qakbot | 0c206dee49a6cf0952f6982439df9f54c0e13d2947ddb8954e021abc7075c7cf

General

Target
0c206dee49a6cf0952f6982439df9f54c0e13d2947ddb8954e021abc7075c7cf.exe
Size 838KB
Sample201108-py753jd9x2
SHA256 0c206dee49a6cf0952f6982439df9f54c0e13d2947ddb8954e021abc7075c7cf
MD5 c965024b9c93611303b5129d867c8209
SHA1 d3bf40155fa4e60d177a96da06ddb6b5b350fce7
SHA512 5a42b555850cee9169cc93a06ad9257c2e0709a98526803a3008a6a29482cd7996c89b0124fdcdd2adc4d0349115f0cf1e3ae72d922abd3abc8c9e92027f1086
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	0c206dee49a6cf0952f6982439df9f54c0e13d2947ddb8954e021abc7075c7cf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	0c206dee49a6cf0952f6982439df9f54c0e13d2947ddb8954e021abc7075c7cf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	0c206dee49a6cf0952f6982439df9f54c0e13d2947ddb8954e021abc7075c7cf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	0c206dee49a6cf0952f6982439df9f54c0e13d2947ddb8954e021abc7075c7cf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	0c206dee49a6cf0952f6982439df9f54c0e13d2947ddb8954e021abc7075c7cf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	0c206dee49a6cf0952f6982439df9f54c0e13d2947ddb8954e021abc7075c7cf.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
2144	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1400	0c206dee49a6cf0952f6982439df9f54c0e13d2947ddb8954e021abc7075c7cf.exe
1400	0c206dee49a6cf0952f6982439df9f54c0e13d2947ddb8954e021abc7075c7cf.exe
688	0c206dee49a6cf0952f6982439df9f54c0e13d2947ddb8954e021abc7075c7cf.exe
688	0c206dee49a6cf0952f6982439df9f54c0e13d2947ddb8954e021abc7075c7cf.exe
688	0c206dee49a6cf0952f6982439df9f54c0e13d2947ddb8954e021abc7075c7cf.exe
688	0c206dee49a6cf0952f6982439df9f54c0e13d2947ddb8954e021abc7075c7cf.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1400 wrote to memory of 688	1400	0c206dee49a6cf0952f6982439df9f54c0e13d2947ddb8954e021abc7075c7cf.exe	79
PID 1400 wrote to memory of 688	1400	0c206dee49a6cf0952f6982439df9f54c0e13d2947ddb8954e021abc7075c7cf.exe	79
PID 1400 wrote to memory of 688	1400	0c206dee49a6cf0952f6982439df9f54c0e13d2947ddb8954e021abc7075c7cf.exe	79
PID 1400 wrote to memory of 2232	1400	0c206dee49a6cf0952f6982439df9f54c0e13d2947ddb8954e021abc7075c7cf.exe	80
PID 1400 wrote to memory of 2232	1400	0c206dee49a6cf0952f6982439df9f54c0e13d2947ddb8954e021abc7075c7cf.exe	80
PID 1400 wrote to memory of 2232	1400	0c206dee49a6cf0952f6982439df9f54c0e13d2947ddb8954e021abc7075c7cf.exe	80
PID 2232 wrote to memory of 2144	2232	cmd.exe	82
PID 2232 wrote to memory of 2144	2232	cmd.exe	82
PID 2232 wrote to memory of 2144	2232	cmd.exe	82