Sarah Chen — Malware Reverse Engineer
Key Takeaways
- QBot malware exhibits advanced evasion techniques alongside network propagation capabilities.
- Initial access was likely achieved through a sophisticated phishing campaign employing credential harvesting.
- Implementing holistic detection strategies can significantly mitigate risks associated with QBot infections.
Executive Summary
During our investigation into a recent QBot malware infection, we observed a series of tactics employed by the actors that resulted in compromised credentials and subsequent network infiltration. QBot, a well-known information-stealer and banking trojan, has evolved to include functionality that facilitates lateral movement. This analysis outlines the attack chain from initial access through to the intended objectives, with a focus on indicator identification and responses.
Initial Access
Our analysis revealed that the initial access vector was a phishing email that contained a malicious attachment styled as an invoice. The attachment was a bypassed Microsoft Office document that required macros to be enabled. The user, unaware of the risks, enabled macros, triggering a download of QBot’s dropper payload from a command-and-control (C2) server. The payload was hosted on a dynamically registered domain that had a brief lifespan to evade detection, consistent with TTPs known to be employed by sophisticated threat actors.
Execution & Persistence
Following execution, the dropper executed a PowerShell command to install the QBot implant silently. The implant utilized the T1059.001 – PowerShell technique to facilitate operations and set itself to persist across reboots. Persistence was achieved through the creation of a registry key at HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run with the value of the executable path, ensuring re-infection upon restart.
Command and Control
Command-and-control methods employed by QBot that we analyzed indicate the use of a list of hardcoded domains. In the sample we examined, the actor utilized DNS over HTTPS (DoH) to obfuscate traffic, making detection more challenging. This was in addition to regularly rotating domains used for C2 traffic to prevent blocking. We identified base64-encoded commands sent from the malware to the C2 server, revealing its capability to receive additional commands and payload updates, which corresponds with the T1071.001 – Application Layer Protocol: Web Protocols within the MITRE ATT&CK framework.
Lateral Movement & Discovery
Upon establishing the foothold, lateral movement techniques came into play, particularly the utilization of T1021.002 – SMB/Windows Admin Shares. The implant was observed attempting to access shared drives in the environment. Passwords harvested during the initial compromise were leveraged to authenticate against administrative shares. The actor executed commands to enumerate local user accounts and running processes, demonstrating reconnaissance activities typical of follow-on access attempts.
Impact & Objectives
The primary objectives of the threat actor appeared twofold: to harvest sensitive information and facilitate further network infiltration, likely for ransomware deployment. The implant exhibited behaviors typical of information theft, including capturing keystrokes and exfiltrating sensitive data. Exfiltration commonly utilized HTTP POST requests to the previously established C2 infrastructure. Our investigation concluded with an assessment that entities compromised by QBot are at increased risk for subsequent attacks, specifically targeting financial and personal data.
MITRE ATT&CK Mapping
- T1193 – Spear Phishing Attachment: initial access achieved through malicious document.
- T1059.001 – PowerShell: used for executing commands and installing implants.
- T1071.001 – Application Layer Protocol: Web Protocols: command and control traffic conducted over HTTPS.
- T1021.002 – SMB/Windows Admin Shares: lateral movement by accessing shared drives.
Detection Opportunities
- Monitor for unusual PowerShell activity, especially with encoded commands.
- Set up alerts for modifications to the
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Runregistry path. - Implement DNS monitoring to identify unusual domain resolutions that lack historical context.
Analyst Notes
Our investigation into the QBot campaign underscored the necessity of robust user training and advanced endpoint detection strategies. Given the evolving nature of QBot’s tactics, continuous monitoring and updating detection rules are imperative. Threat actors are undoubtedly shifting their techniques in response to improvements in defense technologies, making proactive hunting and defense-in-depth approaches vital to mitigate the risks posed by such malware.
Source: Original Report