qakbot | bb114f4de8e76b31de99bf0e09cb03dfc3883b4e4a5171b6b67445040df91ed8

General

Target
bb114f4de8e76b31de99bf0e09cb03dfc3883b4e4a5171b6b67445040df91ed8.exe
Size 270KB
Sample201109-hf4lbebj2n
SHA256 bb114f4de8e76b31de99bf0e09cb03dfc3883b4e4a5171b6b67445040df91ed8
MD5 579167f6c6d59be12817b2b6e1ebd0da
SHA1 80e2942803cfd9e7f92a7f1336ecf3e010ba8336
SHA512 eac544988a9246d4702f1e0eefc2cb576fcf3824d021a790cef90363269958abacec02a21fd13ab923f0349138afc2c79cf55bbc0c6f49e8648b6ac0238f828f
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	bb114f4de8e76b31de99bf0e09cb03dfc3883b4e4a5171b6b67445040df91ed8.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	bb114f4de8e76b31de99bf0e09cb03dfc3883b4e4a5171b6b67445040df91ed8.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	bb114f4de8e76b31de99bf0e09cb03dfc3883b4e4a5171b6b67445040df91ed8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	bb114f4de8e76b31de99bf0e09cb03dfc3883b4e4a5171b6b67445040df91ed8.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	bb114f4de8e76b31de99bf0e09cb03dfc3883b4e4a5171b6b67445040df91ed8.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	bb114f4de8e76b31de99bf0e09cb03dfc3883b4e4a5171b6b67445040df91ed8.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
2600	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
648	bb114f4de8e76b31de99bf0e09cb03dfc3883b4e4a5171b6b67445040df91ed8.exe
648	bb114f4de8e76b31de99bf0e09cb03dfc3883b4e4a5171b6b67445040df91ed8.exe
928	bb114f4de8e76b31de99bf0e09cb03dfc3883b4e4a5171b6b67445040df91ed8.exe
928	bb114f4de8e76b31de99bf0e09cb03dfc3883b4e4a5171b6b67445040df91ed8.exe
928	bb114f4de8e76b31de99bf0e09cb03dfc3883b4e4a5171b6b67445040df91ed8.exe
928	bb114f4de8e76b31de99bf0e09cb03dfc3883b4e4a5171b6b67445040df91ed8.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 648 wrote to memory of 928	648	bb114f4de8e76b31de99bf0e09cb03dfc3883b4e4a5171b6b67445040df91ed8.exe	78
PID 648 wrote to memory of 928	648	bb114f4de8e76b31de99bf0e09cb03dfc3883b4e4a5171b6b67445040df91ed8.exe	78
PID 648 wrote to memory of 928	648	bb114f4de8e76b31de99bf0e09cb03dfc3883b4e4a5171b6b67445040df91ed8.exe	78
PID 648 wrote to memory of 3512	648	bb114f4de8e76b31de99bf0e09cb03dfc3883b4e4a5171b6b67445040df91ed8.exe	79
PID 648 wrote to memory of 3512	648	bb114f4de8e76b31de99bf0e09cb03dfc3883b4e4a5171b6b67445040df91ed8.exe	79
PID 648 wrote to memory of 3512	648	bb114f4de8e76b31de99bf0e09cb03dfc3883b4e4a5171b6b67445040df91ed8.exe	79
PID 3512 wrote to memory of 2600	3512	cmd.exe	81
PID 3512 wrote to memory of 2600	3512	cmd.exe	81
PID 3512 wrote to memory of 2600	3512	cmd.exe	81