qakbot | 38133b95604cbf9c73ab525f0980b04a3d2f3cdced76e13e341f164b66339795

General

Target
38133b95604cbf9c73ab525f0980b04a3d2f3cdced76e13e341f164b66339795.exe
Size 270KB
Sample201113-c8l5d3dwha
SHA256 38133b95604cbf9c73ab525f0980b04a3d2f3cdced76e13e341f164b66339795
MD5 e8700eddd6cece16a9743e58a324f421
SHA1 0fd049e90a131d7edb94d2f661b7c10d4d5ec088
SHA512 8b0565019203ae5bb74a25c3645070b715606024ca8ef077d92265366ec83d1e8ce34ecf35855b9b9874a8bfd84e664f9dc857affacc70723e6fe7db55c270ed
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	38133b95604cbf9c73ab525f0980b04a3d2f3cdced76e13e341f164b66339795.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	38133b95604cbf9c73ab525f0980b04a3d2f3cdced76e13e341f164b66339795.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	38133b95604cbf9c73ab525f0980b04a3d2f3cdced76e13e341f164b66339795.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	38133b95604cbf9c73ab525f0980b04a3d2f3cdced76e13e341f164b66339795.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	38133b95604cbf9c73ab525f0980b04a3d2f3cdced76e13e341f164b66339795.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	38133b95604cbf9c73ab525f0980b04a3d2f3cdced76e13e341f164b66339795.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
3812	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 980 wrote to memory of 188	980	38133b95604cbf9c73ab525f0980b04a3d2f3cdced76e13e341f164b66339795.exe	78
PID 980 wrote to memory of 188	980	38133b95604cbf9c73ab525f0980b04a3d2f3cdced76e13e341f164b66339795.exe	78
PID 980 wrote to memory of 188	980	38133b95604cbf9c73ab525f0980b04a3d2f3cdced76e13e341f164b66339795.exe	78
PID 980 wrote to memory of 732	980	38133b95604cbf9c73ab525f0980b04a3d2f3cdced76e13e341f164b66339795.exe	79
PID 980 wrote to memory of 732	980	38133b95604cbf9c73ab525f0980b04a3d2f3cdced76e13e341f164b66339795.exe	79
PID 980 wrote to memory of 732	980	38133b95604cbf9c73ab525f0980b04a3d2f3cdced76e13e341f164b66339795.exe	79
PID 732 wrote to memory of 3812	732	cmd.exe	81
PID 732 wrote to memory of 3812	732	cmd.exe	81
PID 732 wrote to memory of 3812	732	cmd.exe	81