qakbot | 01110780e65a94296dffd67db662296c987d24323b6e1c2ef760dd7057123a6f

General

Target
01110780e65a94296dffd67db662296c987d24323b6e1c2ef760dd7057123a6f.exe
Size 257KB
Sample201108-754sc6f2ex
SHA256 01110780e65a94296dffd67db662296c987d24323b6e1c2ef760dd7057123a6f
MD5 49f6d63ba58a1a61fb5a82608c6b5a76
SHA1 ac3b2a484ec13e044238f0ffdf38b1baad82116e
SHA512 a1164cd2ad7adee4ede679f9b4df6959ee41606089996eda15e2f44d6858ae7ef3434f8435d47fec162c3da89ee65ca66df79ebfeca5aaac3f901f959c089088
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	01110780e65a94296dffd67db662296c987d24323b6e1c2ef760dd7057123a6f.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	01110780e65a94296dffd67db662296c987d24323b6e1c2ef760dd7057123a6f.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	01110780e65a94296dffd67db662296c987d24323b6e1c2ef760dd7057123a6f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	01110780e65a94296dffd67db662296c987d24323b6e1c2ef760dd7057123a6f.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	01110780e65a94296dffd67db662296c987d24323b6e1c2ef760dd7057123a6f.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	01110780e65a94296dffd67db662296c987d24323b6e1c2ef760dd7057123a6f.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
4440	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4760 wrote to memory of 2376	4760	01110780e65a94296dffd67db662296c987d24323b6e1c2ef760dd7057123a6f.exe	79
PID 4760 wrote to memory of 2376	4760	01110780e65a94296dffd67db662296c987d24323b6e1c2ef760dd7057123a6f.exe	79
PID 4760 wrote to memory of 2376	4760	01110780e65a94296dffd67db662296c987d24323b6e1c2ef760dd7057123a6f.exe	79
PID 4760 wrote to memory of 4080	4760	01110780e65a94296dffd67db662296c987d24323b6e1c2ef760dd7057123a6f.exe	80
PID 4760 wrote to memory of 4080	4760	01110780e65a94296dffd67db662296c987d24323b6e1c2ef760dd7057123a6f.exe	80
PID 4760 wrote to memory of 4080	4760	01110780e65a94296dffd67db662296c987d24323b6e1c2ef760dd7057123a6f.exe	80
PID 4080 wrote to memory of 4440	4080	cmd.exe	82
PID 4080 wrote to memory of 4440	4080	cmd.exe	82
PID 4080 wrote to memory of 4440	4080	cmd.exe	82