qakbot | 2740229cd0513f81b0be2ac7cb06871f44bdfcea2fca954b7d4d78823c1f19c1

General

Target
2740229cd0513f81b0be2ac7cb06871f44bdfcea2fca954b7d4d78823c1f19c1.exe
Size 254KB
Sample201111-age8mjj9b2
SHA256 2740229cd0513f81b0be2ac7cb06871f44bdfcea2fca954b7d4d78823c1f19c1
MD5 451e1925e6b9fbf83ea26c579250e8df
SHA1 3da4a4c82d6d5b08c231a9eb33c4ad0f38fd94b8
SHA512 d5a13d5fd989d189abd5d0034ee74a13fe57fb4f54d5bab044ce12667c6832f020a4799495c71e997000a23246e7493be057bcfa96712144161d8943dfe04ee2
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	2740229cd0513f81b0be2ac7cb06871f44bdfcea2fca954b7d4d78823c1f19c1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	2740229cd0513f81b0be2ac7cb06871f44bdfcea2fca954b7d4d78823c1f19c1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	2740229cd0513f81b0be2ac7cb06871f44bdfcea2fca954b7d4d78823c1f19c1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	2740229cd0513f81b0be2ac7cb06871f44bdfcea2fca954b7d4d78823c1f19c1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	2740229cd0513f81b0be2ac7cb06871f44bdfcea2fca954b7d4d78823c1f19c1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	2740229cd0513f81b0be2ac7cb06871f44bdfcea2fca954b7d4d78823c1f19c1.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
3292	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
796	2740229cd0513f81b0be2ac7cb06871f44bdfcea2fca954b7d4d78823c1f19c1.exe
796	2740229cd0513f81b0be2ac7cb06871f44bdfcea2fca954b7d4d78823c1f19c1.exe
2312	2740229cd0513f81b0be2ac7cb06871f44bdfcea2fca954b7d4d78823c1f19c1.exe
2312	2740229cd0513f81b0be2ac7cb06871f44bdfcea2fca954b7d4d78823c1f19c1.exe
2312	2740229cd0513f81b0be2ac7cb06871f44bdfcea2fca954b7d4d78823c1f19c1.exe
2312	2740229cd0513f81b0be2ac7cb06871f44bdfcea2fca954b7d4d78823c1f19c1.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 796 wrote to memory of 2312	796	2740229cd0513f81b0be2ac7cb06871f44bdfcea2fca954b7d4d78823c1f19c1.exe	78
PID 796 wrote to memory of 2312	796	2740229cd0513f81b0be2ac7cb06871f44bdfcea2fca954b7d4d78823c1f19c1.exe	78
PID 796 wrote to memory of 2312	796	2740229cd0513f81b0be2ac7cb06871f44bdfcea2fca954b7d4d78823c1f19c1.exe	78
PID 796 wrote to memory of 1816	796	2740229cd0513f81b0be2ac7cb06871f44bdfcea2fca954b7d4d78823c1f19c1.exe	79
PID 796 wrote to memory of 1816	796	2740229cd0513f81b0be2ac7cb06871f44bdfcea2fca954b7d4d78823c1f19c1.exe	79
PID 796 wrote to memory of 1816	796	2740229cd0513f81b0be2ac7cb06871f44bdfcea2fca954b7d4d78823c1f19c1.exe	79
PID 1816 wrote to memory of 3292	1816	cmd.exe	81
PID 1816 wrote to memory of 3292	1816	cmd.exe	81
PID 1816 wrote to memory of 3292	1816	cmd.exe	81