Priya Nair — Digital Forensics Analyst
Key Takeaways
- QBot employs sophisticated evasion techniques leveraging PowerShell and scheduled tasks for execution and persistence.
- Command and control (C2) infrastructure demonstrated adaptive behavior, utilizing both HTTP and DNS for beaconing.
- Lateral movement was observed leveraging legitimate Windows tools such as WMI to traverse through networks undetected.
Executive Summary
During our investigation of a recent malware campaign, we identified a variant of QBot (also known as Qakbot), a highly prevalent banking Trojan known for its capability to steal sensitive financial information. The actor behind this campaign utilized a multi-faceted approach focusing on initial access via phishing, followed by execution strategies incorporating both PowerShell scripts and scheduled tasks. Our examination revealed a complex C2 structure, leveraging dynamic DNS and HTTP methods to ensure resilient communication channels. Furthermore, the actor exhibited advanced lateral movement techniques, primarily using tools like WMI and PSEXEC, to expand their foothold within victim networks.
Initial Access
The entry point of this attack was traced back to a targeted phishing email containing a malicious attachment, posing as an invoice. Once the victim opened the document and enabled macros, a Visual Basic for Applications (VBA) script executed, initiating the first stage of the infection. This script, while seemingly benign, extracted and executed a PowerShell command that initiated the download of the QBot binary from a remote server. Our analysis indicated that the initial payload was disguised as a legitimate-looking executable named Invoice.exe.
Execution & Persistence
Upon execution, the QBot binary employed a series of tactics to ensure persistence on the infected host. The malware utilized Windows Task Scheduler to create a scheduled task that executed the payload repeatedly, even after system reboots. The task was registered within C:\Windows\System32\Tasks\QBotTask and configured to trigger on user logon. Furthermore, the malware injected itself into the Windows Explorer process, allowing it to run without raising red flags in system monitoring tools. This evasion tactic is particularly effective against static detection methods.
Command and Control
The C2 infrastructure utilized by QBot demonstrated adaptive behavior in its communication patterns. Our analysis revealed the malware using both HTTP and DNS protocols for beaconing, with the first communication directed towards a dynamic IP service that obfuscated the actual C2 hostname. The malware frequently attempted to connect to domains such as example-malicious.com, which were associated with the actor’s infrastructure. During our analysis, we observed the infected hosts beaconing at intervals of approximately 60 seconds, characteristic of a command waiting phase where the actor would send operational commands or additional payloads.
Lateral Movement & Discovery
Once QBot had established itself within the network, it employed several techniques for lateral movement. Notably, the use of Windows Management Instrumentation (WMI) calls allowed the actor to enumerate other devices on the network seamlessly. The executable also incorporated functionality to use PSEXEC, which facilitates running commands on remote systems. The malware was capable of credential collection via Credential Dumping (T1003) techniques, enabling the actor to escalate privileges and gain access to sensitive systems, closely aligning with the goals of lateral movement in an enterprise environment.
Impact & Objectives
The primary objective of this campaign appeared to be the theft of financial credentials, along with the installation of secondary payloads for broader impact. Once the actor established persistence and lateral control, we observed the preparation for data exfiltration that included email account compromises and potential siphoning of sensitive data across the network. This poses significant risks, particularly to organizations within the finance sector, as the data can be leveraged for further attacks or sold on dark web forums. Additionally, the agility of QBot’s code and its ability to facilitate secondary payloads exacerbate the threat landscape, making it a viable tool for cybercriminals.
MITRE ATT&CK Mapping
- T1203 – Exploitation for Client Execution: The exploitation of the vulnerability within the document to execute the initial payload.
- T1059.001 – Command and Scripting Interpreter: PowerShell: Utilized for executing scripts and commands fetched from remote C2 servers.
- T1077 – Windows Admin Shares: Allowed lateral movement and data collection across networked devices.
Detection Opportunities
- Implement monitoring of scheduled tasks, focusing on those configured for user logon as a potential vector for persistence.
- Analyze HTTP and DNS traffic for unusual patterns, particularly connections to newly resolved domains with a history of malicious activity.
- Employ heuristics to detect anomalous PowerShell command execution, especially for commands attempting to download executables from external sources.
Analyst Notes
This investigation underscores the necessity for constant vigilance and an adaptive security posture. Organizations should prioritize the implementation of robust email filtering solutions combined with user training to recognize and report phishing attempts. Additionally, endpoint detection and response (EDR) solutions should be configured to watch for behaviors associated with QBot, such as irregular PowerShell execution and unauthorized access attempts using tools like WMI and PSEXEC. The dynamic nature of this malware indicates that its threat will evolve, and our defensive measures must evolve correspondingly.
Source: Original Report