qakbot | 98647e4be89e64d5d371fd38ce930da19e9deed7213b3ee445c84764012fd376

General

Target
98647e4be89e64d5d371fd38ce930da19e9deed7213b3ee445c84764012fd376.exe
Size 270KB
Sample201110-akat18pp8n
SHA256 98647e4be89e64d5d371fd38ce930da19e9deed7213b3ee445c84764012fd376
MD5 8a087473b9c77a3d312ac9c047142819
SHA1 73563a1b2fffc0dfa4ad858764f7cfe40d608a48
SHA512 de9e7d9c870fd72be078f4ff3f636b6a2e296f2f139f91423e03331a6cceb8a80704dc291ceb11ef7f9561caaf9ba9c6ea7767d65d1eb1a62f28976d90e1e8aa
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	98647e4be89e64d5d371fd38ce930da19e9deed7213b3ee445c84764012fd376.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	98647e4be89e64d5d371fd38ce930da19e9deed7213b3ee445c84764012fd376.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	98647e4be89e64d5d371fd38ce930da19e9deed7213b3ee445c84764012fd376.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	98647e4be89e64d5d371fd38ce930da19e9deed7213b3ee445c84764012fd376.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	98647e4be89e64d5d371fd38ce930da19e9deed7213b3ee445c84764012fd376.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	98647e4be89e64d5d371fd38ce930da19e9deed7213b3ee445c84764012fd376.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
2268	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
580	98647e4be89e64d5d371fd38ce930da19e9deed7213b3ee445c84764012fd376.exe
580	98647e4be89e64d5d371fd38ce930da19e9deed7213b3ee445c84764012fd376.exe
192	98647e4be89e64d5d371fd38ce930da19e9deed7213b3ee445c84764012fd376.exe
192	98647e4be89e64d5d371fd38ce930da19e9deed7213b3ee445c84764012fd376.exe
192	98647e4be89e64d5d371fd38ce930da19e9deed7213b3ee445c84764012fd376.exe
192	98647e4be89e64d5d371fd38ce930da19e9deed7213b3ee445c84764012fd376.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 580 wrote to memory of 192	580	98647e4be89e64d5d371fd38ce930da19e9deed7213b3ee445c84764012fd376.exe	78
PID 580 wrote to memory of 192	580	98647e4be89e64d5d371fd38ce930da19e9deed7213b3ee445c84764012fd376.exe	78
PID 580 wrote to memory of 192	580	98647e4be89e64d5d371fd38ce930da19e9deed7213b3ee445c84764012fd376.exe	78
PID 580 wrote to memory of 1424	580	98647e4be89e64d5d371fd38ce930da19e9deed7213b3ee445c84764012fd376.exe	79
PID 580 wrote to memory of 1424	580	98647e4be89e64d5d371fd38ce930da19e9deed7213b3ee445c84764012fd376.exe	79
PID 580 wrote to memory of 1424	580	98647e4be89e64d5d371fd38ce930da19e9deed7213b3ee445c84764012fd376.exe	79
PID 1424 wrote to memory of 2268	1424	cmd.exe	81
PID 1424 wrote to memory of 2268	1424	cmd.exe	81
PID 1424 wrote to memory of 2268	1424	cmd.exe	81