QBot/QakBot Malware: How does it work?

Qbot, also known as "QakBot,” is malware originally designed as a banking trojan to steal financial information. Its modular design enables it to transport and install malicious software on computers in a variety of ways. QakBot attacks result in a massive botnet of compromised machines under the adversary's or attackers' control.

Qbot spreads via email with unusual attachments. The email or infected email is usually distributed through phishing, spam, or compromised accounts. This would trick the user into opening the email and downloading the attachments.

I will illustrate some sample cases of how Qbot gets activated, which are as follows:

Case 1: The file is distributed via email and Qbot activates via PowerShell

The initial access begins by sending out the deceiving email, which appears to be a legitimate email. Once the email is opened, the associated disguising file, such as a batch file (.bat), a Windows script file (.wsf), a Javascript file (.jse), or an embedded HTML file (.HTA), will be dropped on the system/host. The scripts, as mentioned earlier, download the DLL file, copy it to the “tmp” folder, and execute using "rundll32.exe.”

Note:

Rundll32.exe is a signed Microsoft binary which is used for the following purposes:

a. Load code to memory

b. Load DLLs in Windows

c. Dump the memory of processes such as LSASS (Local Security Authority Subsystem Service) process to retrieve credentials (Using Mimikatz)

d. Execute scripts such as JavaScript, VBScript

Example infection cases:

Case 1:

• Attachment file via email renames the attachment to a “.bat” file.
• Launches a PowerShell script.
• Drops a “cmd” file in the “tmp” folder.
• Executes the malware.

Case 2:

• Phishing email.
• One note attachment: JSscript: Batch file: Powershell.
• Download & execute the Qbot DLL.
• Javascript files can contain highly obfuscated or encoded code.

Case 3:

• Example content: Download a file from a URL (attachment file) and save it in a “.tmp” file and rundll32.exe executes the DLL file

Case 4:

• Similar to JSE files, there can be “.hta” files.

Note:

Some IP addresses associated with the Qbot can be seen in the article “Identification and Disruption of QakBot Infrastructure.”

Link: *https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-242a*

Qbot techniques with the MITRE Framework:

1. Initial Access: Delivered via email, phishing, spam, zips, et cetera.
2. Execution: Uses Powershell to execute
3. Command & Control: Malware will communicate with an external server via HTTP/HTTPS, NetworkEvents.
4. Persistence: Registry changes can be seen, scheduled tasks, et cetera.

5. Defensive evasion:

• Injecting the anomalous entities into explorer.exe, et cetera.
• Uses rundll32.exe to execute DLLs and gain C2 behaviour.
• Overwriting files, disguising them as gifs instead of *.bat files, etc.

6. Credential access:

• Cookie hijacking, password hijacking from web applications.
• Capturing keystrokes.
• The Brute Force Attempts (BFA) can be observed.

7. Discovery: The use of “net” commands could be seen, such as “net share," “net views,” and "netstats.”

8. Lateral Movement: Exploiting SMB, use of removable drives to spread across networks.

9. Collection: Stealing credentials, emails, for example: “esentutl.exe”.

10. Exfiltration: Sends stolen information to the C2 server.

Prevention and Possible Mitigations:

**Qbot is a two-stage malware attack** where it disguises itself as a legitimate process, downloads the malicious code and then executes. So the possible mitigation can be carried in multiple stages.

1. Initial Access:

• Phishing and social engineering raise awareness among all users.
• ASR rules to block unsigned/unknown DLLs.
• Disable Macros in Microsoft Applications.

2. Lateral Movements:

• Implement strong password policies.
• Zero Trust: Verify the user & verify the device.
• Periodic vulnerability assessments should be carried out and the vulnerabilities patched accordingly.
• Implementation of IDS/IPS, spam filters at the gateways checking SPF, DMARC, and DKIM records, and filtering out all attachments and URLs.

References:

• Qakbot botnet infrastructure shattered after an international operation
• FBI, Partners Dismantle Qakbot Infrastructure in Multinational Cyber Takedown
• Ransomware gang QakBot resurfaces after feds’ botnet takedown
• QakBot Malware: Everything You Need to Know
• Identification and Disruption of QakBot Infrastructure