qakbot | 46bb53cb64290bd775679b20f09d60933e043e1d2182ab18c62500fc3c4faaf7

General

Target
46bb53cb64290bd775679b20f09d60933e043e1d2182ab18c62500fc3c4faaf7.exe
Size 1.5MB
Sample201115-7wengtjk5x
SHA256 46bb53cb64290bd775679b20f09d60933e043e1d2182ab18c62500fc3c4faaf7
MD5 82862492863b5ad57427a83c02294cd0
SHA1 651d0a9ed14a9415dbeea9cf7c60f594a1ffab69
SHA512 edf6b316755fd77e5d9a53ac5dc77376d9c1ea3f438ceb06a653013c9809f9bf57cb27ae473a38e26f5f470b1311c429fbe484b6169571e93e1db2b3c3f67b52
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	46bb53cb64290bd775679b20f09d60933e043e1d2182ab18c62500fc3c4faaf7.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	46bb53cb64290bd775679b20f09d60933e043e1d2182ab18c62500fc3c4faaf7.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	46bb53cb64290bd775679b20f09d60933e043e1d2182ab18c62500fc3c4faaf7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	46bb53cb64290bd775679b20f09d60933e043e1d2182ab18c62500fc3c4faaf7.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	46bb53cb64290bd775679b20f09d60933e043e1d2182ab18c62500fc3c4faaf7.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	46bb53cb64290bd775679b20f09d60933e043e1d2182ab18c62500fc3c4faaf7.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
2780	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4696	46bb53cb64290bd775679b20f09d60933e043e1d2182ab18c62500fc3c4faaf7.exe
4696	46bb53cb64290bd775679b20f09d60933e043e1d2182ab18c62500fc3c4faaf7.exe
4172	46bb53cb64290bd775679b20f09d60933e043e1d2182ab18c62500fc3c4faaf7.exe
4172	46bb53cb64290bd775679b20f09d60933e043e1d2182ab18c62500fc3c4faaf7.exe
4172	46bb53cb64290bd775679b20f09d60933e043e1d2182ab18c62500fc3c4faaf7.exe
4172	46bb53cb64290bd775679b20f09d60933e043e1d2182ab18c62500fc3c4faaf7.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4696 wrote to memory of 4172	4696	46bb53cb64290bd775679b20f09d60933e043e1d2182ab18c62500fc3c4faaf7.exe	78
PID 4696 wrote to memory of 4172	4696	46bb53cb64290bd775679b20f09d60933e043e1d2182ab18c62500fc3c4faaf7.exe	78
PID 4696 wrote to memory of 4172	4696	46bb53cb64290bd775679b20f09d60933e043e1d2182ab18c62500fc3c4faaf7.exe	78
PID 4696 wrote to memory of 3860	4696	46bb53cb64290bd775679b20f09d60933e043e1d2182ab18c62500fc3c4faaf7.exe	79
PID 4696 wrote to memory of 3860	4696	46bb53cb64290bd775679b20f09d60933e043e1d2182ab18c62500fc3c4faaf7.exe	79
PID 4696 wrote to memory of 3860	4696	46bb53cb64290bd775679b20f09d60933e043e1d2182ab18c62500fc3c4faaf7.exe	79
PID 3860 wrote to memory of 2780	3860	cmd.exe	81
PID 3860 wrote to memory of 2780	3860	cmd.exe	81
PID 3860 wrote to memory of 2780	3860	cmd.exe	81