qakbot | 4d99f5b5bcc10fde5ef24c1699bffaeca430d45e4b5cc2d5537a7e3c18f9c3d5

General

Target
4d99f5b5bcc10fde5ef24c1699bffaeca430d45e4b5cc2d5537a7e3c18f9c3d5.exe
Size 270KB
Sample201115-nzykdx6stn
SHA256 4d99f5b5bcc10fde5ef24c1699bffaeca430d45e4b5cc2d5537a7e3c18f9c3d5
MD5 9ef4a15603e24e5dea2cf84b9f6ceed0
SHA1 a9f16d458f676f75b05085d473a734ea7af83b13
SHA512 d8c8a238ad62fb4ebd103d9ed0a3708bc0350f222105b4704cb453d4307aceee66360e7380429e4eb9a2993f8743b55ee6e9b2d4820792d172b57ed7a2b8b625
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	4d99f5b5bcc10fde5ef24c1699bffaeca430d45e4b5cc2d5537a7e3c18f9c3d5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	4d99f5b5bcc10fde5ef24c1699bffaeca430d45e4b5cc2d5537a7e3c18f9c3d5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	4d99f5b5bcc10fde5ef24c1699bffaeca430d45e4b5cc2d5537a7e3c18f9c3d5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	4d99f5b5bcc10fde5ef24c1699bffaeca430d45e4b5cc2d5537a7e3c18f9c3d5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	4d99f5b5bcc10fde5ef24c1699bffaeca430d45e4b5cc2d5537a7e3c18f9c3d5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	4d99f5b5bcc10fde5ef24c1699bffaeca430d45e4b5cc2d5537a7e3c18f9c3d5.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
952	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1180	4d99f5b5bcc10fde5ef24c1699bffaeca430d45e4b5cc2d5537a7e3c18f9c3d5.exe
1180	4d99f5b5bcc10fde5ef24c1699bffaeca430d45e4b5cc2d5537a7e3c18f9c3d5.exe
2556	4d99f5b5bcc10fde5ef24c1699bffaeca430d45e4b5cc2d5537a7e3c18f9c3d5.exe
2556	4d99f5b5bcc10fde5ef24c1699bffaeca430d45e4b5cc2d5537a7e3c18f9c3d5.exe
2556	4d99f5b5bcc10fde5ef24c1699bffaeca430d45e4b5cc2d5537a7e3c18f9c3d5.exe
2556	4d99f5b5bcc10fde5ef24c1699bffaeca430d45e4b5cc2d5537a7e3c18f9c3d5.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1180 wrote to memory of 2556	1180	4d99f5b5bcc10fde5ef24c1699bffaeca430d45e4b5cc2d5537a7e3c18f9c3d5.exe	79
PID 1180 wrote to memory of 2556	1180	4d99f5b5bcc10fde5ef24c1699bffaeca430d45e4b5cc2d5537a7e3c18f9c3d5.exe	79
PID 1180 wrote to memory of 2556	1180	4d99f5b5bcc10fde5ef24c1699bffaeca430d45e4b5cc2d5537a7e3c18f9c3d5.exe	79
PID 1180 wrote to memory of 1088	1180	4d99f5b5bcc10fde5ef24c1699bffaeca430d45e4b5cc2d5537a7e3c18f9c3d5.exe	80
PID 1180 wrote to memory of 1088	1180	4d99f5b5bcc10fde5ef24c1699bffaeca430d45e4b5cc2d5537a7e3c18f9c3d5.exe	80
PID 1180 wrote to memory of 1088	1180	4d99f5b5bcc10fde5ef24c1699bffaeca430d45e4b5cc2d5537a7e3c18f9c3d5.exe	80
PID 1088 wrote to memory of 952	1088	cmd.exe	82
PID 1088 wrote to memory of 952	1088	cmd.exe	82
PID 1088 wrote to memory of 952	1088	cmd.exe	82