qakbot | 730a2f13a2d69afe03a940276aca880c5a2c29b68d3d2d15e4d517ef69d03ce7

General

Target
730a2f13a2d69afe03a940276aca880c5a2c29b68d3d2d15e4d517ef69d03ce7.exe
Size 254KB
Sample201113-ttmmydj7bx
SHA256 730a2f13a2d69afe03a940276aca880c5a2c29b68d3d2d15e4d517ef69d03ce7
MD5 2d9137d22d9c02781f90071d69205699
SHA1 c5795deb0305db2fb170231faab31a05f88ff429
SHA512 33f27f25a0f07a4c57220db224155fce55ca6a402c4ed2ec3bcfab869bb09d02a9f42cf55d5a701ce0ed8533e838cf0adb0c7ffc42569e496ebfb338a70048c3
MD5 SHA1 SHA512

Score

10^/10

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	730a2f13a2d69afe03a940276aca880c5a2c29b68d3d2d15e4d517ef69d03ce7.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	730a2f13a2d69afe03a940276aca880c5a2c29b68d3d2d15e4d517ef69d03ce7.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	730a2f13a2d69afe03a940276aca880c5a2c29b68d3d2d15e4d517ef69d03ce7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	730a2f13a2d69afe03a940276aca880c5a2c29b68d3d2d15e4d517ef69d03ce7.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	730a2f13a2d69afe03a940276aca880c5a2c29b68d3d2d15e4d517ef69d03ce7.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	730a2f13a2d69afe03a940276aca880c5a2c29b68d3d2d15e4d517ef69d03ce7.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
3368	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
640	730a2f13a2d69afe03a940276aca880c5a2c29b68d3d2d15e4d517ef69d03ce7.exe
640	730a2f13a2d69afe03a940276aca880c5a2c29b68d3d2d15e4d517ef69d03ce7.exe
184	730a2f13a2d69afe03a940276aca880c5a2c29b68d3d2d15e4d517ef69d03ce7.exe
184	730a2f13a2d69afe03a940276aca880c5a2c29b68d3d2d15e4d517ef69d03ce7.exe
184	730a2f13a2d69afe03a940276aca880c5a2c29b68d3d2d15e4d517ef69d03ce7.exe
184	730a2f13a2d69afe03a940276aca880c5a2c29b68d3d2d15e4d517ef69d03ce7.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 640 wrote to memory of 184	640	730a2f13a2d69afe03a940276aca880c5a2c29b68d3d2d15e4d517ef69d03ce7.exe	78
PID 640 wrote to memory of 184	640	730a2f13a2d69afe03a940276aca880c5a2c29b68d3d2d15e4d517ef69d03ce7.exe	78
PID 640 wrote to memory of 184	640	730a2f13a2d69afe03a940276aca880c5a2c29b68d3d2d15e4d517ef69d03ce7.exe	78
PID 640 wrote to memory of 2268	640	730a2f13a2d69afe03a940276aca880c5a2c29b68d3d2d15e4d517ef69d03ce7.exe	79
PID 640 wrote to memory of 2268	640	730a2f13a2d69afe03a940276aca880c5a2c29b68d3d2d15e4d517ef69d03ce7.exe	79
PID 640 wrote to memory of 2268	640	730a2f13a2d69afe03a940276aca880c5a2c29b68d3d2d15e4d517ef69d03ce7.exe	79
PID 2268 wrote to memory of 3368	2268	cmd.exe	81
PID 2268 wrote to memory of 3368	2268	cmd.exe	81
PID 2268 wrote to memory of 3368	2268	cmd.exe	81