qakbot | aa6f6ad650e54086167bc3cdb5d8764f066e36e1e5d536edd16f06b38d03f414

General

Target
aa6f6ad650e54086167bc3cdb5d8764f066e36e1e5d536edd16f06b38d03f414.exe
Size 270KB
Sample201115-841hdk7j7a
SHA256 aa6f6ad650e54086167bc3cdb5d8764f066e36e1e5d536edd16f06b38d03f414
MD5 f4927978a5494a2f58a2abd111ff0834
SHA1 4e29f719a7a52d59ff0ba5a410bd520a5071f002
SHA512 e0f18c1f98fe1fa93ebf9bc33bd73aa87bf6f46c8f376149132c4905348e9c4063ab4290be7ede6580f6f38800097740e0bd10322119a93dc2e96e542205a987
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	aa6f6ad650e54086167bc3cdb5d8764f066e36e1e5d536edd16f06b38d03f414.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	aa6f6ad650e54086167bc3cdb5d8764f066e36e1e5d536edd16f06b38d03f414.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	aa6f6ad650e54086167bc3cdb5d8764f066e36e1e5d536edd16f06b38d03f414.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	aa6f6ad650e54086167bc3cdb5d8764f066e36e1e5d536edd16f06b38d03f414.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	aa6f6ad650e54086167bc3cdb5d8764f066e36e1e5d536edd16f06b38d03f414.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	aa6f6ad650e54086167bc3cdb5d8764f066e36e1e5d536edd16f06b38d03f414.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
3452	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
632	aa6f6ad650e54086167bc3cdb5d8764f066e36e1e5d536edd16f06b38d03f414.exe
632	aa6f6ad650e54086167bc3cdb5d8764f066e36e1e5d536edd16f06b38d03f414.exe
1944	aa6f6ad650e54086167bc3cdb5d8764f066e36e1e5d536edd16f06b38d03f414.exe
1944	aa6f6ad650e54086167bc3cdb5d8764f066e36e1e5d536edd16f06b38d03f414.exe
1944	aa6f6ad650e54086167bc3cdb5d8764f066e36e1e5d536edd16f06b38d03f414.exe
1944	aa6f6ad650e54086167bc3cdb5d8764f066e36e1e5d536edd16f06b38d03f414.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 632 wrote to memory of 1944	632	aa6f6ad650e54086167bc3cdb5d8764f066e36e1e5d536edd16f06b38d03f414.exe	78
PID 632 wrote to memory of 1944	632	aa6f6ad650e54086167bc3cdb5d8764f066e36e1e5d536edd16f06b38d03f414.exe	78
PID 632 wrote to memory of 1944	632	aa6f6ad650e54086167bc3cdb5d8764f066e36e1e5d536edd16f06b38d03f414.exe	78
PID 632 wrote to memory of 1340	632	aa6f6ad650e54086167bc3cdb5d8764f066e36e1e5d536edd16f06b38d03f414.exe	79
PID 632 wrote to memory of 1340	632	aa6f6ad650e54086167bc3cdb5d8764f066e36e1e5d536edd16f06b38d03f414.exe	79
PID 632 wrote to memory of 1340	632	aa6f6ad650e54086167bc3cdb5d8764f066e36e1e5d536edd16f06b38d03f414.exe	79
PID 1340 wrote to memory of 3452	1340	cmd.exe	81
PID 1340 wrote to memory of 3452	1340	cmd.exe	81
PID 1340 wrote to memory of 3452	1340	cmd.exe	81