qakbot | d1be4ea0a813d768275ffb824cf46342fb435e63d93aadc30c36d68f021234f2

General

Target
d1be4ea0a813d768275ffb824cf46342fb435e63d93aadc30c36d68f021234f2.exe
Size 1.0MB
Sample201106-2nhsckys8n
SHA256 d1be4ea0a813d768275ffb824cf46342fb435e63d93aadc30c36d68f021234f2
MD5 93cd4cc70e4eff4b8ea9f230f4c8db94
SHA1 59ef7d8c1201aabb2b40493767683fceb83c08f5
SHA512 b5a5f0ce174c256ad5e7c06f4ef83183c849e494e7420b9200721067f655fbe4300f95dc1537e2b37db4dc0c562aafb6fb838d38bd2a401959e527da63b95566
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	d1be4ea0a813d768275ffb824cf46342fb435e63d93aadc30c36d68f021234f2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	d1be4ea0a813d768275ffb824cf46342fb435e63d93aadc30c36d68f021234f2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	d1be4ea0a813d768275ffb824cf46342fb435e63d93aadc30c36d68f021234f2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	d1be4ea0a813d768275ffb824cf46342fb435e63d93aadc30c36d68f021234f2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	d1be4ea0a813d768275ffb824cf46342fb435e63d93aadc30c36d68f021234f2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	d1be4ea0a813d768275ffb824cf46342fb435e63d93aadc30c36d68f021234f2.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
2204	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1036	d1be4ea0a813d768275ffb824cf46342fb435e63d93aadc30c36d68f021234f2.exe
1036	d1be4ea0a813d768275ffb824cf46342fb435e63d93aadc30c36d68f021234f2.exe
2448	d1be4ea0a813d768275ffb824cf46342fb435e63d93aadc30c36d68f021234f2.exe
2448	d1be4ea0a813d768275ffb824cf46342fb435e63d93aadc30c36d68f021234f2.exe
2448	d1be4ea0a813d768275ffb824cf46342fb435e63d93aadc30c36d68f021234f2.exe
2448	d1be4ea0a813d768275ffb824cf46342fb435e63d93aadc30c36d68f021234f2.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1036 wrote to memory of 2448	1036	d1be4ea0a813d768275ffb824cf46342fb435e63d93aadc30c36d68f021234f2.exe	79
PID 1036 wrote to memory of 2448	1036	d1be4ea0a813d768275ffb824cf46342fb435e63d93aadc30c36d68f021234f2.exe	79
PID 1036 wrote to memory of 2448	1036	d1be4ea0a813d768275ffb824cf46342fb435e63d93aadc30c36d68f021234f2.exe	79
PID 1036 wrote to memory of 1476	1036	d1be4ea0a813d768275ffb824cf46342fb435e63d93aadc30c36d68f021234f2.exe	80
PID 1036 wrote to memory of 1476	1036	d1be4ea0a813d768275ffb824cf46342fb435e63d93aadc30c36d68f021234f2.exe	80
PID 1036 wrote to memory of 1476	1036	d1be4ea0a813d768275ffb824cf46342fb435e63d93aadc30c36d68f021234f2.exe	80
PID 1476 wrote to memory of 2204	1476	cmd.exe	82
PID 1476 wrote to memory of 2204	1476	cmd.exe	82
PID 1476 wrote to memory of 2204	1476	cmd.exe	82