qakbot | fc5cdcb48d28e667120549379c01df4d533d9a84f5424322ca9bd804d6ad6c07

General

Target
fc5cdcb48d28e667120549379c01df4d533d9a84f5424322ca9bd804d6ad6c07.exe
Size 270KB
Sample201115-y48rewkre6
SHA256 fc5cdcb48d28e667120549379c01df4d533d9a84f5424322ca9bd804d6ad6c07
MD5 0b8b07534c0f9d1fd5afc39768e96ad6
SHA1 343ffff581c82411ff1d1eb782f4bf4dd2984ea7
SHA512 539f5bcb2409b9d7745f8f820e05ddc90d98ae7b5ccfd1b7f28ca43a8cc698859b0c8e48e59253cd8a92b663b302d8dcfbe45681d9721fa5373deb983a835736
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	fc5cdcb48d28e667120549379c01df4d533d9a84f5424322ca9bd804d6ad6c07.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	fc5cdcb48d28e667120549379c01df4d533d9a84f5424322ca9bd804d6ad6c07.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	fc5cdcb48d28e667120549379c01df4d533d9a84f5424322ca9bd804d6ad6c07.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	fc5cdcb48d28e667120549379c01df4d533d9a84f5424322ca9bd804d6ad6c07.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	fc5cdcb48d28e667120549379c01df4d533d9a84f5424322ca9bd804d6ad6c07.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	fc5cdcb48d28e667120549379c01df4d533d9a84f5424322ca9bd804d6ad6c07.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
768	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1060	fc5cdcb48d28e667120549379c01df4d533d9a84f5424322ca9bd804d6ad6c07.exe
1060	fc5cdcb48d28e667120549379c01df4d533d9a84f5424322ca9bd804d6ad6c07.exe
1944	fc5cdcb48d28e667120549379c01df4d533d9a84f5424322ca9bd804d6ad6c07.exe
1944	fc5cdcb48d28e667120549379c01df4d533d9a84f5424322ca9bd804d6ad6c07.exe
1944	fc5cdcb48d28e667120549379c01df4d533d9a84f5424322ca9bd804d6ad6c07.exe
1944	fc5cdcb48d28e667120549379c01df4d533d9a84f5424322ca9bd804d6ad6c07.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1060 wrote to memory of 1944	1060	fc5cdcb48d28e667120549379c01df4d533d9a84f5424322ca9bd804d6ad6c07.exe	79
PID 1060 wrote to memory of 1944	1060	fc5cdcb48d28e667120549379c01df4d533d9a84f5424322ca9bd804d6ad6c07.exe	79
PID 1060 wrote to memory of 1944	1060	fc5cdcb48d28e667120549379c01df4d533d9a84f5424322ca9bd804d6ad6c07.exe	79
PID 1060 wrote to memory of 2712	1060	fc5cdcb48d28e667120549379c01df4d533d9a84f5424322ca9bd804d6ad6c07.exe	80
PID 1060 wrote to memory of 2712	1060	fc5cdcb48d28e667120549379c01df4d533d9a84f5424322ca9bd804d6ad6c07.exe	80
PID 1060 wrote to memory of 2712	1060	fc5cdcb48d28e667120549379c01df4d533d9a84f5424322ca9bd804d6ad6c07.exe	80
PID 2712 wrote to memory of 768	2712	cmd.exe	82
PID 2712 wrote to memory of 768	2712	cmd.exe	82
PID 2712 wrote to memory of 768	2712	cmd.exe	82