qakbot | f728716c490fdee6cd66e6d4122c9ff41f23530f2867a235a8963117bcdd7c3e

General

Target
f728716c490fdee6cd66e6d4122c9ff41f23530f2867a235a8963117bcdd7c3e.exe
Size 1.4MB
Sample201106-b1bsvd1ffa
SHA256 f728716c490fdee6cd66e6d4122c9ff41f23530f2867a235a8963117bcdd7c3e
MD5 0c10f88062cfeeb7d894d5397fa262cd
SHA1 839f9e6d54774ee5a412fd56d80c76c2db201a89
SHA512 66eed3160d7e54be613a5031c3805e048b6d082f728c240927c002971a622bd5f6499c9b4e282ac5f245e37dd22422822416f9415aa769c3d20db13dabfc8867
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	f728716c490fdee6cd66e6d4122c9ff41f23530f2867a235a8963117bcdd7c3e.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	f728716c490fdee6cd66e6d4122c9ff41f23530f2867a235a8963117bcdd7c3e.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	f728716c490fdee6cd66e6d4122c9ff41f23530f2867a235a8963117bcdd7c3e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	f728716c490fdee6cd66e6d4122c9ff41f23530f2867a235a8963117bcdd7c3e.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	f728716c490fdee6cd66e6d4122c9ff41f23530f2867a235a8963117bcdd7c3e.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	f728716c490fdee6cd66e6d4122c9ff41f23530f2867a235a8963117bcdd7c3e.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
504	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
648	f728716c490fdee6cd66e6d4122c9ff41f23530f2867a235a8963117bcdd7c3e.exe
648	f728716c490fdee6cd66e6d4122c9ff41f23530f2867a235a8963117bcdd7c3e.exe
2704	f728716c490fdee6cd66e6d4122c9ff41f23530f2867a235a8963117bcdd7c3e.exe
2704	f728716c490fdee6cd66e6d4122c9ff41f23530f2867a235a8963117bcdd7c3e.exe
2704	f728716c490fdee6cd66e6d4122c9ff41f23530f2867a235a8963117bcdd7c3e.exe
2704	f728716c490fdee6cd66e6d4122c9ff41f23530f2867a235a8963117bcdd7c3e.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 648 wrote to memory of 2704	648	f728716c490fdee6cd66e6d4122c9ff41f23530f2867a235a8963117bcdd7c3e.exe	75
PID 648 wrote to memory of 2704	648	f728716c490fdee6cd66e6d4122c9ff41f23530f2867a235a8963117bcdd7c3e.exe	75
PID 648 wrote to memory of 2704	648	f728716c490fdee6cd66e6d4122c9ff41f23530f2867a235a8963117bcdd7c3e.exe	75
PID 648 wrote to memory of 3768	648	f728716c490fdee6cd66e6d4122c9ff41f23530f2867a235a8963117bcdd7c3e.exe	76
PID 648 wrote to memory of 3768	648	f728716c490fdee6cd66e6d4122c9ff41f23530f2867a235a8963117bcdd7c3e.exe	76
PID 648 wrote to memory of 3768	648	f728716c490fdee6cd66e6d4122c9ff41f23530f2867a235a8963117bcdd7c3e.exe	76
PID 3768 wrote to memory of 504	3768	cmd.exe	78
PID 3768 wrote to memory of 504	3768	cmd.exe	78
PID 3768 wrote to memory of 504	3768	cmd.exe	78