qakbot | 4bdda8fa80ed6424a11fc9521deac2defe3f9c658c5d6294db27a833152c7dab

General

Target
4bdda8fa80ed6424a11fc9521deac2defe3f9c658c5d6294db27a833152c7dab.exe
Size 270KB
Sample201110-htfvg4nace
SHA256 4bdda8fa80ed6424a11fc9521deac2defe3f9c658c5d6294db27a833152c7dab
MD5 f2ae3dc63d64ae03aff35178ad07b83a
SHA1 ce9829db72ce18084b5ba80ceb79e8546f18ec88
SHA512 7b87007ec032b95142c45807733d879a3121c558b074bf89c03741beafe5bc7a41d03419f2f140641d31d1f1af62e34c117ed5692f06c5f6607ade637e7a3dae
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	4bdda8fa80ed6424a11fc9521deac2defe3f9c658c5d6294db27a833152c7dab.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	4bdda8fa80ed6424a11fc9521deac2defe3f9c658c5d6294db27a833152c7dab.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	4bdda8fa80ed6424a11fc9521deac2defe3f9c658c5d6294db27a833152c7dab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	4bdda8fa80ed6424a11fc9521deac2defe3f9c658c5d6294db27a833152c7dab.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	4bdda8fa80ed6424a11fc9521deac2defe3f9c658c5d6294db27a833152c7dab.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	4bdda8fa80ed6424a11fc9521deac2defe3f9c658c5d6294db27a833152c7dab.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
2312	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2268	4bdda8fa80ed6424a11fc9521deac2defe3f9c658c5d6294db27a833152c7dab.exe
2268	4bdda8fa80ed6424a11fc9521deac2defe3f9c658c5d6294db27a833152c7dab.exe
2908	4bdda8fa80ed6424a11fc9521deac2defe3f9c658c5d6294db27a833152c7dab.exe
2908	4bdda8fa80ed6424a11fc9521deac2defe3f9c658c5d6294db27a833152c7dab.exe
2908	4bdda8fa80ed6424a11fc9521deac2defe3f9c658c5d6294db27a833152c7dab.exe
2908	4bdda8fa80ed6424a11fc9521deac2defe3f9c658c5d6294db27a833152c7dab.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 2908	2268	4bdda8fa80ed6424a11fc9521deac2defe3f9c658c5d6294db27a833152c7dab.exe	78
PID 2268 wrote to memory of 2908	2268	4bdda8fa80ed6424a11fc9521deac2defe3f9c658c5d6294db27a833152c7dab.exe	78
PID 2268 wrote to memory of 2908	2268	4bdda8fa80ed6424a11fc9521deac2defe3f9c658c5d6294db27a833152c7dab.exe	78
PID 2268 wrote to memory of 3168	2268	4bdda8fa80ed6424a11fc9521deac2defe3f9c658c5d6294db27a833152c7dab.exe	79
PID 2268 wrote to memory of 3168	2268	4bdda8fa80ed6424a11fc9521deac2defe3f9c658c5d6294db27a833152c7dab.exe	79
PID 2268 wrote to memory of 3168	2268	4bdda8fa80ed6424a11fc9521deac2defe3f9c658c5d6294db27a833152c7dab.exe	79
PID 3168 wrote to memory of 2312	3168	cmd.exe	81
PID 3168 wrote to memory of 2312	3168	cmd.exe	81
PID 3168 wrote to memory of 2312	3168	cmd.exe	81