qakbot | 1807e9ffd0691baa7afbef30b3f4c1186750817bcd3e8167be2c00a6e09d3295

General

Target
1807e9ffd0691baa7afbef30b3f4c1186750817bcd3e8167be2c00a6e09d3295.exe
Size 257KB
Sample201108-v4wrkbnhsx
SHA256 1807e9ffd0691baa7afbef30b3f4c1186750817bcd3e8167be2c00a6e09d3295
MD5 3f0a72aa00e5240b40d0f4c6a282adde
SHA1 94aa3b27e8f161cd6fd5d9fec39789f7ca3829c8
SHA512 c6236a8c10122c14911ec1873486f887309ba4fbbc1c961b82e858755ae6ac3be7b3c438ad574ce0cd41678113f0ce4433ea62344a3df469255e10ff0e170dfe
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	1807e9ffd0691baa7afbef30b3f4c1186750817bcd3e8167be2c00a6e09d3295.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	1807e9ffd0691baa7afbef30b3f4c1186750817bcd3e8167be2c00a6e09d3295.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	1807e9ffd0691baa7afbef30b3f4c1186750817bcd3e8167be2c00a6e09d3295.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	1807e9ffd0691baa7afbef30b3f4c1186750817bcd3e8167be2c00a6e09d3295.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	1807e9ffd0691baa7afbef30b3f4c1186750817bcd3e8167be2c00a6e09d3295.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	1807e9ffd0691baa7afbef30b3f4c1186750817bcd3e8167be2c00a6e09d3295.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
3760	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
648	1807e9ffd0691baa7afbef30b3f4c1186750817bcd3e8167be2c00a6e09d3295.exe
648	1807e9ffd0691baa7afbef30b3f4c1186750817bcd3e8167be2c00a6e09d3295.exe
2532	1807e9ffd0691baa7afbef30b3f4c1186750817bcd3e8167be2c00a6e09d3295.exe
2532	1807e9ffd0691baa7afbef30b3f4c1186750817bcd3e8167be2c00a6e09d3295.exe
2532	1807e9ffd0691baa7afbef30b3f4c1186750817bcd3e8167be2c00a6e09d3295.exe
2532	1807e9ffd0691baa7afbef30b3f4c1186750817bcd3e8167be2c00a6e09d3295.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 648 wrote to memory of 2532	648	1807e9ffd0691baa7afbef30b3f4c1186750817bcd3e8167be2c00a6e09d3295.exe	78
PID 648 wrote to memory of 2532	648	1807e9ffd0691baa7afbef30b3f4c1186750817bcd3e8167be2c00a6e09d3295.exe	78
PID 648 wrote to memory of 2532	648	1807e9ffd0691baa7afbef30b3f4c1186750817bcd3e8167be2c00a6e09d3295.exe	78
PID 648 wrote to memory of 2276	648	1807e9ffd0691baa7afbef30b3f4c1186750817bcd3e8167be2c00a6e09d3295.exe	79
PID 648 wrote to memory of 2276	648	1807e9ffd0691baa7afbef30b3f4c1186750817bcd3e8167be2c00a6e09d3295.exe	79
PID 648 wrote to memory of 2276	648	1807e9ffd0691baa7afbef30b3f4c1186750817bcd3e8167be2c00a6e09d3295.exe	79
PID 2276 wrote to memory of 3760	2276	cmd.exe	81
PID 2276 wrote to memory of 3760	2276	cmd.exe	81
PID 2276 wrote to memory of 3760	2276	cmd.exe	81