qakbot | 4501f4605ab99f013c75de4c2ee39bba7632479ab28733de38bc5c7ad78dfac0

General

Target
4501f4605ab99f013c75de4c2ee39bba7632479ab28733de38bc5c7ad78dfac0.exe
Size 1.0MB
Sample201106-5qpy127das
SHA256 4501f4605ab99f013c75de4c2ee39bba7632479ab28733de38bc5c7ad78dfac0
MD5 86227eff9769b40b784973184d6bde2e
SHA1 ac5d34f9016abb02adb808c243829a61d8c1c734
SHA512 09556732497f966ea3aa6771adfe9ebcc9bd3fb638ad1e3e1b1459beb69f94b23a1ee7a75f4b0afbe4dfbdac8cc5a2583d418bfa1e591dc729c86485d2969ede
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	4501f4605ab99f013c75de4c2ee39bba7632479ab28733de38bc5c7ad78dfac0.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	4501f4605ab99f013c75de4c2ee39bba7632479ab28733de38bc5c7ad78dfac0.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	4501f4605ab99f013c75de4c2ee39bba7632479ab28733de38bc5c7ad78dfac0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	4501f4605ab99f013c75de4c2ee39bba7632479ab28733de38bc5c7ad78dfac0.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	4501f4605ab99f013c75de4c2ee39bba7632479ab28733de38bc5c7ad78dfac0.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	4501f4605ab99f013c75de4c2ee39bba7632479ab28733de38bc5c7ad78dfac0.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
3516	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
640	4501f4605ab99f013c75de4c2ee39bba7632479ab28733de38bc5c7ad78dfac0.exe
640	4501f4605ab99f013c75de4c2ee39bba7632479ab28733de38bc5c7ad78dfac0.exe
2308	4501f4605ab99f013c75de4c2ee39bba7632479ab28733de38bc5c7ad78dfac0.exe
2308	4501f4605ab99f013c75de4c2ee39bba7632479ab28733de38bc5c7ad78dfac0.exe
2308	4501f4605ab99f013c75de4c2ee39bba7632479ab28733de38bc5c7ad78dfac0.exe
2308	4501f4605ab99f013c75de4c2ee39bba7632479ab28733de38bc5c7ad78dfac0.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 640 wrote to memory of 2308	640	4501f4605ab99f013c75de4c2ee39bba7632479ab28733de38bc5c7ad78dfac0.exe	78
PID 640 wrote to memory of 2308	640	4501f4605ab99f013c75de4c2ee39bba7632479ab28733de38bc5c7ad78dfac0.exe	78
PID 640 wrote to memory of 2308	640	4501f4605ab99f013c75de4c2ee39bba7632479ab28733de38bc5c7ad78dfac0.exe	78
PID 640 wrote to memory of 3740	640	4501f4605ab99f013c75de4c2ee39bba7632479ab28733de38bc5c7ad78dfac0.exe	79
PID 640 wrote to memory of 3740	640	4501f4605ab99f013c75de4c2ee39bba7632479ab28733de38bc5c7ad78dfac0.exe	79
PID 640 wrote to memory of 3740	640	4501f4605ab99f013c75de4c2ee39bba7632479ab28733de38bc5c7ad78dfac0.exe	79
PID 3740 wrote to memory of 3516	3740	cmd.exe	81
PID 3740 wrote to memory of 3516	3740	cmd.exe	81
PID 3740 wrote to memory of 3516	3740	cmd.exe	81