qakbot | 1347ffea327367ff357fc9a184cfa741565012c03407bc6674093d7b4251da88

General

Target
1347ffea327367ff357fc9a184cfa741565012c03407bc6674093d7b4251da88.exe
Size 270KB
Sample201114-b2mdcs392x
SHA256 1347ffea327367ff357fc9a184cfa741565012c03407bc6674093d7b4251da88
MD5 b7bbae5e80933fd4f504016745bbaf4d
SHA1 cdc88365a8da31cadef80c0b154f6bec8270b980
SHA512 bd120e988d7c689d7f3ca1a7ebd6366e8acde9340b66c60229f3bc73a3b30d438afed4a774e0316313c1aeccf9789f070d32e8713a3c4944be5e70c0c8729eb8
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	1347ffea327367ff357fc9a184cfa741565012c03407bc6674093d7b4251da88.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	1347ffea327367ff357fc9a184cfa741565012c03407bc6674093d7b4251da88.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	1347ffea327367ff357fc9a184cfa741565012c03407bc6674093d7b4251da88.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	1347ffea327367ff357fc9a184cfa741565012c03407bc6674093d7b4251da88.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	1347ffea327367ff357fc9a184cfa741565012c03407bc6674093d7b4251da88.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	1347ffea327367ff357fc9a184cfa741565012c03407bc6674093d7b4251da88.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
3740	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3940 wrote to memory of 2832	3940	1347ffea327367ff357fc9a184cfa741565012c03407bc6674093d7b4251da88.exe	78
PID 3940 wrote to memory of 2832	3940	1347ffea327367ff357fc9a184cfa741565012c03407bc6674093d7b4251da88.exe	78
PID 3940 wrote to memory of 2832	3940	1347ffea327367ff357fc9a184cfa741565012c03407bc6674093d7b4251da88.exe	78
PID 3940 wrote to memory of 2280	3940	1347ffea327367ff357fc9a184cfa741565012c03407bc6674093d7b4251da88.exe	79
PID 3940 wrote to memory of 2280	3940	1347ffea327367ff357fc9a184cfa741565012c03407bc6674093d7b4251da88.exe	79
PID 3940 wrote to memory of 2280	3940	1347ffea327367ff357fc9a184cfa741565012c03407bc6674093d7b4251da88.exe	79
PID 2280 wrote to memory of 3740	2280	cmd.exe	81
PID 2280 wrote to memory of 3740	2280	cmd.exe	81
PID 2280 wrote to memory of 3740	2280	cmd.exe	81