qakbot | 8a1f442c36b006b522a8de507e95c0043e0c3ee452e1915aa01086e48a11ceea

General

Target
8a1f442c36b006b522a8de507e95c0043e0c3ee452e1915aa01086e48a11ceea.exe
Size 270KB
Sample201110-l1e6j4bqcs
SHA256 8a1f442c36b006b522a8de507e95c0043e0c3ee452e1915aa01086e48a11ceea
MD5 9ca81d5f77a8e0d383db58151c84b07b
SHA1 028a5305c55508876b30e5c3840f632a9540111a
SHA512 f33e5196bcacf01e9a885c21b8be9523ff7ab18226cbe933e1a62ea4b6059465f9b473d2d3218c50c6269cddcef563650600417cadbea07acaf67ce2edca9c3b
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	8a1f442c36b006b522a8de507e95c0043e0c3ee452e1915aa01086e48a11ceea.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	8a1f442c36b006b522a8de507e95c0043e0c3ee452e1915aa01086e48a11ceea.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	8a1f442c36b006b522a8de507e95c0043e0c3ee452e1915aa01086e48a11ceea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	8a1f442c36b006b522a8de507e95c0043e0c3ee452e1915aa01086e48a11ceea.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	8a1f442c36b006b522a8de507e95c0043e0c3ee452e1915aa01086e48a11ceea.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	8a1f442c36b006b522a8de507e95c0043e0c3ee452e1915aa01086e48a11ceea.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
2828	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3160	8a1f442c36b006b522a8de507e95c0043e0c3ee452e1915aa01086e48a11ceea.exe
3160	8a1f442c36b006b522a8de507e95c0043e0c3ee452e1915aa01086e48a11ceea.exe
3192	8a1f442c36b006b522a8de507e95c0043e0c3ee452e1915aa01086e48a11ceea.exe
3192	8a1f442c36b006b522a8de507e95c0043e0c3ee452e1915aa01086e48a11ceea.exe
3192	8a1f442c36b006b522a8de507e95c0043e0c3ee452e1915aa01086e48a11ceea.exe
3192	8a1f442c36b006b522a8de507e95c0043e0c3ee452e1915aa01086e48a11ceea.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3160 wrote to memory of 3192	3160	8a1f442c36b006b522a8de507e95c0043e0c3ee452e1915aa01086e48a11ceea.exe	78
PID 3160 wrote to memory of 3192	3160	8a1f442c36b006b522a8de507e95c0043e0c3ee452e1915aa01086e48a11ceea.exe	78
PID 3160 wrote to memory of 3192	3160	8a1f442c36b006b522a8de507e95c0043e0c3ee452e1915aa01086e48a11ceea.exe	78
PID 3160 wrote to memory of 2316	3160	8a1f442c36b006b522a8de507e95c0043e0c3ee452e1915aa01086e48a11ceea.exe	79
PID 3160 wrote to memory of 2316	3160	8a1f442c36b006b522a8de507e95c0043e0c3ee452e1915aa01086e48a11ceea.exe	79
PID 3160 wrote to memory of 2316	3160	8a1f442c36b006b522a8de507e95c0043e0c3ee452e1915aa01086e48a11ceea.exe	79
PID 2316 wrote to memory of 2828	2316	cmd.exe	81
PID 2316 wrote to memory of 2828	2316	cmd.exe	81
PID 2316 wrote to memory of 2828	2316	cmd.exe	81