qakbot | 0a7b23f6d097b50a1e73f3a8957e0ccdbaf9c11d5e589a8c48cb93aad00a57f0

General

Target
0a7b23f6d097b50a1e73f3a8957e0ccdbaf9c11d5e589a8c48cb93aad00a57f0.exe
Size 274KB
Sample201108-4zeppvx8gs
SHA256 0a7b23f6d097b50a1e73f3a8957e0ccdbaf9c11d5e589a8c48cb93aad00a57f0
MD5 3a4b2f940ce615551b18a7d1480f2f35
SHA1 707fc849fe57d25e73df1c856aa5ee04e2d67a6d
SHA512 2ffb096c72b66fa5aa217e8f256bf91f04d4fb3b07cbc4042a5486046756395030c0e54444456c3af7846b81d3d9ee495267616b983a14b96b1501f3ca8c4a8e
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	0a7b23f6d097b50a1e73f3a8957e0ccdbaf9c11d5e589a8c48cb93aad00a57f0.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	0a7b23f6d097b50a1e73f3a8957e0ccdbaf9c11d5e589a8c48cb93aad00a57f0.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	0a7b23f6d097b50a1e73f3a8957e0ccdbaf9c11d5e589a8c48cb93aad00a57f0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	0a7b23f6d097b50a1e73f3a8957e0ccdbaf9c11d5e589a8c48cb93aad00a57f0.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	0a7b23f6d097b50a1e73f3a8957e0ccdbaf9c11d5e589a8c48cb93aad00a57f0.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	0a7b23f6d097b50a1e73f3a8957e0ccdbaf9c11d5e589a8c48cb93aad00a57f0.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
2832	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1036	0a7b23f6d097b50a1e73f3a8957e0ccdbaf9c11d5e589a8c48cb93aad00a57f0.exe
1036	0a7b23f6d097b50a1e73f3a8957e0ccdbaf9c11d5e589a8c48cb93aad00a57f0.exe
2748	0a7b23f6d097b50a1e73f3a8957e0ccdbaf9c11d5e589a8c48cb93aad00a57f0.exe
2748	0a7b23f6d097b50a1e73f3a8957e0ccdbaf9c11d5e589a8c48cb93aad00a57f0.exe
2748	0a7b23f6d097b50a1e73f3a8957e0ccdbaf9c11d5e589a8c48cb93aad00a57f0.exe
2748	0a7b23f6d097b50a1e73f3a8957e0ccdbaf9c11d5e589a8c48cb93aad00a57f0.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1036 wrote to memory of 2748	1036	0a7b23f6d097b50a1e73f3a8957e0ccdbaf9c11d5e589a8c48cb93aad00a57f0.exe	79
PID 1036 wrote to memory of 2748	1036	0a7b23f6d097b50a1e73f3a8957e0ccdbaf9c11d5e589a8c48cb93aad00a57f0.exe	79
PID 1036 wrote to memory of 2748	1036	0a7b23f6d097b50a1e73f3a8957e0ccdbaf9c11d5e589a8c48cb93aad00a57f0.exe	79
PID 1036 wrote to memory of 3400	1036	0a7b23f6d097b50a1e73f3a8957e0ccdbaf9c11d5e589a8c48cb93aad00a57f0.exe	80
PID 1036 wrote to memory of 3400	1036	0a7b23f6d097b50a1e73f3a8957e0ccdbaf9c11d5e589a8c48cb93aad00a57f0.exe	80
PID 1036 wrote to memory of 3400	1036	0a7b23f6d097b50a1e73f3a8957e0ccdbaf9c11d5e589a8c48cb93aad00a57f0.exe	80
PID 3400 wrote to memory of 2832	3400	cmd.exe	82
PID 3400 wrote to memory of 2832	3400	cmd.exe	82
PID 3400 wrote to memory of 2832	3400	cmd.exe	82