qakbot | c42cc196ea59fb2f3917e035548914c55163a565eb2d5189adb455f2641a1429

General

Target
c42cc196ea59fb2f3917e035548914c55163a565eb2d5189adb455f2641a1429.exe
Size 270KB
Sample201113-tfw1k7v7fe
SHA256 c42cc196ea59fb2f3917e035548914c55163a565eb2d5189adb455f2641a1429
MD5 ce613abf2b094fa9b7a4b1183f1ff26a
SHA1 bede6f69b8f19d6273ed1d3a97c3932823473539
SHA512 71dddd78d672e7762dd526b00959b11c9d6f5078d72360256b1041e87aa2446553a06653f895774c603178f74092cbf8bb3010eca5b6f90ce72e88cb23073815
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	c42cc196ea59fb2f3917e035548914c55163a565eb2d5189adb455f2641a1429.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	c42cc196ea59fb2f3917e035548914c55163a565eb2d5189adb455f2641a1429.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	c42cc196ea59fb2f3917e035548914c55163a565eb2d5189adb455f2641a1429.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	c42cc196ea59fb2f3917e035548914c55163a565eb2d5189adb455f2641a1429.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	c42cc196ea59fb2f3917e035548914c55163a565eb2d5189adb455f2641a1429.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	c42cc196ea59fb2f3917e035548914c55163a565eb2d5189adb455f2641a1429.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
3984	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4640 wrote to memory of 3268	4640	c42cc196ea59fb2f3917e035548914c55163a565eb2d5189adb455f2641a1429.exe	78
PID 4640 wrote to memory of 3268	4640	c42cc196ea59fb2f3917e035548914c55163a565eb2d5189adb455f2641a1429.exe	78
PID 4640 wrote to memory of 3268	4640	c42cc196ea59fb2f3917e035548914c55163a565eb2d5189adb455f2641a1429.exe	78
PID 4640 wrote to memory of 4176	4640	c42cc196ea59fb2f3917e035548914c55163a565eb2d5189adb455f2641a1429.exe	79
PID 4640 wrote to memory of 4176	4640	c42cc196ea59fb2f3917e035548914c55163a565eb2d5189adb455f2641a1429.exe	79
PID 4640 wrote to memory of 4176	4640	c42cc196ea59fb2f3917e035548914c55163a565eb2d5189adb455f2641a1429.exe	79
PID 4176 wrote to memory of 3984	4176	cmd.exe	81
PID 4176 wrote to memory of 3984	4176	cmd.exe	81
PID 4176 wrote to memory of 3984	4176	cmd.exe	81