qakbot | 70f4afc3fd63a2ee62cdb0a20e83981899895f1b8104dc94c35d8aad9e7a0b88

General

Target
70f4afc3fd63a2ee62cdb0a20e83981899895f1b8104dc94c35d8aad9e7a0b88.exe
Size 270KB
Sample201115-4c8wg2alg6
SHA256 70f4afc3fd63a2ee62cdb0a20e83981899895f1b8104dc94c35d8aad9e7a0b88
MD5 3289d660a3c81164a17c1609f0ae060f
SHA1 76270d6da613c4f6fd1c1ab825ff780bef4b563f
SHA512 15fa5f9a90a3178b5611460b3668f057f448439cadb28812a2b95e7cb8836c104ef021f81fdfa5b28495014f84bcf41e42c2eac43da84eba4f1c6b4a54d15eb1
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	70f4afc3fd63a2ee62cdb0a20e83981899895f1b8104dc94c35d8aad9e7a0b88.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	70f4afc3fd63a2ee62cdb0a20e83981899895f1b8104dc94c35d8aad9e7a0b88.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	70f4afc3fd63a2ee62cdb0a20e83981899895f1b8104dc94c35d8aad9e7a0b88.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	70f4afc3fd63a2ee62cdb0a20e83981899895f1b8104dc94c35d8aad9e7a0b88.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	70f4afc3fd63a2ee62cdb0a20e83981899895f1b8104dc94c35d8aad9e7a0b88.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	70f4afc3fd63a2ee62cdb0a20e83981899895f1b8104dc94c35d8aad9e7a0b88.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
1096	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4076	70f4afc3fd63a2ee62cdb0a20e83981899895f1b8104dc94c35d8aad9e7a0b88.exe
4076	70f4afc3fd63a2ee62cdb0a20e83981899895f1b8104dc94c35d8aad9e7a0b88.exe
2576	70f4afc3fd63a2ee62cdb0a20e83981899895f1b8104dc94c35d8aad9e7a0b88.exe
2576	70f4afc3fd63a2ee62cdb0a20e83981899895f1b8104dc94c35d8aad9e7a0b88.exe
2576	70f4afc3fd63a2ee62cdb0a20e83981899895f1b8104dc94c35d8aad9e7a0b88.exe
2576	70f4afc3fd63a2ee62cdb0a20e83981899895f1b8104dc94c35d8aad9e7a0b88.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4076 wrote to memory of 2576	4076	70f4afc3fd63a2ee62cdb0a20e83981899895f1b8104dc94c35d8aad9e7a0b88.exe	78
PID 4076 wrote to memory of 2576	4076	70f4afc3fd63a2ee62cdb0a20e83981899895f1b8104dc94c35d8aad9e7a0b88.exe	78
PID 4076 wrote to memory of 2576	4076	70f4afc3fd63a2ee62cdb0a20e83981899895f1b8104dc94c35d8aad9e7a0b88.exe	78
PID 4076 wrote to memory of 2848	4076	70f4afc3fd63a2ee62cdb0a20e83981899895f1b8104dc94c35d8aad9e7a0b88.exe	79
PID 4076 wrote to memory of 2848	4076	70f4afc3fd63a2ee62cdb0a20e83981899895f1b8104dc94c35d8aad9e7a0b88.exe	79
PID 4076 wrote to memory of 2848	4076	70f4afc3fd63a2ee62cdb0a20e83981899895f1b8104dc94c35d8aad9e7a0b88.exe	79
PID 2848 wrote to memory of 1096	2848	cmd.exe	81
PID 2848 wrote to memory of 1096	2848	cmd.exe	81
PID 2848 wrote to memory of 1096	2848	cmd.exe	81