qakbot | bb49117541bbda33fd99a2a41c06be02005e513146f5ea2965a21c3ad504dc97

General

Target
bb49117541bbda33fd99a2a41c06be02005e513146f5ea2965a21c3ad504dc97.exe
Size 2.7MB
Sample201109-nrgcss68jj
SHA256 bb49117541bbda33fd99a2a41c06be02005e513146f5ea2965a21c3ad504dc97
MD5 cb5af161e84ffe8a04db26a202e75104
SHA1 6e00dd9d762c3378055f093f840214d2369d5d79
SHA512 57fa677c00dc6164ef333cc811305d6bfe5215aa76e4cf4e0e63e0eb2c8aa5a039496682be6d0ebcaab56fb1a0cae5e88b7e4b49726a8dd1f2c15e0a6fb9d3f9
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	bb49117541bbda33fd99a2a41c06be02005e513146f5ea2965a21c3ad504dc97.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	bb49117541bbda33fd99a2a41c06be02005e513146f5ea2965a21c3ad504dc97.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	bb49117541bbda33fd99a2a41c06be02005e513146f5ea2965a21c3ad504dc97.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	bb49117541bbda33fd99a2a41c06be02005e513146f5ea2965a21c3ad504dc97.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	bb49117541bbda33fd99a2a41c06be02005e513146f5ea2965a21c3ad504dc97.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	bb49117541bbda33fd99a2a41c06be02005e513146f5ea2965a21c3ad504dc97.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
1888	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4068	bb49117541bbda33fd99a2a41c06be02005e513146f5ea2965a21c3ad504dc97.exe
4068	bb49117541bbda33fd99a2a41c06be02005e513146f5ea2965a21c3ad504dc97.exe
2236	bb49117541bbda33fd99a2a41c06be02005e513146f5ea2965a21c3ad504dc97.exe
2236	bb49117541bbda33fd99a2a41c06be02005e513146f5ea2965a21c3ad504dc97.exe
2236	bb49117541bbda33fd99a2a41c06be02005e513146f5ea2965a21c3ad504dc97.exe
2236	bb49117541bbda33fd99a2a41c06be02005e513146f5ea2965a21c3ad504dc97.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4068 wrote to memory of 2236	4068	bb49117541bbda33fd99a2a41c06be02005e513146f5ea2965a21c3ad504dc97.exe	79
PID 4068 wrote to memory of 2236	4068	bb49117541bbda33fd99a2a41c06be02005e513146f5ea2965a21c3ad504dc97.exe	79
PID 4068 wrote to memory of 2236	4068	bb49117541bbda33fd99a2a41c06be02005e513146f5ea2965a21c3ad504dc97.exe	79
PID 4068 wrote to memory of 972	4068	bb49117541bbda33fd99a2a41c06be02005e513146f5ea2965a21c3ad504dc97.exe	80
PID 4068 wrote to memory of 972	4068	bb49117541bbda33fd99a2a41c06be02005e513146f5ea2965a21c3ad504dc97.exe	80
PID 4068 wrote to memory of 972	4068	bb49117541bbda33fd99a2a41c06be02005e513146f5ea2965a21c3ad504dc97.exe	80
PID 972 wrote to memory of 1888	972	cmd.exe	82
PID 972 wrote to memory of 1888	972	cmd.exe	82
PID 972 wrote to memory of 1888	972	cmd.exe	82