qakbot | 2bd6835baeeca8804c86ea0e354b14df98dc102d039b414df7cc6bdde8686c76

General

Target
2bd6835baeeca8804c86ea0e354b14df98dc102d039b414df7cc6bdde8686c76.exe
Size 838KB
Sample201113-8273zdqr2a
SHA256 2bd6835baeeca8804c86ea0e354b14df98dc102d039b414df7cc6bdde8686c76
MD5 c2e3b22d4c80e7970295b4e20a0832c0
SHA1 4394d8d5c629a3f8f43bd089a4c09784bc47e567
SHA512 7cf86a44d47b67dad8527491632cbc39c20ee7332282ef6f9833fd1141d53f82d5a5a280c1e87dd67967d3a03bff65569e4eb1d0a2478689e9c434042a382758
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	2bd6835baeeca8804c86ea0e354b14df98dc102d039b414df7cc6bdde8686c76.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	2bd6835baeeca8804c86ea0e354b14df98dc102d039b414df7cc6bdde8686c76.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	2bd6835baeeca8804c86ea0e354b14df98dc102d039b414df7cc6bdde8686c76.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	2bd6835baeeca8804c86ea0e354b14df98dc102d039b414df7cc6bdde8686c76.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	2bd6835baeeca8804c86ea0e354b14df98dc102d039b414df7cc6bdde8686c76.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	2bd6835baeeca8804c86ea0e354b14df98dc102d039b414df7cc6bdde8686c76.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
684	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4800	2bd6835baeeca8804c86ea0e354b14df98dc102d039b414df7cc6bdde8686c76.exe
4800	2bd6835baeeca8804c86ea0e354b14df98dc102d039b414df7cc6bdde8686c76.exe
4292	2bd6835baeeca8804c86ea0e354b14df98dc102d039b414df7cc6bdde8686c76.exe
4292	2bd6835baeeca8804c86ea0e354b14df98dc102d039b414df7cc6bdde8686c76.exe
4292	2bd6835baeeca8804c86ea0e354b14df98dc102d039b414df7cc6bdde8686c76.exe
4292	2bd6835baeeca8804c86ea0e354b14df98dc102d039b414df7cc6bdde8686c76.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 4292	4800	2bd6835baeeca8804c86ea0e354b14df98dc102d039b414df7cc6bdde8686c76.exe	78
PID 4800 wrote to memory of 4292	4800	2bd6835baeeca8804c86ea0e354b14df98dc102d039b414df7cc6bdde8686c76.exe	78
PID 4800 wrote to memory of 4292	4800	2bd6835baeeca8804c86ea0e354b14df98dc102d039b414df7cc6bdde8686c76.exe	78
PID 4800 wrote to memory of 3192	4800	2bd6835baeeca8804c86ea0e354b14df98dc102d039b414df7cc6bdde8686c76.exe	79
PID 4800 wrote to memory of 3192	4800	2bd6835baeeca8804c86ea0e354b14df98dc102d039b414df7cc6bdde8686c76.exe	79
PID 4800 wrote to memory of 3192	4800	2bd6835baeeca8804c86ea0e354b14df98dc102d039b414df7cc6bdde8686c76.exe	79
PID 3192 wrote to memory of 684	3192	cmd.exe	81
PID 3192 wrote to memory of 684	3192	cmd.exe	81
PID 3192 wrote to memory of 684	3192	cmd.exe	81