qakbot | c08f3548997ec17cd7127b61d8c4fc05392e27be58bb05f8a033b04515b095e5

General

Target
c08f3548997ec17cd7127b61d8c4fc05392e27be58bb05f8a033b04515b095e5.exe
Size 250KB
Sample201108-d8jmsd8ghn
SHA256 c08f3548997ec17cd7127b61d8c4fc05392e27be58bb05f8a033b04515b095e5
MD5 c7fe5346f3d67dc972beec9be5506217
SHA1 43d174402fb3fc5769f6af8de4703c697462bec3
SHA512 099de491189c4caa6bba2e2eee14dadeb22d722558f85d72720107eff14eab2d0936e2484fe7b56bcc94b3d38ad9ff07958deac4b9721ca8123d9639c983798d
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	c08f3548997ec17cd7127b61d8c4fc05392e27be58bb05f8a033b04515b095e5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	c08f3548997ec17cd7127b61d8c4fc05392e27be58bb05f8a033b04515b095e5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	c08f3548997ec17cd7127b61d8c4fc05392e27be58bb05f8a033b04515b095e5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	c08f3548997ec17cd7127b61d8c4fc05392e27be58bb05f8a033b04515b095e5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	c08f3548997ec17cd7127b61d8c4fc05392e27be58bb05f8a033b04515b095e5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	c08f3548997ec17cd7127b61d8c4fc05392e27be58bb05f8a033b04515b095e5.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
1736	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4692 wrote to memory of 3136	4692	c08f3548997ec17cd7127b61d8c4fc05392e27be58bb05f8a033b04515b095e5.exe	78
PID 4692 wrote to memory of 3136	4692	c08f3548997ec17cd7127b61d8c4fc05392e27be58bb05f8a033b04515b095e5.exe	78
PID 4692 wrote to memory of 3136	4692	c08f3548997ec17cd7127b61d8c4fc05392e27be58bb05f8a033b04515b095e5.exe	78
PID 4692 wrote to memory of 4148	4692	c08f3548997ec17cd7127b61d8c4fc05392e27be58bb05f8a033b04515b095e5.exe	79
PID 4692 wrote to memory of 4148	4692	c08f3548997ec17cd7127b61d8c4fc05392e27be58bb05f8a033b04515b095e5.exe	79
PID 4692 wrote to memory of 4148	4692	c08f3548997ec17cd7127b61d8c4fc05392e27be58bb05f8a033b04515b095e5.exe	79
PID 4148 wrote to memory of 1736	4148	cmd.exe	81
PID 4148 wrote to memory of 1736	4148	cmd.exe	81
PID 4148 wrote to memory of 1736	4148	cmd.exe	81