qakbot | df2f9680b2c73d0d25c298edc502ea127f02a02ce7c2023b0c5a0cbdc863f436

General

Target
df2f9680b2c73d0d25c298edc502ea127f02a02ce7c2023b0c5a0cbdc863f436.exe
Size 270KB
Sample201113-tq54jp2d9e
SHA256 df2f9680b2c73d0d25c298edc502ea127f02a02ce7c2023b0c5a0cbdc863f436
MD5 b0ca44f34504deb50a7448223a2c57bc
SHA1 21b2f9bc1e089640609957b9393c977a60b6150d
SHA512 da6cff366eb38323ee69d3867dd6859b1ff030c599a468ac42824867f9eee4e82b10fd46b7e360e4f43d1eb6f9c3cd6c116d4c069b597194dc2b548039e73261
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	df2f9680b2c73d0d25c298edc502ea127f02a02ce7c2023b0c5a0cbdc863f436.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	df2f9680b2c73d0d25c298edc502ea127f02a02ce7c2023b0c5a0cbdc863f436.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	df2f9680b2c73d0d25c298edc502ea127f02a02ce7c2023b0c5a0cbdc863f436.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	df2f9680b2c73d0d25c298edc502ea127f02a02ce7c2023b0c5a0cbdc863f436.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	df2f9680b2c73d0d25c298edc502ea127f02a02ce7c2023b0c5a0cbdc863f436.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	df2f9680b2c73d0d25c298edc502ea127f02a02ce7c2023b0c5a0cbdc863f436.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
1508	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3408	df2f9680b2c73d0d25c298edc502ea127f02a02ce7c2023b0c5a0cbdc863f436.exe
3408	df2f9680b2c73d0d25c298edc502ea127f02a02ce7c2023b0c5a0cbdc863f436.exe
3564	df2f9680b2c73d0d25c298edc502ea127f02a02ce7c2023b0c5a0cbdc863f436.exe
3564	df2f9680b2c73d0d25c298edc502ea127f02a02ce7c2023b0c5a0cbdc863f436.exe
3564	df2f9680b2c73d0d25c298edc502ea127f02a02ce7c2023b0c5a0cbdc863f436.exe
3564	df2f9680b2c73d0d25c298edc502ea127f02a02ce7c2023b0c5a0cbdc863f436.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3408 wrote to memory of 3564	3408	df2f9680b2c73d0d25c298edc502ea127f02a02ce7c2023b0c5a0cbdc863f436.exe	79
PID 3408 wrote to memory of 3564	3408	df2f9680b2c73d0d25c298edc502ea127f02a02ce7c2023b0c5a0cbdc863f436.exe	79
PID 3408 wrote to memory of 3564	3408	df2f9680b2c73d0d25c298edc502ea127f02a02ce7c2023b0c5a0cbdc863f436.exe	79
PID 3408 wrote to memory of 3860	3408	df2f9680b2c73d0d25c298edc502ea127f02a02ce7c2023b0c5a0cbdc863f436.exe	80
PID 3408 wrote to memory of 3860	3408	df2f9680b2c73d0d25c298edc502ea127f02a02ce7c2023b0c5a0cbdc863f436.exe	80
PID 3408 wrote to memory of 3860	3408	df2f9680b2c73d0d25c298edc502ea127f02a02ce7c2023b0c5a0cbdc863f436.exe	80
PID 3860 wrote to memory of 1508	3860	cmd.exe	82
PID 3860 wrote to memory of 1508	3860	cmd.exe	82
PID 3860 wrote to memory of 1508	3860	cmd.exe	82