qakbot | 9d8fc1beff599063fb0dfdd48ff42bbee47bfbd7fa2e943b7ad9213154f93d54

General

Target
9d8fc1beff599063fb0dfdd48ff42bbee47bfbd7fa2e943b7ad9213154f93d54.exe
Size 270KB
Sample201112-77h3vkc866
SHA256 9d8fc1beff599063fb0dfdd48ff42bbee47bfbd7fa2e943b7ad9213154f93d54
MD5 5fd3006e8fd438e8b7b49c188781cf77
SHA1 0136d7b22a841dbcf608650ef753e689dfbefc97
SHA512 d66c42a1d9622a186fa8491c8c1d826267b58b6ed66a0595202f7402d7825cd75352a4de8c84ce20f03848606ef70fd24d19df0be1e86eea1eed352d92128eae
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	9d8fc1beff599063fb0dfdd48ff42bbee47bfbd7fa2e943b7ad9213154f93d54.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	9d8fc1beff599063fb0dfdd48ff42bbee47bfbd7fa2e943b7ad9213154f93d54.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	9d8fc1beff599063fb0dfdd48ff42bbee47bfbd7fa2e943b7ad9213154f93d54.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	9d8fc1beff599063fb0dfdd48ff42bbee47bfbd7fa2e943b7ad9213154f93d54.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	9d8fc1beff599063fb0dfdd48ff42bbee47bfbd7fa2e943b7ad9213154f93d54.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	9d8fc1beff599063fb0dfdd48ff42bbee47bfbd7fa2e943b7ad9213154f93d54.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
3176	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4632	9d8fc1beff599063fb0dfdd48ff42bbee47bfbd7fa2e943b7ad9213154f93d54.exe
4632	9d8fc1beff599063fb0dfdd48ff42bbee47bfbd7fa2e943b7ad9213154f93d54.exe
4200	9d8fc1beff599063fb0dfdd48ff42bbee47bfbd7fa2e943b7ad9213154f93d54.exe
4200	9d8fc1beff599063fb0dfdd48ff42bbee47bfbd7fa2e943b7ad9213154f93d54.exe
4200	9d8fc1beff599063fb0dfdd48ff42bbee47bfbd7fa2e943b7ad9213154f93d54.exe
4200	9d8fc1beff599063fb0dfdd48ff42bbee47bfbd7fa2e943b7ad9213154f93d54.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4632 wrote to memory of 4200	4632	9d8fc1beff599063fb0dfdd48ff42bbee47bfbd7fa2e943b7ad9213154f93d54.exe	77
PID 4632 wrote to memory of 4200	4632	9d8fc1beff599063fb0dfdd48ff42bbee47bfbd7fa2e943b7ad9213154f93d54.exe	77
PID 4632 wrote to memory of 4200	4632	9d8fc1beff599063fb0dfdd48ff42bbee47bfbd7fa2e943b7ad9213154f93d54.exe	77
PID 4632 wrote to memory of 3264	4632	9d8fc1beff599063fb0dfdd48ff42bbee47bfbd7fa2e943b7ad9213154f93d54.exe	78
PID 4632 wrote to memory of 3264	4632	9d8fc1beff599063fb0dfdd48ff42bbee47bfbd7fa2e943b7ad9213154f93d54.exe	78
PID 4632 wrote to memory of 3264	4632	9d8fc1beff599063fb0dfdd48ff42bbee47bfbd7fa2e943b7ad9213154f93d54.exe	78
PID 3264 wrote to memory of 3176	3264	cmd.exe	80
PID 3264 wrote to memory of 3176	3264	cmd.exe	80
PID 3264 wrote to memory of 3176	3264	cmd.exe	80