Full Report
We're seeing a rise in Qakbot activity. Here's what you need to know to keep your environments safe.
Analysis Summary
# Tool/Technique: Qakbot (aka Qbot)
## Overview
Qakbot is a sophisticated, modular banking trojan that has evolved into a versatile botnet and a primary delivery agent for various ransomware strains. It is known for its continuous development, multi-stage execution, and ability to evade traditional antivirus solutions through process injection and legitimate living-off-the-land binaries.
## Technical Details
- **Type:** Malware family (Modular Trojan/Botnet)
- **Platform:** Windows
- **Capabilities:** Information theft, modular plugin loading, persistence, process injection, and delivery of secondary payloads (e.g., ransomware).
- **First Seen:** Approximately 2007 (Article focuses on late 2022 activity spike).
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.001 - Phishing: Spearphishing Attachment]
- **[TA0002 - Execution]**
- [T1204.002 - User Execution: Malicious File]
- [T1218.010 - System Binary Proxy Execution: Regsvr32]
- [T1218.011 - System Binary Proxy Execution: Rundll32]
- **[TA0003 - Persistence]**
- [T1547 - Boot or Logon Autostart Execution]
- **[TA0005 - Defense Evasion]**
- [T1574.002 - Hijack Execution Flow: DLL Side-Loading]
- [T1055 - Process Injection]
- [T1553.005 - Subvert Trust Controls: Mark-of-the-Web Bypass] (via ISO/VHD mounting)
- **[TA0007 - Discovery]**
- [T1082 - System Information Discovery]
- [T1016 - System Network Configuration Discovery]
## Functionality
### Core Capabilities
- **Modular Architecture:** Can be configured with various modules depending on the attacker's goals.
- **Email-Based Propagation:** Uses HTML attachments to drop password-protected or standard ZIP files.
- **ISO/VHD Mounting:** Uses disk image files to bypass "Mark-of-the-Web" security features and hide malicious components.
- **Living-off-the-Land:** Utilizes `regsvr32.exe`, `rundll32.exe`, and `cmd.exe` to execute its malicious DLLs.
### Advanced Features
- **DLL Side-Loading:** Exploits legitimate applications (e.g., `calc.exe`, `control.exe`) to load malicious DLLs (e.g., `edputil.dll`) to evade detection.
- **Process Injection:** Frequently targets `wermgr.exe` (Windows Error Reporting Manager) to hide its active code in memory.
- **Encrypted Command Lists:** Contains an embedded list of discovery and enumeration commands that are decrypted at runtime to profile the victim's environment.
## Indicators of Compromise
- **File Names:** `*.zip` (in Downloads folder), `.iso`, `.vhd`, `.lnk`, `edputil.dll`, `msoffice.dll`.
- **Registry Keys:** Changes related to ISO/VHD mounting restrictions (if mitigated).
- **Network Indicators:** C2 communication via various non-standard ports (Note: specific IPs/domains not listed in text, but generally involves a rotating set of compromised hosts).
- **Behavioral Indicators:**
- `control.exe` or `calc.exe` spawning `regsvr32.exe`.
- Unexpected mounting of ISO files from the `Downloads` directory.
- Unusual activity involving `wermgr.exe`.
- Execution of discovery commands (`whoami`, `net view`, etc.) immediately after a suspicious file execution.
## Associated Threat Actors
- Historically used by various cybercriminal groups; often serves as a precursor to ransomware attacks by groups like **Conti** or **REvil** (though specific group names for the 2022 spike are not explicitly named in this summary).
## Detection Methods
- **Behavioral Detection:** Monitoring for the "unraveling" phase—processes mounting disk images followed by `regsvr32.exe` execution.
- **EDR/MDR:** Using managed detection to identify process injection into `wermgr.exe`.
- **Memory Analysis:** Using tools like "Dumpulator" to extract decrypted command strings from memory.
## Mitigation Strategies
- **Registry Hardening:** Disable the ability to mount ISO/VHD files via the registry if not required for business operations.
- **Email Filtering:** Implement aggressive filtering for HTML and ZIP attachments.
- **User Education:** Train staff to recognize phishing attempts involving ZIP and ISO files.
- **Attack Surface Reduction:** Limit the use of administrative tools and script interpreters by non-admin users.
## Related Tools/Techniques
- **Emotet:** Often seen in similar distribution patterns and used for payload delivery.
- **DLL Side-Loading:** A technique common to many advanced threats to bypass NGAV.
- **IcedID:** Another banking trojan turned loader with similar modular characteristics.