qakbot | 4403eee4723d0ad9f7b4e9283807ff0a13fc3ceb6ef949c4b539b2d0799b73fb

General

Target
4403eee4723d0ad9f7b4e9283807ff0a13fc3ceb6ef949c4b539b2d0799b73fb.exe
Size 270KB
Sample201115-lhr2acpdja
SHA256 4403eee4723d0ad9f7b4e9283807ff0a13fc3ceb6ef949c4b539b2d0799b73fb
MD5 8712bba71236b4fbdfdfb2fec53cf668
SHA1 d97cf68d3f8479e26194ee7fb05ee437636ffb74
SHA512 de5c54e37afd2bc260dc5d2608a77ac23c58924d841a5d214463199fe20478d21f35697c2049c04c803e7b9864fbd3dc678bf2a953e408898248d6341643148b
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	4403eee4723d0ad9f7b4e9283807ff0a13fc3ceb6ef949c4b539b2d0799b73fb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	4403eee4723d0ad9f7b4e9283807ff0a13fc3ceb6ef949c4b539b2d0799b73fb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	4403eee4723d0ad9f7b4e9283807ff0a13fc3ceb6ef949c4b539b2d0799b73fb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	4403eee4723d0ad9f7b4e9283807ff0a13fc3ceb6ef949c4b539b2d0799b73fb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	4403eee4723d0ad9f7b4e9283807ff0a13fc3ceb6ef949c4b539b2d0799b73fb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	4403eee4723d0ad9f7b4e9283807ff0a13fc3ceb6ef949c4b539b2d0799b73fb.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
636	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4764	4403eee4723d0ad9f7b4e9283807ff0a13fc3ceb6ef949c4b539b2d0799b73fb.exe
4764	4403eee4723d0ad9f7b4e9283807ff0a13fc3ceb6ef949c4b539b2d0799b73fb.exe
4184	4403eee4723d0ad9f7b4e9283807ff0a13fc3ceb6ef949c4b539b2d0799b73fb.exe
4184	4403eee4723d0ad9f7b4e9283807ff0a13fc3ceb6ef949c4b539b2d0799b73fb.exe
4184	4403eee4723d0ad9f7b4e9283807ff0a13fc3ceb6ef949c4b539b2d0799b73fb.exe
4184	4403eee4723d0ad9f7b4e9283807ff0a13fc3ceb6ef949c4b539b2d0799b73fb.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4764 wrote to memory of 4184	4764	4403eee4723d0ad9f7b4e9283807ff0a13fc3ceb6ef949c4b539b2d0799b73fb.exe	78
PID 4764 wrote to memory of 4184	4764	4403eee4723d0ad9f7b4e9283807ff0a13fc3ceb6ef949c4b539b2d0799b73fb.exe	78
PID 4764 wrote to memory of 4184	4764	4403eee4723d0ad9f7b4e9283807ff0a13fc3ceb6ef949c4b539b2d0799b73fb.exe	78
PID 4764 wrote to memory of 4328	4764	4403eee4723d0ad9f7b4e9283807ff0a13fc3ceb6ef949c4b539b2d0799b73fb.exe	79
PID 4764 wrote to memory of 4328	4764	4403eee4723d0ad9f7b4e9283807ff0a13fc3ceb6ef949c4b539b2d0799b73fb.exe	79
PID 4764 wrote to memory of 4328	4764	4403eee4723d0ad9f7b4e9283807ff0a13fc3ceb6ef949c4b539b2d0799b73fb.exe	79
PID 4328 wrote to memory of 636	4328	cmd.exe	81
PID 4328 wrote to memory of 636	4328	cmd.exe	81
PID 4328 wrote to memory of 636	4328	cmd.exe	81