qakbot | 65469fb02cadcc7e78158404a781b8868b93bd8fbe6d01b5132e51ddcd07e4ee

General

Target
65469fb02cadcc7e78158404a781b8868b93bd8fbe6d01b5132e51ddcd07e4ee.exe
Size 270KB
Sample201114-2d6llmn7vs
SHA256 65469fb02cadcc7e78158404a781b8868b93bd8fbe6d01b5132e51ddcd07e4ee
MD5 324d0bff14b847860c7aef1445a519a6
SHA1 dd32a1039eaf66b2de4a58a1bbb59d5b632a77a3
SHA512 2f7d9e28fbe13b9260bdcf083003df7e27f6d38b82f6d4c9a9b2e694a25f0f566c7d0cafbdf0500a455869a502efd5a750f7e465ca9d5ae3c2c7e64c334ae71e
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	65469fb02cadcc7e78158404a781b8868b93bd8fbe6d01b5132e51ddcd07e4ee.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	65469fb02cadcc7e78158404a781b8868b93bd8fbe6d01b5132e51ddcd07e4ee.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	65469fb02cadcc7e78158404a781b8868b93bd8fbe6d01b5132e51ddcd07e4ee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	65469fb02cadcc7e78158404a781b8868b93bd8fbe6d01b5132e51ddcd07e4ee.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	65469fb02cadcc7e78158404a781b8868b93bd8fbe6d01b5132e51ddcd07e4ee.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	65469fb02cadcc7e78158404a781b8868b93bd8fbe6d01b5132e51ddcd07e4ee.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
4072	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4632	65469fb02cadcc7e78158404a781b8868b93bd8fbe6d01b5132e51ddcd07e4ee.exe
4632	65469fb02cadcc7e78158404a781b8868b93bd8fbe6d01b5132e51ddcd07e4ee.exe
2172	65469fb02cadcc7e78158404a781b8868b93bd8fbe6d01b5132e51ddcd07e4ee.exe
2172	65469fb02cadcc7e78158404a781b8868b93bd8fbe6d01b5132e51ddcd07e4ee.exe
2172	65469fb02cadcc7e78158404a781b8868b93bd8fbe6d01b5132e51ddcd07e4ee.exe
2172	65469fb02cadcc7e78158404a781b8868b93bd8fbe6d01b5132e51ddcd07e4ee.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4632 wrote to memory of 2172	4632	65469fb02cadcc7e78158404a781b8868b93bd8fbe6d01b5132e51ddcd07e4ee.exe	78
PID 4632 wrote to memory of 2172	4632	65469fb02cadcc7e78158404a781b8868b93bd8fbe6d01b5132e51ddcd07e4ee.exe	78
PID 4632 wrote to memory of 2172	4632	65469fb02cadcc7e78158404a781b8868b93bd8fbe6d01b5132e51ddcd07e4ee.exe	78
PID 4632 wrote to memory of 4160	4632	65469fb02cadcc7e78158404a781b8868b93bd8fbe6d01b5132e51ddcd07e4ee.exe	79
PID 4632 wrote to memory of 4160	4632	65469fb02cadcc7e78158404a781b8868b93bd8fbe6d01b5132e51ddcd07e4ee.exe	79
PID 4632 wrote to memory of 4160	4632	65469fb02cadcc7e78158404a781b8868b93bd8fbe6d01b5132e51ddcd07e4ee.exe	79
PID 4160 wrote to memory of 4072	4160	cmd.exe	81
PID 4160 wrote to memory of 4072	4160	cmd.exe	81
PID 4160 wrote to memory of 4072	4160	cmd.exe	81