qakbot | 1f5c36da5a61ae77cd1afebd01be90d1a875b0be7056abec586c731bdf61eff6

General

Target
1f5c36da5a61ae77cd1afebd01be90d1a875b0be7056abec586c731bdf61eff6.exe
Size 270KB
Sample201115-q66mb3mkjs
SHA256 1f5c36da5a61ae77cd1afebd01be90d1a875b0be7056abec586c731bdf61eff6
MD5 40ce6052baa6b71eb81502e8b3ff0f3c
SHA1 d36524757d0d91795ea9669e5d961ba1303501ff
SHA512 67b517a6c7e59df04c271fa532fa742c17271fbe1baecfd6eded65ee2359a04b093ba62e81d8304d7f3aa26ba86df9af1401a60456cc2687b3d1b9dac73338af
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	1f5c36da5a61ae77cd1afebd01be90d1a875b0be7056abec586c731bdf61eff6.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	1f5c36da5a61ae77cd1afebd01be90d1a875b0be7056abec586c731bdf61eff6.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	1f5c36da5a61ae77cd1afebd01be90d1a875b0be7056abec586c731bdf61eff6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	1f5c36da5a61ae77cd1afebd01be90d1a875b0be7056abec586c731bdf61eff6.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	1f5c36da5a61ae77cd1afebd01be90d1a875b0be7056abec586c731bdf61eff6.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	1f5c36da5a61ae77cd1afebd01be90d1a875b0be7056abec586c731bdf61eff6.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
4084	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3980	1f5c36da5a61ae77cd1afebd01be90d1a875b0be7056abec586c731bdf61eff6.exe
3980	1f5c36da5a61ae77cd1afebd01be90d1a875b0be7056abec586c731bdf61eff6.exe
2920	1f5c36da5a61ae77cd1afebd01be90d1a875b0be7056abec586c731bdf61eff6.exe
2920	1f5c36da5a61ae77cd1afebd01be90d1a875b0be7056abec586c731bdf61eff6.exe
2920	1f5c36da5a61ae77cd1afebd01be90d1a875b0be7056abec586c731bdf61eff6.exe
2920	1f5c36da5a61ae77cd1afebd01be90d1a875b0be7056abec586c731bdf61eff6.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3980 wrote to memory of 2920	3980	1f5c36da5a61ae77cd1afebd01be90d1a875b0be7056abec586c731bdf61eff6.exe	79
PID 3980 wrote to memory of 2920	3980	1f5c36da5a61ae77cd1afebd01be90d1a875b0be7056abec586c731bdf61eff6.exe	79
PID 3980 wrote to memory of 2920	3980	1f5c36da5a61ae77cd1afebd01be90d1a875b0be7056abec586c731bdf61eff6.exe	79
PID 3980 wrote to memory of 940	3980	1f5c36da5a61ae77cd1afebd01be90d1a875b0be7056abec586c731bdf61eff6.exe	80
PID 3980 wrote to memory of 940	3980	1f5c36da5a61ae77cd1afebd01be90d1a875b0be7056abec586c731bdf61eff6.exe	80
PID 3980 wrote to memory of 940	3980	1f5c36da5a61ae77cd1afebd01be90d1a875b0be7056abec586c731bdf61eff6.exe	80
PID 940 wrote to memory of 4084	940	cmd.exe	82
PID 940 wrote to memory of 4084	940	cmd.exe	82
PID 940 wrote to memory of 4084	940	cmd.exe	82