qakbot | bb54e75c5c7c919c9b9173b6476ba0cce3c5eb45bd1a2b2a178572fc09b65d28

General

Target
bb54e75c5c7c919c9b9173b6476ba0cce3c5eb45bd1a2b2a178572fc09b65d28.exe
Size 270KB
Sample201113-326aw1x366
SHA256 bb54e75c5c7c919c9b9173b6476ba0cce3c5eb45bd1a2b2a178572fc09b65d28
MD5 802c50c47e98014f3fe41b641b825f56
SHA1 c182289dec971f1b3c47cfc7804b7ff6a29ba1a6
SHA512 b6fd9e93c45d344aa5ef06827c45bcd2cff2c05a34202917258e3a5ded4109970df70f4fbe4633fdd493470b3fff273b4a100e9ed32040afe2f8017ed3c827e9
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	bb54e75c5c7c919c9b9173b6476ba0cce3c5eb45bd1a2b2a178572fc09b65d28.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	bb54e75c5c7c919c9b9173b6476ba0cce3c5eb45bd1a2b2a178572fc09b65d28.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	bb54e75c5c7c919c9b9173b6476ba0cce3c5eb45bd1a2b2a178572fc09b65d28.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	bb54e75c5c7c919c9b9173b6476ba0cce3c5eb45bd1a2b2a178572fc09b65d28.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	bb54e75c5c7c919c9b9173b6476ba0cce3c5eb45bd1a2b2a178572fc09b65d28.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	bb54e75c5c7c919c9b9173b6476ba0cce3c5eb45bd1a2b2a178572fc09b65d28.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
192	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3904	bb54e75c5c7c919c9b9173b6476ba0cce3c5eb45bd1a2b2a178572fc09b65d28.exe
3904	bb54e75c5c7c919c9b9173b6476ba0cce3c5eb45bd1a2b2a178572fc09b65d28.exe
2808	bb54e75c5c7c919c9b9173b6476ba0cce3c5eb45bd1a2b2a178572fc09b65d28.exe
2808	bb54e75c5c7c919c9b9173b6476ba0cce3c5eb45bd1a2b2a178572fc09b65d28.exe
2808	bb54e75c5c7c919c9b9173b6476ba0cce3c5eb45bd1a2b2a178572fc09b65d28.exe
2808	bb54e75c5c7c919c9b9173b6476ba0cce3c5eb45bd1a2b2a178572fc09b65d28.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3904 wrote to memory of 2808	3904	bb54e75c5c7c919c9b9173b6476ba0cce3c5eb45bd1a2b2a178572fc09b65d28.exe	77
PID 3904 wrote to memory of 2808	3904	bb54e75c5c7c919c9b9173b6476ba0cce3c5eb45bd1a2b2a178572fc09b65d28.exe	77
PID 3904 wrote to memory of 2808	3904	bb54e75c5c7c919c9b9173b6476ba0cce3c5eb45bd1a2b2a178572fc09b65d28.exe	77
PID 3904 wrote to memory of 2720	3904	bb54e75c5c7c919c9b9173b6476ba0cce3c5eb45bd1a2b2a178572fc09b65d28.exe	78
PID 3904 wrote to memory of 2720	3904	bb54e75c5c7c919c9b9173b6476ba0cce3c5eb45bd1a2b2a178572fc09b65d28.exe	78
PID 3904 wrote to memory of 2720	3904	bb54e75c5c7c919c9b9173b6476ba0cce3c5eb45bd1a2b2a178572fc09b65d28.exe	78
PID 2720 wrote to memory of 192	2720	cmd.exe	80
PID 2720 wrote to memory of 192	2720	cmd.exe	80
PID 2720 wrote to memory of 192	2720	cmd.exe	80