qakbot | bcb4fb3b8b18d7c6fed80f9ed82f6bda826d9639efa79f1eba58ce8f20e998c2

General

Target
bcb4fb3b8b18d7c6fed80f9ed82f6bda826d9639efa79f1eba58ce8f20e998c2.exe
Size 270KB
Sample201115-qkl12kprk2
SHA256 bcb4fb3b8b18d7c6fed80f9ed82f6bda826d9639efa79f1eba58ce8f20e998c2
MD5 7f8368733f3533c8a4c65b3d68a0148f
SHA1 a583eda3ea6904bf19cae727269cbe1fb6aff7a2
SHA512 56f326cf5ee195a1e244a424335d2f2bebc2effca49d31215a85c4177cd2689418e4d388a7d1a1fd5e483645204b89f8ea41f0fff43c38f1269ba0b4befc70af
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	bcb4fb3b8b18d7c6fed80f9ed82f6bda826d9639efa79f1eba58ce8f20e998c2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	bcb4fb3b8b18d7c6fed80f9ed82f6bda826d9639efa79f1eba58ce8f20e998c2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	bcb4fb3b8b18d7c6fed80f9ed82f6bda826d9639efa79f1eba58ce8f20e998c2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	bcb4fb3b8b18d7c6fed80f9ed82f6bda826d9639efa79f1eba58ce8f20e998c2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	bcb4fb3b8b18d7c6fed80f9ed82f6bda826d9639efa79f1eba58ce8f20e998c2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	bcb4fb3b8b18d7c6fed80f9ed82f6bda826d9639efa79f1eba58ce8f20e998c2.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
3452	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3980	bcb4fb3b8b18d7c6fed80f9ed82f6bda826d9639efa79f1eba58ce8f20e998c2.exe
3980	bcb4fb3b8b18d7c6fed80f9ed82f6bda826d9639efa79f1eba58ce8f20e998c2.exe
1540	bcb4fb3b8b18d7c6fed80f9ed82f6bda826d9639efa79f1eba58ce8f20e998c2.exe
1540	bcb4fb3b8b18d7c6fed80f9ed82f6bda826d9639efa79f1eba58ce8f20e998c2.exe
1540	bcb4fb3b8b18d7c6fed80f9ed82f6bda826d9639efa79f1eba58ce8f20e998c2.exe
1540	bcb4fb3b8b18d7c6fed80f9ed82f6bda826d9639efa79f1eba58ce8f20e998c2.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3980 wrote to memory of 1540	3980	bcb4fb3b8b18d7c6fed80f9ed82f6bda826d9639efa79f1eba58ce8f20e998c2.exe	79
PID 3980 wrote to memory of 1540	3980	bcb4fb3b8b18d7c6fed80f9ed82f6bda826d9639efa79f1eba58ce8f20e998c2.exe	79
PID 3980 wrote to memory of 1540	3980	bcb4fb3b8b18d7c6fed80f9ed82f6bda826d9639efa79f1eba58ce8f20e998c2.exe	79
PID 3980 wrote to memory of 3436	3980	bcb4fb3b8b18d7c6fed80f9ed82f6bda826d9639efa79f1eba58ce8f20e998c2.exe	80
PID 3980 wrote to memory of 3436	3980	bcb4fb3b8b18d7c6fed80f9ed82f6bda826d9639efa79f1eba58ce8f20e998c2.exe	80
PID 3980 wrote to memory of 3436	3980	bcb4fb3b8b18d7c6fed80f9ed82f6bda826d9639efa79f1eba58ce8f20e998c2.exe	80
PID 3436 wrote to memory of 3452	3436	cmd.exe	82
PID 3436 wrote to memory of 3452	3436	cmd.exe	82
PID 3436 wrote to memory of 3452	3436	cmd.exe	82