qakbot | d09e0d2237b40edad77efc8c6b54f8d47fdb7720b8a98fee89579b748e9da58e

General

Target
d09e0d2237b40edad77efc8c6b54f8d47fdb7720b8a98fee89579b748e9da58e.exe
Size 270KB
Sample201110-ae84vc5rxe
SHA256 d09e0d2237b40edad77efc8c6b54f8d47fdb7720b8a98fee89579b748e9da58e
MD5 e2ec7b636beb8e5d4f0502c6b0eaf38f
SHA1 e24140ad1f651b27741acb726e0e4a5e0404cd26
SHA512 128a706a894865facf4d9d60b38ca70e733b564bed255ea386176c05e485bb3ab6cd581ff6469d48081ffa4efe631c21989e1bf6a3fa321fdf1462bdfd0dceef
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	d09e0d2237b40edad77efc8c6b54f8d47fdb7720b8a98fee89579b748e9da58e.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	d09e0d2237b40edad77efc8c6b54f8d47fdb7720b8a98fee89579b748e9da58e.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	d09e0d2237b40edad77efc8c6b54f8d47fdb7720b8a98fee89579b748e9da58e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	d09e0d2237b40edad77efc8c6b54f8d47fdb7720b8a98fee89579b748e9da58e.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	d09e0d2237b40edad77efc8c6b54f8d47fdb7720b8a98fee89579b748e9da58e.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	d09e0d2237b40edad77efc8c6b54f8d47fdb7720b8a98fee89579b748e9da58e.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
1940	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2268	d09e0d2237b40edad77efc8c6b54f8d47fdb7720b8a98fee89579b748e9da58e.exe
2268	d09e0d2237b40edad77efc8c6b54f8d47fdb7720b8a98fee89579b748e9da58e.exe
3992	d09e0d2237b40edad77efc8c6b54f8d47fdb7720b8a98fee89579b748e9da58e.exe
3992	d09e0d2237b40edad77efc8c6b54f8d47fdb7720b8a98fee89579b748e9da58e.exe
3992	d09e0d2237b40edad77efc8c6b54f8d47fdb7720b8a98fee89579b748e9da58e.exe
3992	d09e0d2237b40edad77efc8c6b54f8d47fdb7720b8a98fee89579b748e9da58e.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 3992	2268	d09e0d2237b40edad77efc8c6b54f8d47fdb7720b8a98fee89579b748e9da58e.exe	78
PID 2268 wrote to memory of 3992	2268	d09e0d2237b40edad77efc8c6b54f8d47fdb7720b8a98fee89579b748e9da58e.exe	78
PID 2268 wrote to memory of 3992	2268	d09e0d2237b40edad77efc8c6b54f8d47fdb7720b8a98fee89579b748e9da58e.exe	78
PID 2268 wrote to memory of 196	2268	d09e0d2237b40edad77efc8c6b54f8d47fdb7720b8a98fee89579b748e9da58e.exe	79
PID 2268 wrote to memory of 196	2268	d09e0d2237b40edad77efc8c6b54f8d47fdb7720b8a98fee89579b748e9da58e.exe	79
PID 2268 wrote to memory of 196	2268	d09e0d2237b40edad77efc8c6b54f8d47fdb7720b8a98fee89579b748e9da58e.exe	79
PID 196 wrote to memory of 1940	196	cmd.exe	81
PID 196 wrote to memory of 1940	196	cmd.exe	81
PID 196 wrote to memory of 1940	196	cmd.exe	81