff7b19c59f14a6cee1ea723957b8a1dc9c54153e89599e610e40f022f2.exe
1028	aaa7fcff7b19c59f14a6cee1ea723957b8a1dc9c54153e89599e610e40f022f2.exe
940	aaa7fcff7b19c59f14a6cee1ea723957b8a1dc9c54153e89599e610e40f022f2.exe
940	aaa7fcff7b19c59f14a6cee1ea723957b8a1dc9c54153e89599e610e40f022f2.exe
940	aaa7fcff7b19c59f14a6cee1ea723957b8a1dc9c54153e89599e610e40f022f2.exe
940	aaa7fcff7b19c59f14a6cee1ea723957b8a1dc9c54153e89599e610e40f022f2.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1028 wrote to memory of 940	1028	aaa7fcff7b19c59f14a6cee1ea723957b8a1dc9c54153e89599e610e40f022f2.exe	79
PID 1028 wrote to memory of 940	1028	aaa7fcff7b19c59f14a6cee1ea723957b8a1dc9c54153e89599e610e40f022f2.exe	79
PID 1028 wrote to memory of 940	1028	aaa7fcff7b19c59f14a6cee1ea723957b8a1dc9c54153e89599e610e40f022f2.exe	79
PID 1028 wrote to memory of 2376	1028	aaa7fcff7b19c59f14a6cee1ea723957b8a1dc9c54153e89599e610e40f022f2.exe	80
PID 1028 wrote to memory of 2376	1028	aaa7fcff7b19c59f14a6cee1ea723957b8a1dc9c54153e89599e610e40f022f2.exe	80
PID 1028 wrote to memory of 2376	1028	aaa7fcff7b19c59f14a6cee1ea723957b8a1dc9c54153e89599e610e40f022f2.exe	80
PID 2376 wrote to memory of 3780	2376	cmd.exe	82
PID 2376 wrote to memory of 3780	2376	cmd.exe	82
PID 2376 wrote to memory of 3780	2376	cmd.exe	82