qakbot | fd269a83d52440897e901bd0baa8a8bf01f48652eb2f8abf5422d2352d775836

General

Target
fd269a83d52440897e901bd0baa8a8bf01f48652eb2f8abf5422d2352d775836.exe
Size 270KB
Sample201112-bc1ezcjc9a
SHA256 fd269a83d52440897e901bd0baa8a8bf01f48652eb2f8abf5422d2352d775836
MD5 ad1be79b9fbf4ca09ecf39baffac4787
SHA1 c950d150642b1437f23ac2030d42fca5a56c18a5
SHA512 d9b7ec1b62a4eeac21399bf92502d81d2a792aa07619885d98765862533d671aff72e0aa95876e3281f5d5d29cb26b2781a7d2ab2f6033348e7fb204398d6c95
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	fd269a83d52440897e901bd0baa8a8bf01f48652eb2f8abf5422d2352d775836.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	fd269a83d52440897e901bd0baa8a8bf01f48652eb2f8abf5422d2352d775836.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	fd269a83d52440897e901bd0baa8a8bf01f48652eb2f8abf5422d2352d775836.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	fd269a83d52440897e901bd0baa8a8bf01f48652eb2f8abf5422d2352d775836.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	fd269a83d52440897e901bd0baa8a8bf01f48652eb2f8abf5422d2352d775836.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	fd269a83d52440897e901bd0baa8a8bf01f48652eb2f8abf5422d2352d775836.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
732	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3008	fd269a83d52440897e901bd0baa8a8bf01f48652eb2f8abf5422d2352d775836.exe
3008	fd269a83d52440897e901bd0baa8a8bf01f48652eb2f8abf5422d2352d775836.exe
1948	fd269a83d52440897e901bd0baa8a8bf01f48652eb2f8abf5422d2352d775836.exe
1948	fd269a83d52440897e901bd0baa8a8bf01f48652eb2f8abf5422d2352d775836.exe
1948	fd269a83d52440897e901bd0baa8a8bf01f48652eb2f8abf5422d2352d775836.exe
1948	fd269a83d52440897e901bd0baa8a8bf01f48652eb2f8abf5422d2352d775836.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 1948	3008	fd269a83d52440897e901bd0baa8a8bf01f48652eb2f8abf5422d2352d775836.exe	79
PID 3008 wrote to memory of 1948	3008	fd269a83d52440897e901bd0baa8a8bf01f48652eb2f8abf5422d2352d775836.exe	79
PID 3008 wrote to memory of 1948	3008	fd269a83d52440897e901bd0baa8a8bf01f48652eb2f8abf5422d2352d775836.exe	79
PID 3008 wrote to memory of 2668	3008	fd269a83d52440897e901bd0baa8a8bf01f48652eb2f8abf5422d2352d775836.exe	80
PID 3008 wrote to memory of 2668	3008	fd269a83d52440897e901bd0baa8a8bf01f48652eb2f8abf5422d2352d775836.exe	80
PID 3008 wrote to memory of 2668	3008	fd269a83d52440897e901bd0baa8a8bf01f48652eb2f8abf5422d2352d775836.exe	80
PID 2668 wrote to memory of 732	2668	cmd.exe	82
PID 2668 wrote to memory of 732	2668	cmd.exe	82
PID 2668 wrote to memory of 732	2668	cmd.exe	82