qakbot | 4cf82d583d9b0a153239079f9a0058ef4b2e6c6be2f0123b9198c561ffd42364

General

Target
4cf82d583d9b0a153239079f9a0058ef4b2e6c6be2f0123b9198c561ffd42364.exe
Size 250KB
Sample201106-ja2vkevv3e
SHA256 4cf82d583d9b0a153239079f9a0058ef4b2e6c6be2f0123b9198c561ffd42364
MD5 f8c944e792acc0e10caca5eb2f934f40
SHA1 e776dc8d3a3dc02a31dee39357b74326d16b9832
SHA512 8a3a6f02d358ea194980da75d1d04c6c2854f84c60ea46ebea437b257fde67b9c7739d5ab1ddec09b27fe59346d09ab5fcbd4978f0b02b574a55bbfcea4ed14a
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	4cf82d583d9b0a153239079f9a0058ef4b2e6c6be2f0123b9198c561ffd42364.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	4cf82d583d9b0a153239079f9a0058ef4b2e6c6be2f0123b9198c561ffd42364.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	4cf82d583d9b0a153239079f9a0058ef4b2e6c6be2f0123b9198c561ffd42364.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	4cf82d583d9b0a153239079f9a0058ef4b2e6c6be2f0123b9198c561ffd42364.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	4cf82d583d9b0a153239079f9a0058ef4b2e6c6be2f0123b9198c561ffd42364.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	4cf82d583d9b0a153239079f9a0058ef4b2e6c6be2f0123b9198c561ffd42364.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
452	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 2152	4800	4cf82d583d9b0a153239079f9a0058ef4b2e6c6be2f0123b9198c561ffd42364.exe	78
PID 4800 wrote to memory of 2152	4800	4cf82d583d9b0a153239079f9a0058ef4b2e6c6be2f0123b9198c561ffd42364.exe	78
PID 4800 wrote to memory of 2152	4800	4cf82d583d9b0a153239079f9a0058ef4b2e6c6be2f0123b9198c561ffd42364.exe	78
PID 4800 wrote to memory of 4272	4800	4cf82d583d9b0a153239079f9a0058ef4b2e6c6be2f0123b9198c561ffd42364.exe	79
PID 4800 wrote to memory of 4272	4800	4cf82d583d9b0a153239079f9a0058ef4b2e6c6be2f0123b9198c561ffd42364.exe	79
PID 4800 wrote to memory of 4272	4800	4cf82d583d9b0a153239079f9a0058ef4b2e6c6be2f0123b9198c561ffd42364.exe	79
PID 4272 wrote to memory of 452	4272	cmd.exe	81
PID 4272 wrote to memory of 452	4272	cmd.exe	81
PID 4272 wrote to memory of 452	4272	cmd.exe	81