qakbot | 2087fdd8a2e0c1ee71599f9a90b2234a58e70eb74693fd3bf58b9185b5f47fde

General

Target
2087fdd8a2e0c1ee71599f9a90b2234a58e70eb74693fd3bf58b9185b5f47fde.exe
Size 838KB
Sample201108-5je194bbcs
SHA256 2087fdd8a2e0c1ee71599f9a90b2234a58e70eb74693fd3bf58b9185b5f47fde
MD5 94ba556ff1ab259945864047f6d87524
SHA1 6414d2982cf2112fde3332acef24da36197b4021
SHA512 1b94b41f0150fca53926abcc3bfddb7d5da92445dd262e2edee20d1d94bee8e62607c98e6f7d125760213ba961a13d7ad832d98a4e466a754f9525f890e68f25
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	2087fdd8a2e0c1ee71599f9a90b2234a58e70eb74693fd3bf58b9185b5f47fde.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	2087fdd8a2e0c1ee71599f9a90b2234a58e70eb74693fd3bf58b9185b5f47fde.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	2087fdd8a2e0c1ee71599f9a90b2234a58e70eb74693fd3bf58b9185b5f47fde.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	2087fdd8a2e0c1ee71599f9a90b2234a58e70eb74693fd3bf58b9185b5f47fde.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	2087fdd8a2e0c1ee71599f9a90b2234a58e70eb74693fd3bf58b9185b5f47fde.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	2087fdd8a2e0c1ee71599f9a90b2234a58e70eb74693fd3bf58b9185b5f47fde.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
3824	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3984	2087fdd8a2e0c1ee71599f9a90b2234a58e70eb74693fd3bf58b9185b5f47fde.exe
3984	2087fdd8a2e0c1ee71599f9a90b2234a58e70eb74693fd3bf58b9185b5f47fde.exe
200	2087fdd8a2e0c1ee71599f9a90b2234a58e70eb74693fd3bf58b9185b5f47fde.exe
200	2087fdd8a2e0c1ee71599f9a90b2234a58e70eb74693fd3bf58b9185b5f47fde.exe
200	2087fdd8a2e0c1ee71599f9a90b2234a58e70eb74693fd3bf58b9185b5f47fde.exe
200	2087fdd8a2e0c1ee71599f9a90b2234a58e70eb74693fd3bf58b9185b5f47fde.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3984 wrote to memory of 200	3984	2087fdd8a2e0c1ee71599f9a90b2234a58e70eb74693fd3bf58b9185b5f47fde.exe	78
PID 3984 wrote to memory of 200	3984	2087fdd8a2e0c1ee71599f9a90b2234a58e70eb74693fd3bf58b9185b5f47fde.exe	78
PID 3984 wrote to memory of 200	3984	2087fdd8a2e0c1ee71599f9a90b2234a58e70eb74693fd3bf58b9185b5f47fde.exe	78
PID 3984 wrote to memory of 952	3984	2087fdd8a2e0c1ee71599f9a90b2234a58e70eb74693fd3bf58b9185b5f47fde.exe	79
PID 3984 wrote to memory of 952	3984	2087fdd8a2e0c1ee71599f9a90b2234a58e70eb74693fd3bf58b9185b5f47fde.exe	79
PID 3984 wrote to memory of 952	3984	2087fdd8a2e0c1ee71599f9a90b2234a58e70eb74693fd3bf58b9185b5f47fde.exe	79
PID 952 wrote to memory of 3824	952	cmd.exe	81
PID 952 wrote to memory of 3824	952	cmd.exe	81
PID 952 wrote to memory of 3824	952	cmd.exe	81