qakbot | 044df9496396f39de1d8abb5fbf2841d528ecbf3f8c83283176bf6f65ece7325

General

Target
044df9496396f39de1d8abb5fbf2841d528ecbf3f8c83283176bf6f65ece7325.exe
Size 270KB
Sample201110-b33menrw6s
SHA256 044df9496396f39de1d8abb5fbf2841d528ecbf3f8c83283176bf6f65ece7325
MD5 d245848da68e50a3fd06a4bc7f662fe0
SHA1 9d33a5c93cb816597aea7316fbd4734676cdc284
SHA512 e41c9946cb7d4f6b72c4b71de2687c592c5d1b405a1b97aca8d6a5f9450d95288904d6f435cb9e473aa40e0b2eb74e5c6b0637fed582e752f4924b01a3720270
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	044df9496396f39de1d8abb5fbf2841d528ecbf3f8c83283176bf6f65ece7325.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	044df9496396f39de1d8abb5fbf2841d528ecbf3f8c83283176bf6f65ece7325.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	044df9496396f39de1d8abb5fbf2841d528ecbf3f8c83283176bf6f65ece7325.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	044df9496396f39de1d8abb5fbf2841d528ecbf3f8c83283176bf6f65ece7325.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	044df9496396f39de1d8abb5fbf2841d528ecbf3f8c83283176bf6f65ece7325.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	044df9496396f39de1d8abb5fbf2841d528ecbf3f8c83283176bf6f65ece7325.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
2836	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
984	044df9496396f39de1d8abb5fbf2841d528ecbf3f8c83283176bf6f65ece7325.exe
984	044df9496396f39de1d8abb5fbf2841d528ecbf3f8c83283176bf6f65ece7325.exe
2288	044df9496396f39de1d8abb5fbf2841d528ecbf3f8c83283176bf6f65ece7325.exe
2288	044df9496396f39de1d8abb5fbf2841d528ecbf3f8c83283176bf6f65ece7325.exe
2288	044df9496396f39de1d8abb5fbf2841d528ecbf3f8c83283176bf6f65ece7325.exe
2288	044df9496396f39de1d8abb5fbf2841d528ecbf3f8c83283176bf6f65ece7325.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 984 wrote to memory of 2288	984	044df9496396f39de1d8abb5fbf2841d528ecbf3f8c83283176bf6f65ece7325.exe	78
PID 984 wrote to memory of 2288	984	044df9496396f39de1d8abb5fbf2841d528ecbf3f8c83283176bf6f65ece7325.exe	78
PID 984 wrote to memory of 2288	984	044df9496396f39de1d8abb5fbf2841d528ecbf3f8c83283176bf6f65ece7325.exe	78
PID 984 wrote to memory of 3684	984	044df9496396f39de1d8abb5fbf2841d528ecbf3f8c83283176bf6f65ece7325.exe	79
PID 984 wrote to memory of 3684	984	044df9496396f39de1d8abb5fbf2841d528ecbf3f8c83283176bf6f65ece7325.exe	79
PID 984 wrote to memory of 3684	984	044df9496396f39de1d8abb5fbf2841d528ecbf3f8c83283176bf6f65ece7325.exe	79
PID 3684 wrote to memory of 2836	3684	cmd.exe	81
PID 3684 wrote to memory of 2836	3684	cmd.exe	81
PID 3684 wrote to memory of 2836	3684	cmd.exe	81