qakbot | 6fc0902e7abb8dce8e3cd4628aabf30a5a59bb56e587de17562661730db47c1c

General

Target
6fc0902e7abb8dce8e3cd4628aabf30a5a59bb56e587de17562661730db47c1c.exe
Size 270KB
Sample201115-656f3v3kv6
SHA256 6fc0902e7abb8dce8e3cd4628aabf30a5a59bb56e587de17562661730db47c1c
MD5 9100b732e80ae0248fa9c616406fe73d
SHA1 7b55c39af784ad2089a69fb906b6a2c140dd9a55
SHA512 160a7204c98ea3fe402503e6081f2d6bbe89aa75fb65d82522322be556afa0cf15101bc0310a47f81501eb8798954d90ea13ef753f536c216b97868c8b76bce0
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	6fc0902e7abb8dce8e3cd4628aabf30a5a59bb56e587de17562661730db47c1c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	6fc0902e7abb8dce8e3cd4628aabf30a5a59bb56e587de17562661730db47c1c.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	6fc0902e7abb8dce8e3cd4628aabf30a5a59bb56e587de17562661730db47c1c.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	6fc0902e7abb8dce8e3cd4628aabf30a5a59bb56e587de17562661730db47c1c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	6fc0902e7abb8dce8e3cd4628aabf30a5a59bb56e587de17562661730db47c1c.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	6fc0902e7abb8dce8e3cd4628aabf30a5a59bb56e587de17562661730db47c1c.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
2740	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2868	6fc0902e7abb8dce8e3cd4628aabf30a5a59bb56e587de17562661730db47c1c.exe
2868	6fc0902e7abb8dce8e3cd4628aabf30a5a59bb56e587de17562661730db47c1c.exe
208	6fc0902e7abb8dce8e3cd4628aabf30a5a59bb56e587de17562661730db47c1c.exe
208	6fc0902e7abb8dce8e3cd4628aabf30a5a59bb56e587de17562661730db47c1c.exe
208	6fc0902e7abb8dce8e3cd4628aabf30a5a59bb56e587de17562661730db47c1c.exe
208	6fc0902e7abb8dce8e3cd4628aabf30a5a59bb56e587de17562661730db47c1c.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 208	2868	6fc0902e7abb8dce8e3cd4628aabf30a5a59bb56e587de17562661730db47c1c.exe	78
PID 2868 wrote to memory of 208	2868	6fc0902e7abb8dce8e3cd4628aabf30a5a59bb56e587de17562661730db47c1c.exe	78
PID 2868 wrote to memory of 208	2868	6fc0902e7abb8dce8e3cd4628aabf30a5a59bb56e587de17562661730db47c1c.exe	78
PID 2868 wrote to memory of 2640	2868	6fc0902e7abb8dce8e3cd4628aabf30a5a59bb56e587de17562661730db47c1c.exe	79
PID 2868 wrote to memory of 2640	2868	6fc0902e7abb8dce8e3cd4628aabf30a5a59bb56e587de17562661730db47c1c.exe	79
PID 2868 wrote to memory of 2640	2868	6fc0902e7abb8dce8e3cd4628aabf30a5a59bb56e587de17562661730db47c1c.exe	79
PID 2640 wrote to memory of 2740	2640	cmd.exe	81
PID 2640 wrote to memory of 2740	2640	cmd.exe	81
PID 2640 wrote to memory of 2740	2640	cmd.exe	81