qakbot | 9355e5c6013cb28dd51122783213c7923a2c413f3fcb1bbef03e1832e99f67b8

General

Target
9355e5c6013cb28dd51122783213c7923a2c413f3fcb1bbef03e1832e99f67b8.exe
Size 270KB
Sample201112-68wvflth7e
SHA256 9355e5c6013cb28dd51122783213c7923a2c413f3fcb1bbef03e1832e99f67b8
MD5 ccc58b6426f6db4ec68eb0f3cb89d21e
SHA1 62c360e8c15190fe52f9e669ba28e7732a3ea37a
SHA512 3afeea75fde8360f794055c6971c03ab734ad1b7bd93af46b1fee140c9f315f6ab71752e25d5abca91eda6cee75705ec846f42ba26ad2cae5b2b9b0a7b1b578f
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	9355e5c6013cb28dd51122783213c7923a2c413f3fcb1bbef03e1832e99f67b8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	9355e5c6013cb28dd51122783213c7923a2c413f3fcb1bbef03e1832e99f67b8.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	9355e5c6013cb28dd51122783213c7923a2c413f3fcb1bbef03e1832e99f67b8.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	9355e5c6013cb28dd51122783213c7923a2c413f3fcb1bbef03e1832e99f67b8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	9355e5c6013cb28dd51122783213c7923a2c413f3fcb1bbef03e1832e99f67b8.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	9355e5c6013cb28dd51122783213c7923a2c413f3fcb1bbef03e1832e99f67b8.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
3764	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3932 wrote to memory of 200	3932	9355e5c6013cb28dd51122783213c7923a2c413f3fcb1bbef03e1832e99f67b8.exe	78
PID 3932 wrote to memory of 200	3932	9355e5c6013cb28dd51122783213c7923a2c413f3fcb1bbef03e1832e99f67b8.exe	78
PID 3932 wrote to memory of 200	3932	9355e5c6013cb28dd51122783213c7923a2c413f3fcb1bbef03e1832e99f67b8.exe	78
PID 3932 wrote to memory of 3948	3932	9355e5c6013cb28dd51122783213c7923a2c413f3fcb1bbef03e1832e99f67b8.exe	79
PID 3932 wrote to memory of 3948	3932	9355e5c6013cb28dd51122783213c7923a2c413f3fcb1bbef03e1832e99f67b8.exe	79
PID 3932 wrote to memory of 3948	3932	9355e5c6013cb28dd51122783213c7923a2c413f3fcb1bbef03e1832e99f67b8.exe	79
PID 3948 wrote to memory of 3764	3948	cmd.exe	81
PID 3948 wrote to memory of 3764	3948	cmd.exe	81
PID 3948 wrote to memory of 3764	3948	cmd.exe	81