QakBot

The basic flow is as follows: An attacker sends a phishing email containing a .one file attachment.

MITRE ATT&CK Mapping | Initial Access | T1566.001 | Spearphishing attachment, the HTML file

QAKBOT is typically distributed via phishing emails containing malicious links or attachments.

An example of this method is when Black Basta ransomware gang, on November 2022 were using QakBot loader (by hijacking legitimate email threads and sending phishing emails) to create an initial point of entry.

In the Qakbot DLL shown below, CoInitializeSecurity is called before the sample references IID_IWbemLocator, and CoCreateInstance creates an instance of the WMI locator class... the method of interest is ConnectServer.

Qakbot obtains a persistent foothold in the victim environment by setting a scheduled task which references a malicious PowerShell stored in the registry, acting as a listener and loader.

The LNK file target property is interesting: C:\Windows\System32\cmd.exe /c IncomingPay\Issues.cmd

Qakbot obtains a persistent foothold in the victim environment by setting a scheduled task which references a malicious PowerShell stored in the registry... The powershell.exe process continues to communicate with different servers...

The second stage of Qbot is known to contain its further payload in its resource section, and also contain RC4 encryption and BLZPack decompression.

After mounting the drive, the user sees a shortcut that they believe will take them to the resource they are trying to find. But the shortcut actually calls a command or scripting interpreter that executes other malicious files that are hidden on the disk drive.

One of the interesting initial access vectors we observed was an ISO dropper shipped as “Report Jul 14 39337.iso” that exploits a DLL hijacking in calc.exe... triggering the DLL hijacking inside the calc binary and executing a Qakbot DLL, WindowsCodecs.dll.

Qakbot obtains a persistent foothold in the victim environment by setting a scheduled task which references a malicious PowerShell stored in the registry, acting as a listener and loader.

During the 2016 Ukraine Electric Power Attack, Sandworm Team used an arbitrary system service to load at system boot for persistence for Industroyer. They also replaced the ImagePath registry value of a Windows service with a new backdoor binary.

Qakbot obtains a persistent foothold in the victim environment by setting a scheduled task which references a malicious PowerShell stored in the registry, acting as a listener and loader.

When an operator connects to the backdoor... a new explorer.exe process is created and a process hollowing is performed to hide malicious activity behind the legitimate process.

When an operator connects to the backdoor... a new explorer.exe process is created and a process hollowing is performed to hide malicious activity behind the legitimate process.

During the 2016 Ukraine Electric Power Attack, Sandworm Team used an arbitrary system service to load at system boot for persistence for Industroyer. They also replaced the ImagePath registry value of a Windows service with a new backdoor binary.

It uses password protected zip files to block sandboxing analysis.

In malware, we often see threat actors that tend to obfuscate or encrypt their code in order to slow down the analysis of security researchers... many authors tend to use open-source packers but also craft their own custom packers.

This technique is called Stack-Strings and will appear several times during the Qbot unpacking process.

MITRE ATT&CK Mapping | Defense Evasion | T1027.006 | HTML smuggling, payload assembled client-side

These instructions assign the HEX value “47 65 74 50 72 6f 63 41 64 64 72 65 73 73” to the ECX register... This technique is called Stack-Strings... Then, the GetProcAddress string being used by another function.

When an operator connects to the backdoor... a new explorer.exe process is created and a process hollowing is performed to hide malicious activity behind the legitimate process.

When an operator connects to the backdoor... a new explorer.exe process is created and a process hollowing is performed to hide malicious activity behind the legitimate process.

At first glance, it seems this loop has characteristics we expect from traditional decryption\encryption routines, such as shr (shift right), xor , and rol (rotate left) opcodes... The loop changes the first bytes of the obfuscated content to “M8Z”, which starts to resemble the classic “MZ” string.

When I hit the eighth sample, however, the fourth rule in the chain did not fire, because the .lnk file called RunDLL32.exe directly, instead of cmd.exe or wscript.exe.

It uses a disk image format called an .iso file to evade the Mark-of-the-Web protection.

Agent Tesla has created hidden folders. AppleJeus has added a leading . to plist filenames, unlisting them from the Finder app and default Terminal directory listings. APT28 has saved files with hidden file attributes. FIN13 has created hidden files and folders within a compromised Linux system /tmp directory and also used attrib.exe to hide gathered local host information.

One of the interesting initial access vectors we observed was an ISO dropper shipped as “Report Jul 14 39337.iso” that exploits a DLL hijacking in calc.exe... triggering the DLL hijacking inside the calc binary and executing a Qakbot DLL, WindowsCodecs.dll.

Calling GetProcAddress... request VirtualAlloc... VirtualAlloc being called with Read-Write-Execute permissions.

The content repeatedly describes malware and threat actors using commands and APIs such as ipconfig /all, ifconfig, arp -a, route print, nbtstat, netsh, GetAdaptersInfo, and GetIpNetTable to gather IP addresses, MAC addresses, DNS, DHCP, gateways, routing tables, ARP cache, proxy settings, domains, and network adapter/interface details.

The content repeatedly describes malware and threat actors collecting usernames, identifying logged-in users, running whoami/query user/quser, checking whether the current user is an administrator, enumerating user sessions, and gathering account details from compromised hosts.

The content repeatedly describes malware and threat actors listing files and directories, enumerating drives, searching for files by extension/name/path, retrieving file metadata, and browsing file systems (for example: "APT28 has used Forfiles to locate PDF, Excel, and Word documents during collection" and "cmd can be used to find files and directories with native functionality such as dir commands").

In this blog, I will explain my hunting methodology with two practical examples... this methodology (JARM and HTTP Response hash) is applicable to both examples and provides great results.

OilRig has used a compromised Domain Controller to create a service on a remote host.

We reported on this previously, noting that some criminals were turning to other filetypes instead, like archive and container formats – and, more recently, OneNote files.

Hunting QBot C2 and Brute Ratel C4 Infrastructure

The content repeatedly describes threat actors and malware using HTTP and HTTPS for command and control, such as: "Sandworm Team used BlackEnergy to communicate between compromised hosts and their command-and-control servers via HTTP post requests."

TA551 is a threat actor tracked by Proofpoint since 2016. This actor frequently leverages thread hijacking to distribute malicious Office documents via email.