qakbot | fad3bef0301e1ecfddca2e63b90700f1f07e52d29cfaf7f4f213e65963e745c4

General

Target
fad3bef0301e1ecfddca2e63b90700f1f07e52d29cfaf7f4f213e65963e745c4.exe
Size 254KB
Sample201115-bcm7rx1ewa
SHA256 fad3bef0301e1ecfddca2e63b90700f1f07e52d29cfaf7f4f213e65963e745c4
MD5 7343af8f14acfa9a335db157fac7bc98
SHA1 9f458222005614213f7cbd74fcbcf997d852985f
SHA512 9d7af838f02efeb2e917205795848a3f3c2ad08d7b490d955a42315814663490637f480727075f3319509e0d4d9ecdf70d3eb7cbd8a87bc889e059962abc7fc9
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	fad3bef0301e1ecfddca2e63b90700f1f07e52d29cfaf7f4f213e65963e745c4.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	fad3bef0301e1ecfddca2e63b90700f1f07e52d29cfaf7f4f213e65963e745c4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	fad3bef0301e1ecfddca2e63b90700f1f07e52d29cfaf7f4f213e65963e745c4.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	fad3bef0301e1ecfddca2e63b90700f1f07e52d29cfaf7f4f213e65963e745c4.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	fad3bef0301e1ecfddca2e63b90700f1f07e52d29cfaf7f4f213e65963e745c4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	fad3bef0301e1ecfddca2e63b90700f1f07e52d29cfaf7f4f213e65963e745c4.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
668	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
676	fad3bef0301e1ecfddca2e63b90700f1f07e52d29cfaf7f4f213e65963e745c4.exe
676	fad3bef0301e1ecfddca2e63b90700f1f07e52d29cfaf7f4f213e65963e745c4.exe
1184	fad3bef0301e1ecfddca2e63b90700f1f07e52d29cfaf7f4f213e65963e745c4.exe
1184	fad3bef0301e1ecfddca2e63b90700f1f07e52d29cfaf7f4f213e65963e745c4.exe
1184	fad3bef0301e1ecfddca2e63b90700f1f07e52d29cfaf7f4f213e65963e745c4.exe
1184	fad3bef0301e1ecfddca2e63b90700f1f07e52d29cfaf7f4f213e65963e745c4.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 676 wrote to memory of 1184	676	fad3bef0301e1ecfddca2e63b90700f1f07e52d29cfaf7f4f213e65963e745c4.exe	79
PID 676 wrote to memory of 1184	676	fad3bef0301e1ecfddca2e63b90700f1f07e52d29cfaf7f4f213e65963e745c4.exe	79
PID 676 wrote to memory of 1184	676	fad3bef0301e1ecfddca2e63b90700f1f07e52d29cfaf7f4f213e65963e745c4.exe	79
PID 676 wrote to memory of 1984	676	fad3bef0301e1ecfddca2e63b90700f1f07e52d29cfaf7f4f213e65963e745c4.exe	80
PID 676 wrote to memory of 1984	676	fad3bef0301e1ecfddca2e63b90700f1f07e52d29cfaf7f4f213e65963e745c4.exe	80
PID 676 wrote to memory of 1984	676	fad3bef0301e1ecfddca2e63b90700f1f07e52d29cfaf7f4f213e65963e745c4.exe	80
PID 1984 wrote to memory of 668	1984	cmd.exe	82
PID 1984 wrote to memory of 668	1984	cmd.exe	82
PID 1984 wrote to memory of 668	1984	cmd.exe	82