qakbot | 9d64082b446384cacb7811dbb928b8789cef88486a88ed7ca30b75dfbd5e7c40

General

Target
9d64082b446384cacb7811dbb928b8789cef88486a88ed7ca30b75dfbd5e7c40.exe
Size 270KB
Sample201112-t1hj769bfj
SHA256 9d64082b446384cacb7811dbb928b8789cef88486a88ed7ca30b75dfbd5e7c40
MD5 f775260bb078dea38eeccfa66b193ee0
SHA1 cafb7dc2c78c69fac71b46f6a3b6b1b98467ae0e
SHA512 d972d2a0f1bc718d5dbf1b85e57e3ece85f94e549289e6e46ea6b2d6196b0b840f7c9603c03c58279a172b26aee712b7aa92e6e3444485166a2cc716b75d41c9
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	9d64082b446384cacb7811dbb928b8789cef88486a88ed7ca30b75dfbd5e7c40.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	9d64082b446384cacb7811dbb928b8789cef88486a88ed7ca30b75dfbd5e7c40.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	9d64082b446384cacb7811dbb928b8789cef88486a88ed7ca30b75dfbd5e7c40.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	9d64082b446384cacb7811dbb928b8789cef88486a88ed7ca30b75dfbd5e7c40.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	9d64082b446384cacb7811dbb928b8789cef88486a88ed7ca30b75dfbd5e7c40.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	9d64082b446384cacb7811dbb928b8789cef88486a88ed7ca30b75dfbd5e7c40.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
2288	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2268	9d64082b446384cacb7811dbb928b8789cef88486a88ed7ca30b75dfbd5e7c40.exe
2268	9d64082b446384cacb7811dbb928b8789cef88486a88ed7ca30b75dfbd5e7c40.exe
4060	9d64082b446384cacb7811dbb928b8789cef88486a88ed7ca30b75dfbd5e7c40.exe
4060	9d64082b446384cacb7811dbb928b8789cef88486a88ed7ca30b75dfbd5e7c40.exe
4060	9d64082b446384cacb7811dbb928b8789cef88486a88ed7ca30b75dfbd5e7c40.exe
4060	9d64082b446384cacb7811dbb928b8789cef88486a88ed7ca30b75dfbd5e7c40.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 4060	2268	9d64082b446384cacb7811dbb928b8789cef88486a88ed7ca30b75dfbd5e7c40.exe	78
PID 2268 wrote to memory of 4060	2268	9d64082b446384cacb7811dbb928b8789cef88486a88ed7ca30b75dfbd5e7c40.exe	78
PID 2268 wrote to memory of 4060	2268	9d64082b446384cacb7811dbb928b8789cef88486a88ed7ca30b75dfbd5e7c40.exe	78
PID 2268 wrote to memory of 1324	2268	9d64082b446384cacb7811dbb928b8789cef88486a88ed7ca30b75dfbd5e7c40.exe	79
PID 2268 wrote to memory of 1324	2268	9d64082b446384cacb7811dbb928b8789cef88486a88ed7ca30b75dfbd5e7c40.exe	79
PID 2268 wrote to memory of 1324	2268	9d64082b446384cacb7811dbb928b8789cef88486a88ed7ca30b75dfbd5e7c40.exe	79
PID 1324 wrote to memory of 2288	1324	cmd.exe	81
PID 1324 wrote to memory of 2288	1324	cmd.exe	81
PID 1324 wrote to memory of 2288	1324	cmd.exe	81