qakbot | f2bffbb33a1dde799a1e19aee3eb88c71c23b2f1f0f2ccf4a61dec148f781bb0

General

Target
f2bffbb33a1dde799a1e19aee3eb88c71c23b2f1f0f2ccf4a61dec148f781bb0.exe
Size 270KB
Sample201112-9ph8bgtbsx
SHA256 f2bffbb33a1dde799a1e19aee3eb88c71c23b2f1f0f2ccf4a61dec148f781bb0
MD5 434f01d0639f6955c1f36649ec57e092
SHA1 aaf913fcd91e155abe74f15ff5da594e30a0b0a9
SHA512 e91f9aab35b5d5c2cca58aa631891f4ddb35dfcd406955567c9c1b0877c296091d6d8b2b98e2000b11dab075d0e81b541861339491d0e2d03e68421564957c6a
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	f2bffbb33a1dde799a1e19aee3eb88c71c23b2f1f0f2ccf4a61dec148f781bb0.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	f2bffbb33a1dde799a1e19aee3eb88c71c23b2f1f0f2ccf4a61dec148f781bb0.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	f2bffbb33a1dde799a1e19aee3eb88c71c23b2f1f0f2ccf4a61dec148f781bb0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	f2bffbb33a1dde799a1e19aee3eb88c71c23b2f1f0f2ccf4a61dec148f781bb0.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	f2bffbb33a1dde799a1e19aee3eb88c71c23b2f1f0f2ccf4a61dec148f781bb0.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	f2bffbb33a1dde799a1e19aee3eb88c71c23b2f1f0f2ccf4a61dec148f781bb0.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
952	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1180	f2bffbb33a1dde799a1e19aee3eb88c71c23b2f1f0f2ccf4a61dec148f781bb0.exe
1180	f2bffbb33a1dde799a1e19aee3eb88c71c23b2f1f0f2ccf4a61dec148f781bb0.exe
2584	f2bffbb33a1dde799a1e19aee3eb88c71c23b2f1f0f2ccf4a61dec148f781bb0.exe
2584	f2bffbb33a1dde799a1e19aee3eb88c71c23b2f1f0f2ccf4a61dec148f781bb0.exe
2584	f2bffbb33a1dde799a1e19aee3eb88c71c23b2f1f0f2ccf4a61dec148f781bb0.exe
2584	f2bffbb33a1dde799a1e19aee3eb88c71c23b2f1f0f2ccf4a61dec148f781bb0.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1180 wrote to memory of 2584	1180	f2bffbb33a1dde799a1e19aee3eb88c71c23b2f1f0f2ccf4a61dec148f781bb0.exe	79
PID 1180 wrote to memory of 2584	1180	f2bffbb33a1dde799a1e19aee3eb88c71c23b2f1f0f2ccf4a61dec148f781bb0.exe	79
PID 1180 wrote to memory of 2584	1180	f2bffbb33a1dde799a1e19aee3eb88c71c23b2f1f0f2ccf4a61dec148f781bb0.exe	79
PID 1180 wrote to memory of 408	1180	f2bffbb33a1dde799a1e19aee3eb88c71c23b2f1f0f2ccf4a61dec148f781bb0.exe	80
PID 1180 wrote to memory of 408	1180	f2bffbb33a1dde799a1e19aee3eb88c71c23b2f1f0f2ccf4a61dec148f781bb0.exe	80
PID 1180 wrote to memory of 408	1180	f2bffbb33a1dde799a1e19aee3eb88c71c23b2f1f0f2ccf4a61dec148f781bb0.exe	80
PID 408 wrote to memory of 952	408	cmd.exe	82
PID 408 wrote to memory of 952	408	cmd.exe	82
PID 408 wrote to memory of 952	408	cmd.exe	82