qakbot | 3f4f3662e3a09ec59403ed283ba4ed9a77dfe6ca357af42493bd398e8a9d67b6

General

Target
3f4f3662e3a09ec59403ed283ba4ed9a77dfe6ca357af42493bd398e8a9d67b6.exe
Size 257KB
Sample201110-ff75n6knr6
SHA256 3f4f3662e3a09ec59403ed283ba4ed9a77dfe6ca357af42493bd398e8a9d67b6
MD5 8ed91dbedeb529049403c00b06e1d46f
SHA1 68f812db5e677a79e98001fdad2ff544e42193cd
SHA512 7043cea4e064903fb123b6a965ea7badda362547fdf0203bff4062e36919f706de8781d2bae8a906b73ffed5456d56aafaeb65235fdcd6ba1c6cc21652cf4b22
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	3f4f3662e3a09ec59403ed283ba4ed9a77dfe6ca357af42493bd398e8a9d67b6.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	3f4f3662e3a09ec59403ed283ba4ed9a77dfe6ca357af42493bd398e8a9d67b6.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	3f4f3662e3a09ec59403ed283ba4ed9a77dfe6ca357af42493bd398e8a9d67b6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	3f4f3662e3a09ec59403ed283ba4ed9a77dfe6ca357af42493bd398e8a9d67b6.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	3f4f3662e3a09ec59403ed283ba4ed9a77dfe6ca357af42493bd398e8a9d67b6.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	3f4f3662e3a09ec59403ed283ba4ed9a77dfe6ca357af42493bd398e8a9d67b6.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
884	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1100	3f4f3662e3a09ec59403ed283ba4ed9a77dfe6ca357af42493bd398e8a9d67b6.exe
1100	3f4f3662e3a09ec59403ed283ba4ed9a77dfe6ca357af42493bd398e8a9d67b6.exe
2784	3f4f3662e3a09ec59403ed283ba4ed9a77dfe6ca357af42493bd398e8a9d67b6.exe
2784	3f4f3662e3a09ec59403ed283ba4ed9a77dfe6ca357af42493bd398e8a9d67b6.exe
2784	3f4f3662e3a09ec59403ed283ba4ed9a77dfe6ca357af42493bd398e8a9d67b6.exe
2784	3f4f3662e3a09ec59403ed283ba4ed9a77dfe6ca357af42493bd398e8a9d67b6.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 2784	1100	3f4f3662e3a09ec59403ed283ba4ed9a77dfe6ca357af42493bd398e8a9d67b6.exe	79
PID 1100 wrote to memory of 2784	1100	3f4f3662e3a09ec59403ed283ba4ed9a77dfe6ca357af42493bd398e8a9d67b6.exe	79
PID 1100 wrote to memory of 2784	1100	3f4f3662e3a09ec59403ed283ba4ed9a77dfe6ca357af42493bd398e8a9d67b6.exe	79
PID 1100 wrote to memory of 404	1100	3f4f3662e3a09ec59403ed283ba4ed9a77dfe6ca357af42493bd398e8a9d67b6.exe	80
PID 1100 wrote to memory of 404	1100	3f4f3662e3a09ec59403ed283ba4ed9a77dfe6ca357af42493bd398e8a9d67b6.exe	80
PID 1100 wrote to memory of 404	1100	3f4f3662e3a09ec59403ed283ba4ed9a77dfe6ca357af42493bd398e8a9d67b6.exe	80
PID 404 wrote to memory of 884	404	cmd.exe	82
PID 404 wrote to memory of 884	404	cmd.exe	82
PID 404 wrote to memory of 884	404	cmd.exe	82