qakbot | 9ab75fa1b1c139dcbb7b40be3015dbae29beff182738aec2a1a77f4d34e140a5

General

Target
9ab75fa1b1c139dcbb7b40be3015dbae29beff182738aec2a1a77f4d34e140a5.exe
Size 257KB
Sample201108-nlmkmlcpbx
SHA256 9ab75fa1b1c139dcbb7b40be3015dbae29beff182738aec2a1a77f4d34e140a5
MD5 133fd41dc5a86a5b28b05a9fc0ce96d9
SHA1 c5a87935eb4d40f7d24190b41fdef68511ddcd82
SHA512 3378e654f3ae7f5976126a9be007add69e9e16804d5b3e6ad78eafce7a4ed30a75a2af2cfcde722c5b4108d3727c46c305300c1ea3fb6d54d143d91b0e77b81c
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	9ab75fa1b1c139dcbb7b40be3015dbae29beff182738aec2a1a77f4d34e140a5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	9ab75fa1b1c139dcbb7b40be3015dbae29beff182738aec2a1a77f4d34e140a5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	9ab75fa1b1c139dcbb7b40be3015dbae29beff182738aec2a1a77f4d34e140a5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	9ab75fa1b1c139dcbb7b40be3015dbae29beff182738aec2a1a77f4d34e140a5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	9ab75fa1b1c139dcbb7b40be3015dbae29beff182738aec2a1a77f4d34e140a5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	9ab75fa1b1c139dcbb7b40be3015dbae29beff182738aec2a1a77f4d34e140a5.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
3100	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3412	9ab75fa1b1c139dcbb7b40be3015dbae29beff182738aec2a1a77f4d34e140a5.exe
3412	9ab75fa1b1c139dcbb7b40be3015dbae29beff182738aec2a1a77f4d34e140a5.exe
1100	9ab75fa1b1c139dcbb7b40be3015dbae29beff182738aec2a1a77f4d34e140a5.exe
1100	9ab75fa1b1c139dcbb7b40be3015dbae29beff182738aec2a1a77f4d34e140a5.exe
1100	9ab75fa1b1c139dcbb7b40be3015dbae29beff182738aec2a1a77f4d34e140a5.exe
1100	9ab75fa1b1c139dcbb7b40be3015dbae29beff182738aec2a1a77f4d34e140a5.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3412 wrote to memory of 1100	3412	9ab75fa1b1c139dcbb7b40be3015dbae29beff182738aec2a1a77f4d34e140a5.exe	79
PID 3412 wrote to memory of 1100	3412	9ab75fa1b1c139dcbb7b40be3015dbae29beff182738aec2a1a77f4d34e140a5.exe	79
PID 3412 wrote to memory of 1100	3412	9ab75fa1b1c139dcbb7b40be3015dbae29beff182738aec2a1a77f4d34e140a5.exe	79
PID 3412 wrote to memory of 972	3412	9ab75fa1b1c139dcbb7b40be3015dbae29beff182738aec2a1a77f4d34e140a5.exe	80
PID 3412 wrote to memory of 972	3412	9ab75fa1b1c139dcbb7b40be3015dbae29beff182738aec2a1a77f4d34e140a5.exe	80
PID 3412 wrote to memory of 972	3412	9ab75fa1b1c139dcbb7b40be3015dbae29beff182738aec2a1a77f4d34e140a5.exe	80
PID 972 wrote to memory of 3100	972	cmd.exe	82
PID 972 wrote to memory of 3100	972	cmd.exe	82
PID 972 wrote to memory of 3100	972	cmd.exe	82