qakbot | b2cc4637dbd26123d5401d4040ded43a618d8a719510692fc85ae87a4789173e

General

Target
b2cc4637dbd26123d5401d4040ded43a618d8a719510692fc85ae87a4789173e.exe
Size 270KB
Sample201114-gp6pes2bla
SHA256 b2cc4637dbd26123d5401d4040ded43a618d8a719510692fc85ae87a4789173e
MD5 3028a88811e2e9ade4b2b6a6cf2046af
SHA1 1f74a4d4d4ff7d0872c3472340b7bc0652b6d68c
SHA512 d193741e7fc71372d1e13d75716467ed3deb46649d515882e32ae39b3d194c8b9b19e3afb18bf38ec7d12d3bb7a616e04f715ad25fb5873935a7cfd3735c22df
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	b2cc4637dbd26123d5401d4040ded43a618d8a719510692fc85ae87a4789173e.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	b2cc4637dbd26123d5401d4040ded43a618d8a719510692fc85ae87a4789173e.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	b2cc4637dbd26123d5401d4040ded43a618d8a719510692fc85ae87a4789173e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	b2cc4637dbd26123d5401d4040ded43a618d8a719510692fc85ae87a4789173e.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	b2cc4637dbd26123d5401d4040ded43a618d8a719510692fc85ae87a4789173e.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	b2cc4637dbd26123d5401d4040ded43a618d8a719510692fc85ae87a4789173e.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
3152	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3160 wrote to memory of 1892	3160	b2cc4637dbd26123d5401d4040ded43a618d8a719510692fc85ae87a4789173e.exe	78
PID 3160 wrote to memory of 1892	3160	b2cc4637dbd26123d5401d4040ded43a618d8a719510692fc85ae87a4789173e.exe	78
PID 3160 wrote to memory of 1892	3160	b2cc4637dbd26123d5401d4040ded43a618d8a719510692fc85ae87a4789173e.exe	78
PID 3160 wrote to memory of 3856	3160	b2cc4637dbd26123d5401d4040ded43a618d8a719510692fc85ae87a4789173e.exe	79
PID 3160 wrote to memory of 3856	3160	b2cc4637dbd26123d5401d4040ded43a618d8a719510692fc85ae87a4789173e.exe	79
PID 3160 wrote to memory of 3856	3160	b2cc4637dbd26123d5401d4040ded43a618d8a719510692fc85ae87a4789173e.exe	79
PID 3856 wrote to memory of 3152	3856	cmd.exe	81
PID 3856 wrote to memory of 3152	3856	cmd.exe	81
PID 3856 wrote to memory of 3152	3856	cmd.exe	81