3849944c5db10f13305f76c92c1a8c80bc37f6a0514c19ea4a2bbeae62438113

General

Target
Qakbot signed VESNA, OOO.exe
Size 4.2MB
Sample200923-w86fvraqxs
SHA256 3849944c5db10f13305f76c92c1a8c80bc37f6a0514c19ea4a2bbeae62438113
MD5 5bc0b082c0e069532cb31bd08bd4a2d4
SHA1 e48d322c3b1126ed4d51a0e50914d20fdc94c633
SHA512 2405d05220812ae9977213e3fd4f5474e2ac9be92f8da1c0a7bc9ebe541fbe77f1b006bb8b56b4b72e2b3bf681cbb7119da3c72190be22886a5503ea524ce210
MD5 SHA1 SHA512

Score

8^/10

Executes dropped EXE 2 IoCs

pid	Process
2408	guxyfo.exe
2704	guxyfo.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	Qakbot signed VESNA, OOO.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	Qakbot signed VESNA, OOO.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	Qakbot signed VESNA, OOO.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	Qakbot signed VESNA, OOO.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	Qakbot signed VESNA, OOO.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	Qakbot signed VESNA, OOO.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
2600	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3740 wrote to memory of 3540	3740	Qakbot signed VESNA, OOO.exe	75
PID 3740 wrote to memory of 3540	3740	Qakbot signed VESNA, OOO.exe	75
PID 3740 wrote to memory of 3540	3740	Qakbot signed VESNA, OOO.exe	75
PID 3740 wrote to memory of 2408	3740	Qakbot signed VESNA, OOO.exe	76
PID 3740 wrote to memory of 2408	3740	Qakbot signed VESNA, OOO.exe	76
PID 3740 wrote to memory of 2408	3740	Qakbot signed VESNA, OOO.exe	76
PID 3740 wrote to memory of 2600	3740	Qakbot signed VESNA, OOO.exe	77
PID 3740 wrote to memory of 2600	3740	Qakbot signed VESNA, OOO.exe	77
PID 3740 wrote to memory of 2600	3740	Qakbot signed VESNA, OOO.exe	77
PID 2408 wrote to memory of 2704	2408	guxyfo.exe	79
PID 2408 wrote to memory of 2704	2408	guxyfo.exe	79
PID 2408 wrote to memory of 2704	2408	guxyfo.exe	79

C:\Users\Admin\AppData\Local\Temp\Qakbot signed VESNA, OOO.exe
"C:\Users\Admin\AppData\Local\Temp\Qakbot signed VESNA, OOO.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3740
- C:\Users\Admin\AppData\Local\Temp\Qakbot signed VESNA, OOO.exe
  "C:\Users\Admin\AppData\Local\Temp\Qakbot signed VESNA, OOO.exe" /C
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  PID:3540
- C:\Users\Admin\AppData\Roaming\Microsoft\Efiythavllkc\guxyfo.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Efiythavllkc\guxyfo.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2408
- - C:\Users\Admin\AppData\Roaming\Microsoft\Efiythavllkc\guxyfo.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Efiythavllkc\guxyfo.exe /C
    3⤵
    - Executes dropped EXE
    PID:2704
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn rbilnhbh /tr "\"C:\Users\Admin\AppData\Local\Temp\Qakbot signed VESNA, OOO.exe\" /I rbilnhbh" /SC ONCE /Z /ST 10:26 /ET 10:38
  2⤵
  - Creates scheduled task(s)
  PID:2600