qakbot | 84e40468a472981cf6c37b92f4b03ddfb165d5d39820c8df107dd95ec28972f6

General

Target
84e40468a472981cf6c37b92f4b03ddfb165d5d39820c8df107dd95ec28972f6.exe
Size 838KB
Sample201105-xglp7pgm62
SHA256 84e40468a472981cf6c37b92f4b03ddfb165d5d39820c8df107dd95ec28972f6
MD5 d4d8e62ef8ae0a54a83e88ca1ac1352b
SHA1 147bf36755da1a0533f43175432912aa63adf338
SHA512 3054f530fc0b9b0466c784e163fd4685da6c9c89e20d418e4e42a4cf04293336917c09421e11a1c40fce058164374aaa1b3dfafdeb5a4eed492bf6a610eb3217
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	84e40468a472981cf6c37b92f4b03ddfb165d5d39820c8df107dd95ec28972f6.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	84e40468a472981cf6c37b92f4b03ddfb165d5d39820c8df107dd95ec28972f6.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	84e40468a472981cf6c37b92f4b03ddfb165d5d39820c8df107dd95ec28972f6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	84e40468a472981cf6c37b92f4b03ddfb165d5d39820c8df107dd95ec28972f6.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	84e40468a472981cf6c37b92f4b03ddfb165d5d39820c8df107dd95ec28972f6.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	84e40468a472981cf6c37b92f4b03ddfb165d5d39820c8df107dd95ec28972f6.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
908	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4768	84e40468a472981cf6c37b92f4b03ddfb165d5d39820c8df107dd95ec28972f6.exe
4768	84e40468a472981cf6c37b92f4b03ddfb165d5d39820c8df107dd95ec28972f6.exe
2092	84e40468a472981cf6c37b92f4b03ddfb165d5d39820c8df107dd95ec28972f6.exe
2092	84e40468a472981cf6c37b92f4b03ddfb165d5d39820c8df107dd95ec28972f6.exe
2092	84e40468a472981cf6c37b92f4b03ddfb165d5d39820c8df107dd95ec28972f6.exe
2092	84e40468a472981cf6c37b92f4b03ddfb165d5d39820c8df107dd95ec28972f6.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4768 wrote to memory of 2092	4768	84e40468a472981cf6c37b92f4b03ddfb165d5d39820c8df107dd95ec28972f6.exe	78
PID 4768 wrote to memory of 2092	4768	84e40468a472981cf6c37b92f4b03ddfb165d5d39820c8df107dd95ec28972f6.exe	78
PID 4768 wrote to memory of 2092	4768	84e40468a472981cf6c37b92f4b03ddfb165d5d39820c8df107dd95ec28972f6.exe	78
PID 4768 wrote to memory of 552	4768	84e40468a472981cf6c37b92f4b03ddfb165d5d39820c8df107dd95ec28972f6.exe	79
PID 4768 wrote to memory of 552	4768	84e40468a472981cf6c37b92f4b03ddfb165d5d39820c8df107dd95ec28972f6.exe	79
PID 4768 wrote to memory of 552	4768	84e40468a472981cf6c37b92f4b03ddfb165d5d39820c8df107dd95ec28972f6.exe	79
PID 552 wrote to memory of 908	552	cmd.exe	81
PID 552 wrote to memory of 908	552	cmd.exe	81
PID 552 wrote to memory of 908	552	cmd.exe	81