qakbot | 8048dcf4bd4c2a6c61c7d5edff668d2bca7f2bb50ffc3202a270a973baaac2ce

General

Target
8048dcf4bd4c2a6c61c7d5edff668d2bca7f2bb50ffc3202a270a973baaac2ce.exe
Size 838KB
Sample201115-ekejp8ddv6
SHA256 8048dcf4bd4c2a6c61c7d5edff668d2bca7f2bb50ffc3202a270a973baaac2ce
MD5 427305bdc08beb9b814959094375432c
SHA1 815f302611e17a8df5b20215d0b2c9d9b99b71e9
SHA512 d4271b913776a8b882a33643acc5b9fe4409477cf733bc8ff9d4874e9b32dc5f9afbe22696ff78c43ffa838b405bb750864b4ea0727bb87238f5abfd00cfc549
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	8048dcf4bd4c2a6c61c7d5edff668d2bca7f2bb50ffc3202a270a973baaac2ce.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	8048dcf4bd4c2a6c61c7d5edff668d2bca7f2bb50ffc3202a270a973baaac2ce.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	8048dcf4bd4c2a6c61c7d5edff668d2bca7f2bb50ffc3202a270a973baaac2ce.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	8048dcf4bd4c2a6c61c7d5edff668d2bca7f2bb50ffc3202a270a973baaac2ce.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	8048dcf4bd4c2a6c61c7d5edff668d2bca7f2bb50ffc3202a270a973baaac2ce.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	8048dcf4bd4c2a6c61c7d5edff668d2bca7f2bb50ffc3202a270a973baaac2ce.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
4024	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3276	8048dcf4bd4c2a6c61c7d5edff668d2bca7f2bb50ffc3202a270a973baaac2ce.exe
3276	8048dcf4bd4c2a6c61c7d5edff668d2bca7f2bb50ffc3202a270a973baaac2ce.exe
2704	8048dcf4bd4c2a6c61c7d5edff668d2bca7f2bb50ffc3202a270a973baaac2ce.exe
2704	8048dcf4bd4c2a6c61c7d5edff668d2bca7f2bb50ffc3202a270a973baaac2ce.exe
2704	8048dcf4bd4c2a6c61c7d5edff668d2bca7f2bb50ffc3202a270a973baaac2ce.exe
2704	8048dcf4bd4c2a6c61c7d5edff668d2bca7f2bb50ffc3202a270a973baaac2ce.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3276 wrote to memory of 2704	3276	8048dcf4bd4c2a6c61c7d5edff668d2bca7f2bb50ffc3202a270a973baaac2ce.exe	79
PID 3276 wrote to memory of 2704	3276	8048dcf4bd4c2a6c61c7d5edff668d2bca7f2bb50ffc3202a270a973baaac2ce.exe	79
PID 3276 wrote to memory of 2704	3276	8048dcf4bd4c2a6c61c7d5edff668d2bca7f2bb50ffc3202a270a973baaac2ce.exe	79
PID 3276 wrote to memory of 1864	3276	8048dcf4bd4c2a6c61c7d5edff668d2bca7f2bb50ffc3202a270a973baaac2ce.exe	80
PID 3276 wrote to memory of 1864	3276	8048dcf4bd4c2a6c61c7d5edff668d2bca7f2bb50ffc3202a270a973baaac2ce.exe	80
PID 3276 wrote to memory of 1864	3276	8048dcf4bd4c2a6c61c7d5edff668d2bca7f2bb50ffc3202a270a973baaac2ce.exe	80
PID 1864 wrote to memory of 4024	1864	cmd.exe	82
PID 1864 wrote to memory of 4024	1864	cmd.exe	82
PID 1864 wrote to memory of 4024	1864	cmd.exe	82