qakbot | 39d6cd237b99668d5018f346f4d71fae6cf2f085ca36d6d008d43fac5eccaea0

General

Target
39d6cd237b99668d5018f346f4d71fae6cf2f085ca36d6d008d43fac5eccaea0.exe
Size 251KB
Sample201113-zfda4tr5gj
SHA256 39d6cd237b99668d5018f346f4d71fae6cf2f085ca36d6d008d43fac5eccaea0
MD5 5c37d4a0a9ee2844842e1918d5d73308
SHA1 613aa10f2377aa558cb3e338d43608d40df214a3
SHA512 dff9fdbded1544a65482872af2c5ad051b966cd77acffe0ca02b075f3566d7f6e9415aea51671e008676da1df5c1b6402c45ee7abc128288452b2571dcafc2f5
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	39d6cd237b99668d5018f346f4d71fae6cf2f085ca36d6d008d43fac5eccaea0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	39d6cd237b99668d5018f346f4d71fae6cf2f085ca36d6d008d43fac5eccaea0.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	39d6cd237b99668d5018f346f4d71fae6cf2f085ca36d6d008d43fac5eccaea0.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	39d6cd237b99668d5018f346f4d71fae6cf2f085ca36d6d008d43fac5eccaea0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	39d6cd237b99668d5018f346f4d71fae6cf2f085ca36d6d008d43fac5eccaea0.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	39d6cd237b99668d5018f346f4d71fae6cf2f085ca36d6d008d43fac5eccaea0.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
4048	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
696	39d6cd237b99668d5018f346f4d71fae6cf2f085ca36d6d008d43fac5eccaea0.exe
696	39d6cd237b99668d5018f346f4d71fae6cf2f085ca36d6d008d43fac5eccaea0.exe
3164	39d6cd237b99668d5018f346f4d71fae6cf2f085ca36d6d008d43fac5eccaea0.exe
3164	39d6cd237b99668d5018f346f4d71fae6cf2f085ca36d6d008d43fac5eccaea0.exe
3164	39d6cd237b99668d5018f346f4d71fae6cf2f085ca36d6d008d43fac5eccaea0.exe
3164	39d6cd237b99668d5018f346f4d71fae6cf2f085ca36d6d008d43fac5eccaea0.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 696 wrote to memory of 3164	696	39d6cd237b99668d5018f346f4d71fae6cf2f085ca36d6d008d43fac5eccaea0.exe	79
PID 696 wrote to memory of 3164	696	39d6cd237b99668d5018f346f4d71fae6cf2f085ca36d6d008d43fac5eccaea0.exe	79
PID 696 wrote to memory of 3164	696	39d6cd237b99668d5018f346f4d71fae6cf2f085ca36d6d008d43fac5eccaea0.exe	79
PID 696 wrote to memory of 1376	696	39d6cd237b99668d5018f346f4d71fae6cf2f085ca36d6d008d43fac5eccaea0.exe	80
PID 696 wrote to memory of 1376	696	39d6cd237b99668d5018f346f4d71fae6cf2f085ca36d6d008d43fac5eccaea0.exe	80
PID 696 wrote to memory of 1376	696	39d6cd237b99668d5018f346f4d71fae6cf2f085ca36d6d008d43fac5eccaea0.exe	80
PID 1376 wrote to memory of 4048	1376	cmd.exe	82
PID 1376 wrote to memory of 4048	1376	cmd.exe	82
PID 1376 wrote to memory of 4048	1376	cmd.exe	82