qakbot | 9d8eb1fc299a3be657eb975c5c7bc69bff72f536c6c02ae2cb98b7f1924aa175

General

Target
9d8eb1fc299a3be657eb975c5c7bc69bff72f536c6c02ae2cb98b7f1924aa175.exe
Size 254KB
Sample201101-mlsgq9c2ce
SHA256 9d8eb1fc299a3be657eb975c5c7bc69bff72f536c6c02ae2cb98b7f1924aa175
MD5 2652cb6dede0a322f2aaa727ba63bc91
SHA1 93f94d86e22ddcd9659b37263cb5c826db3b21e3
SHA512 48393042350e5ecada98cce4b8e3e9fad55b8b00b565fea3a155e8dd922720d236678105a5f6759b435e80135d7a5e4908f77c43f0967d410833ec1b6e4d1201
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	9d8eb1fc299a3be657eb975c5c7bc69bff72f536c6c02ae2cb98b7f1924aa175.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	9d8eb1fc299a3be657eb975c5c7bc69bff72f536c6c02ae2cb98b7f1924aa175.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	9d8eb1fc299a3be657eb975c5c7bc69bff72f536c6c02ae2cb98b7f1924aa175.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	9d8eb1fc299a3be657eb975c5c7bc69bff72f536c6c02ae2cb98b7f1924aa175.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	9d8eb1fc299a3be657eb975c5c7bc69bff72f536c6c02ae2cb98b7f1924aa175.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	9d8eb1fc299a3be657eb975c5c7bc69bff72f536c6c02ae2cb98b7f1924aa175.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
2676	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
732	9d8eb1fc299a3be657eb975c5c7bc69bff72f536c6c02ae2cb98b7f1924aa175.exe
732	9d8eb1fc299a3be657eb975c5c7bc69bff72f536c6c02ae2cb98b7f1924aa175.exe
4072	9d8eb1fc299a3be657eb975c5c7bc69bff72f536c6c02ae2cb98b7f1924aa175.exe
4072	9d8eb1fc299a3be657eb975c5c7bc69bff72f536c6c02ae2cb98b7f1924aa175.exe
4072	9d8eb1fc299a3be657eb975c5c7bc69bff72f536c6c02ae2cb98b7f1924aa175.exe
4072	9d8eb1fc299a3be657eb975c5c7bc69bff72f536c6c02ae2cb98b7f1924aa175.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 732 wrote to memory of 4072	732	9d8eb1fc299a3be657eb975c5c7bc69bff72f536c6c02ae2cb98b7f1924aa175.exe	78
PID 732 wrote to memory of 4072	732	9d8eb1fc299a3be657eb975c5c7bc69bff72f536c6c02ae2cb98b7f1924aa175.exe	78
PID 732 wrote to memory of 4072	732	9d8eb1fc299a3be657eb975c5c7bc69bff72f536c6c02ae2cb98b7f1924aa175.exe	78
PID 732 wrote to memory of 2920	732	9d8eb1fc299a3be657eb975c5c7bc69bff72f536c6c02ae2cb98b7f1924aa175.exe	79
PID 732 wrote to memory of 2920	732	9d8eb1fc299a3be657eb975c5c7bc69bff72f536c6c02ae2cb98b7f1924aa175.exe	79
PID 732 wrote to memory of 2920	732	9d8eb1fc299a3be657eb975c5c7bc69bff72f536c6c02ae2cb98b7f1924aa175.exe	79
PID 2920 wrote to memory of 2676	2920	cmd.exe	81
PID 2920 wrote to memory of 2676	2920	cmd.exe	81
PID 2920 wrote to memory of 2676	2920	cmd.exe	81