qakbot | d946deeeff734644a86d7b254ad9d69f730e2014411404696da19dbd508711c4

General

Target
d946deeeff734644a86d7b254ad9d69f730e2014411404696da19dbd508711c4.exe
Size 270KB
Sample201105-9ckmg5r136
SHA256 d946deeeff734644a86d7b254ad9d69f730e2014411404696da19dbd508711c4
MD5 e719222bd4624f1c0a92117fe33e2612
SHA1 4a4c0fd4f278c2abb699b03afe9c8e93dc578f3d
SHA512 437eca616ce0b6fa894b11d317f4ae93e8c30d76b2eb1580c56a1d55e31b4449aec76a037c54c56d7fa04418263ea57c042a27cc4fd929d1d018ead3a3aea457
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	d946deeeff734644a86d7b254ad9d69f730e2014411404696da19dbd508711c4.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	d946deeeff734644a86d7b254ad9d69f730e2014411404696da19dbd508711c4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	d946deeeff734644a86d7b254ad9d69f730e2014411404696da19dbd508711c4.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	d946deeeff734644a86d7b254ad9d69f730e2014411404696da19dbd508711c4.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	d946deeeff734644a86d7b254ad9d69f730e2014411404696da19dbd508711c4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	d946deeeff734644a86d7b254ad9d69f730e2014411404696da19dbd508711c4.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
2736	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 644 wrote to memory of 4016	644	d946deeeff734644a86d7b254ad9d69f730e2014411404696da19dbd508711c4.exe	78
PID 644 wrote to memory of 4016	644	d946deeeff734644a86d7b254ad9d69f730e2014411404696da19dbd508711c4.exe	78
PID 644 wrote to memory of 4016	644	d946deeeff734644a86d7b254ad9d69f730e2014411404696da19dbd508711c4.exe	78
PID 644 wrote to memory of 1424	644	d946deeeff734644a86d7b254ad9d69f730e2014411404696da19dbd508711c4.exe	79
PID 644 wrote to memory of 1424	644	d946deeeff734644a86d7b254ad9d69f730e2014411404696da19dbd508711c4.exe	79
PID 644 wrote to memory of 1424	644	d946deeeff734644a86d7b254ad9d69f730e2014411404696da19dbd508711c4.exe	79
PID 1424 wrote to memory of 2736	1424	cmd.exe	81
PID 1424 wrote to memory of 2736	1424	cmd.exe	81
PID 1424 wrote to memory of 2736	1424	cmd.exe	81