qakbot | 0fdf4a2a4cddab51a5e3dfd53f85c4d7edbd85a15a8106b5b1fef2c993a5b211

General

Target
0fdf4a2a4cddab51a5e3dfd53f85c4d7edbd85a15a8106b5b1fef2c993a5b211.exe
Size 270KB
Sample201110-kg8mtesr76
SHA256 0fdf4a2a4cddab51a5e3dfd53f85c4d7edbd85a15a8106b5b1fef2c993a5b211
MD5 96ab9429e1eac58837e6af2431302892
SHA1 b50cba06e8bd0fd72be183b8871d69b4261d5ab7
SHA512 daa4cf2a61465746973f858bce12ff24de6e95772301deffd6e6be6ea87816dc1bb5dd3e19725a2f43c3c9170666a0bc6740b38515a513b0d668d4479d1ca3ce
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	0fdf4a2a4cddab51a5e3dfd53f85c4d7edbd85a15a8106b5b1fef2c993a5b211.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	0fdf4a2a4cddab51a5e3dfd53f85c4d7edbd85a15a8106b5b1fef2c993a5b211.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	0fdf4a2a4cddab51a5e3dfd53f85c4d7edbd85a15a8106b5b1fef2c993a5b211.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	0fdf4a2a4cddab51a5e3dfd53f85c4d7edbd85a15a8106b5b1fef2c993a5b211.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	0fdf4a2a4cddab51a5e3dfd53f85c4d7edbd85a15a8106b5b1fef2c993a5b211.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	0fdf4a2a4cddab51a5e3dfd53f85c4d7edbd85a15a8106b5b1fef2c993a5b211.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
636	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
640	0fdf4a2a4cddab51a5e3dfd53f85c4d7edbd85a15a8106b5b1fef2c993a5b211.exe
640	0fdf4a2a4cddab51a5e3dfd53f85c4d7edbd85a15a8106b5b1fef2c993a5b211.exe
184	0fdf4a2a4cddab51a5e3dfd53f85c4d7edbd85a15a8106b5b1fef2c993a5b211.exe
184	0fdf4a2a4cddab51a5e3dfd53f85c4d7edbd85a15a8106b5b1fef2c993a5b211.exe
184	0fdf4a2a4cddab51a5e3dfd53f85c4d7edbd85a15a8106b5b1fef2c993a5b211.exe
184	0fdf4a2a4cddab51a5e3dfd53f85c4d7edbd85a15a8106b5b1fef2c993a5b211.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 640 wrote to memory of 184	640	0fdf4a2a4cddab51a5e3dfd53f85c4d7edbd85a15a8106b5b1fef2c993a5b211.exe	78
PID 640 wrote to memory of 184	640	0fdf4a2a4cddab51a5e3dfd53f85c4d7edbd85a15a8106b5b1fef2c993a5b211.exe	78
PID 640 wrote to memory of 184	640	0fdf4a2a4cddab51a5e3dfd53f85c4d7edbd85a15a8106b5b1fef2c993a5b211.exe	78
PID 640 wrote to memory of 3120	640	0fdf4a2a4cddab51a5e3dfd53f85c4d7edbd85a15a8106b5b1fef2c993a5b211.exe	79
PID 640 wrote to memory of 3120	640	0fdf4a2a4cddab51a5e3dfd53f85c4d7edbd85a15a8106b5b1fef2c993a5b211.exe	79
PID 640 wrote to memory of 3120	640	0fdf4a2a4cddab51a5e3dfd53f85c4d7edbd85a15a8106b5b1fef2c993a5b211.exe	79
PID 3120 wrote to memory of 636	3120	cmd.exe	81
PID 3120 wrote to memory of 636	3120	cmd.exe	81
PID 3120 wrote to memory of 636	3120	cmd.exe	81