qakbot | dd4f612b2a41726b005fda6852bd9d6c2bbba0fd610bb944a88096ddd557fa5a

General

Target
dd4f612b2a41726b005fda6852bd9d6c2bbba0fd610bb944a88096ddd557fa5a.exe
Size 270KB
Sample201112-g6v3496262
SHA256 dd4f612b2a41726b005fda6852bd9d6c2bbba0fd610bb944a88096ddd557fa5a
MD5 8e15f1e8a132dca6e66e41a521b33b64
SHA1 e5cf27938f38bcca00eae231e3d4073fbc2d2267
SHA512 2a9c94598eb5b9350e5898e87a3acde85229ecf2ebf48dda544fd876fb7729d7c598c2ed50fd4e2965cbe468906b57210646b2391fd284341b421b65907a94f0
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	dd4f612b2a41726b005fda6852bd9d6c2bbba0fd610bb944a88096ddd557fa5a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	dd4f612b2a41726b005fda6852bd9d6c2bbba0fd610bb944a88096ddd557fa5a.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	dd4f612b2a41726b005fda6852bd9d6c2bbba0fd610bb944a88096ddd557fa5a.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	dd4f612b2a41726b005fda6852bd9d6c2bbba0fd610bb944a88096ddd557fa5a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	dd4f612b2a41726b005fda6852bd9d6c2bbba0fd610bb944a88096ddd557fa5a.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	dd4f612b2a41726b005fda6852bd9d6c2bbba0fd610bb944a88096ddd557fa5a.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
2068	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3992	dd4f612b2a41726b005fda6852bd9d6c2bbba0fd610bb944a88096ddd557fa5a.exe
3992	dd4f612b2a41726b005fda6852bd9d6c2bbba0fd610bb944a88096ddd557fa5a.exe
3948	dd4f612b2a41726b005fda6852bd9d6c2bbba0fd610bb944a88096ddd557fa5a.exe
3948	dd4f612b2a41726b005fda6852bd9d6c2bbba0fd610bb944a88096ddd557fa5a.exe
3948	dd4f612b2a41726b005fda6852bd9d6c2bbba0fd610bb944a88096ddd557fa5a.exe
3948	dd4f612b2a41726b005fda6852bd9d6c2bbba0fd610bb944a88096ddd557fa5a.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3992 wrote to memory of 3948	3992	dd4f612b2a41726b005fda6852bd9d6c2bbba0fd610bb944a88096ddd557fa5a.exe	79
PID 3992 wrote to memory of 3948	3992	dd4f612b2a41726b005fda6852bd9d6c2bbba0fd610bb944a88096ddd557fa5a.exe	79
PID 3992 wrote to memory of 3948	3992	dd4f612b2a41726b005fda6852bd9d6c2bbba0fd610bb944a88096ddd557fa5a.exe	79
PID 3992 wrote to memory of 1568	3992	dd4f612b2a41726b005fda6852bd9d6c2bbba0fd610bb944a88096ddd557fa5a.exe	80
PID 3992 wrote to memory of 1568	3992	dd4f612b2a41726b005fda6852bd9d6c2bbba0fd610bb944a88096ddd557fa5a.exe	80
PID 3992 wrote to memory of 1568	3992	dd4f612b2a41726b005fda6852bd9d6c2bbba0fd610bb944a88096ddd557fa5a.exe	80
PID 1568 wrote to memory of 2068	1568	cmd.exe	82
PID 1568 wrote to memory of 2068	1568	cmd.exe	82
PID 1568 wrote to memory of 2068	1568	cmd.exe	82