qakbot | db1e27ede507d93eded6eaa8ed741d46ef537f25e03f00116fd39cd5986f79fb

General

Target
db1e27ede507d93eded6eaa8ed741d46ef537f25e03f00116fd39cd5986f79fb.exe
Size 257KB
Sample201113-tybh8kbxgn
SHA256 db1e27ede507d93eded6eaa8ed741d46ef537f25e03f00116fd39cd5986f79fb
MD5 49f5a58728815c3d6fdafecd07b0a79d
SHA1 2c375cb6c6bf6518e248b452854b5d1698cbf576
SHA512 63af8db5757ce493cb89827250ba2e6022ba2d12342a8c4d9d47f48b4610eda56d9c7c8775c83c4f84963e7ad142405330a2167254c188a729bb1942d79b5923
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	db1e27ede507d93eded6eaa8ed741d46ef537f25e03f00116fd39cd5986f79fb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	db1e27ede507d93eded6eaa8ed741d46ef537f25e03f00116fd39cd5986f79fb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	db1e27ede507d93eded6eaa8ed741d46ef537f25e03f00116fd39cd5986f79fb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	db1e27ede507d93eded6eaa8ed741d46ef537f25e03f00116fd39cd5986f79fb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	db1e27ede507d93eded6eaa8ed741d46ef537f25e03f00116fd39cd5986f79fb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	db1e27ede507d93eded6eaa8ed741d46ef537f25e03f00116fd39cd5986f79fb.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
4052	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3336	db1e27ede507d93eded6eaa8ed741d46ef537f25e03f00116fd39cd5986f79fb.exe
3336	db1e27ede507d93eded6eaa8ed741d46ef537f25e03f00116fd39cd5986f79fb.exe
208	db1e27ede507d93eded6eaa8ed741d46ef537f25e03f00116fd39cd5986f79fb.exe
208	db1e27ede507d93eded6eaa8ed741d46ef537f25e03f00116fd39cd5986f79fb.exe
208	db1e27ede507d93eded6eaa8ed741d46ef537f25e03f00116fd39cd5986f79fb.exe
208	db1e27ede507d93eded6eaa8ed741d46ef537f25e03f00116fd39cd5986f79fb.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3336 wrote to memory of 208	3336	db1e27ede507d93eded6eaa8ed741d46ef537f25e03f00116fd39cd5986f79fb.exe	78
PID 3336 wrote to memory of 208	3336	db1e27ede507d93eded6eaa8ed741d46ef537f25e03f00116fd39cd5986f79fb.exe	78
PID 3336 wrote to memory of 208	3336	db1e27ede507d93eded6eaa8ed741d46ef537f25e03f00116fd39cd5986f79fb.exe	78
PID 3336 wrote to memory of 1384	3336	db1e27ede507d93eded6eaa8ed741d46ef537f25e03f00116fd39cd5986f79fb.exe	79
PID 3336 wrote to memory of 1384	3336	db1e27ede507d93eded6eaa8ed741d46ef537f25e03f00116fd39cd5986f79fb.exe	79
PID 3336 wrote to memory of 1384	3336	db1e27ede507d93eded6eaa8ed741d46ef537f25e03f00116fd39cd5986f79fb.exe	79
PID 1384 wrote to memory of 4052	1384	cmd.exe	81
PID 1384 wrote to memory of 4052	1384	cmd.exe	81
PID 1384 wrote to memory of 4052	1384	cmd.exe	81