qakbot | 60494d0e44e94acaa558ec9bd8cf2781e91865873d4c7af02ccdc545b9f5466c

General

Target
60494d0e44e94acaa558ec9bd8cf2781e91865873d4c7af02ccdc545b9f5466c.exe
Size 270KB
Sample201113-l6qwhpwarn
SHA256 60494d0e44e94acaa558ec9bd8cf2781e91865873d4c7af02ccdc545b9f5466c
MD5 f54a28f3b8daea94a623a12958182761
SHA1 147952ce2c7cc9bd9f86dc2ab133e36873ca074f
SHA512 bb2df474139d028de6a89e3e1ec3fda4db6b8217dc5d15825c7ce153c645ca37625295f8ae298cbbb52ecfe30b2b55bb1cc6b46048421214e91066719ed547a1
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	60494d0e44e94acaa558ec9bd8cf2781e91865873d4c7af02ccdc545b9f5466c.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	60494d0e44e94acaa558ec9bd8cf2781e91865873d4c7af02ccdc545b9f5466c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	60494d0e44e94acaa558ec9bd8cf2781e91865873d4c7af02ccdc545b9f5466c.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	60494d0e44e94acaa558ec9bd8cf2781e91865873d4c7af02ccdc545b9f5466c.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	60494d0e44e94acaa558ec9bd8cf2781e91865873d4c7af02ccdc545b9f5466c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	60494d0e44e94acaa558ec9bd8cf2781e91865873d4c7af02ccdc545b9f5466c.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
1864	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
984	60494d0e44e94acaa558ec9bd8cf2781e91865873d4c7af02ccdc545b9f5466c.exe
984	60494d0e44e94acaa558ec9bd8cf2781e91865873d4c7af02ccdc545b9f5466c.exe
2500	60494d0e44e94acaa558ec9bd8cf2781e91865873d4c7af02ccdc545b9f5466c.exe
2500	60494d0e44e94acaa558ec9bd8cf2781e91865873d4c7af02ccdc545b9f5466c.exe
2500	60494d0e44e94acaa558ec9bd8cf2781e91865873d4c7af02ccdc545b9f5466c.exe
2500	60494d0e44e94acaa558ec9bd8cf2781e91865873d4c7af02ccdc545b9f5466c.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 984 wrote to memory of 2500	984	60494d0e44e94acaa558ec9bd8cf2781e91865873d4c7af02ccdc545b9f5466c.exe	78
PID 984 wrote to memory of 2500	984	60494d0e44e94acaa558ec9bd8cf2781e91865873d4c7af02ccdc545b9f5466c.exe	78
PID 984 wrote to memory of 2500	984	60494d0e44e94acaa558ec9bd8cf2781e91865873d4c7af02ccdc545b9f5466c.exe	78
PID 984 wrote to memory of 2244	984	60494d0e44e94acaa558ec9bd8cf2781e91865873d4c7af02ccdc545b9f5466c.exe	79
PID 984 wrote to memory of 2244	984	60494d0e44e94acaa558ec9bd8cf2781e91865873d4c7af02ccdc545b9f5466c.exe	79
PID 984 wrote to memory of 2244	984	60494d0e44e94acaa558ec9bd8cf2781e91865873d4c7af02ccdc545b9f5466c.exe	79
PID 2244 wrote to memory of 1864	2244	cmd.exe	81
PID 2244 wrote to memory of 1864	2244	cmd.exe	81
PID 2244 wrote to memory of 1864	2244	cmd.exe	81