# Qbot Likes to Move It, Move It **[thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/](https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/)** February 7, 2022 ### Qbot (aka QakBot, Quakbot, Pinkslipbot ) has been around for a long time having first been observed back in 2007. More info on Qbot can be found at the following links: Microsoft & Red Canary In this case, from October 2021, we will break down how Qbot quickly spread across all workstations in an environment, while stealing browser information and emails. While the case is nearly 5 months old, Qbot infections in the past week have followed the same pattern. ## Case Summary ### We did not observe the initial access for this case but assess with medium to high confidence that a malicious email campaign was used to deliver an Excel (xls) document. Following the opening of the xls document, the initial Qbot DLL loader was downloaded and saved to disk. Interestingly, the name of the DLL contained a .html extension to disguise the portable executable nature of the payload. Once executed, the Qbot process creates a scheduled task to elevate itself to system. ----- ### Qbot injected into many processes but one favorite in this intrusion, was Microsoft Remote Assistance (msra.exe). Within minutes of landing on the beachhead, a series of discovery commands were executed using Microsoft utilities. Around the same time, LSASS was access by Qbot to collect credentials from memory. Thirty minutes after initial access, Qbot was observed collecting data from the beachhead host including browser data and emails from Outlook. At around 50 minutes into the infection, the beachhead host copied a Qbot dll to an adjacent workstation, which was then executed by remotely creating a service. Minutes later, the beachhead host did the same thing to another adjacent workstation and then another, and before we knew it, all workstations in the environment were compromised. Qbot followed it’s normal process on each machine. Servers were not accessed in this intrusion. After this activity, normal beaconing occurred but no further actions on objectives were seen. ## Services ### We offer multiple services including a Threat Feed service which tracks Command and Control frameworks such as Qbot, Cobalt Strike, BazarLoader, Covenant, Metasploit, Empire, PoshC2, etc. More information on this service and others can be found here. We also have artifacts and IOCs available from this case such as memory captures, files, event logs including Sysmon, Kape packages, and more, under our Security Researcher and Organization services. ## Timeline ----- ### Analysis and reporting completed by @iiamaleks Reviewed by and @MetallicHack & @tas_kmanager ## MITRE ATT&CK Initial Access ----- ### We assess with medium to high confidence that the QBot infection was delivered to the system via a malspam campaign through a hidden 4.0 Macro’s in Excel. We believe this is the xls file that lead to the Qbot infection, due to the overlap in time period, download url, and file name. ## Execution ### The QBot dll was executed on the system and shortly after, injected into the msra.exe process. ## Privilege Escalation ### A scheduled task was created by Qbot to escalate to SYSTEM privileges. This scheduled task was created by the msra.exe process, to be run only once, a few minutes after its creation. ----- ``` "schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn juqpxmakfk /tr "regsvr32.exe -s \"C:\Users\REDACTED\ocrafh.html\"" /SC ONCE /Z /ST 14:20 /ET 14:32 ## Defense Evasion ### QBot was observed injecting into msra.exe process on multiple systems. Multiple folders were added to the Windows Defender Exclusions list in order to prevent the Qbot dll placed inside of it from being detected. The newly dropped dll was then executed and process injected into msra.exe. Qbot used reg.exe to add Defender folder exceptions for folders within AppData and ProgramData. C:\Windows\system32\reg.exe ADD \"HKLM\SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Paths\" /f /t REG_DWORD /v \"C:\ProgramData\Microsoft\Oweboiqnb\" /d \"0\" C:\Windows\system32\reg.exe ADD \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /f /t REG_DWORD /v \"C:\ProgramData\Microsoft\Oweboiqnb\" /d \"0\" dll files dropped by Qbot, were deleted after injection into msra.exe. ## Credential Access ### LSASS was accessed by Qbot, with the intention of accessing credentials. This can be observed through the Sysmon process access event, indicating the GrantedAccess value of 0x1410 . ``` ----- ### Additional evidence of LSASS access was visible in API calls from Qbot injected processes to LSASS. ## Discovery ### The following discovery commands where observed coming from the Qbot processes. These commands where executed on the beachhead system along with other workstations compromised through lateral movement. ``` whoami /all arp -a cmd /c set arp -a net view /all ipconfig /all net view /all nslookup -querytype=ALL -timeout=10 _ldap._tcp.dc._msdcs.REDACTED route print net share net1 localgroup net localgroup netstat -nao ## Lateral Movement ``` ----- ### Qbot moved laterally to all workstations in the environment by copying a dll to the machine and then remotely creating a service to execute the Qbot dll. The services created had the DeleteFlag set causing the service to be removed upon reboot. The following occurred on each workstation: ----- ### The lateral movement activity from the beachhead host was rapid and connections were seen across all workstations in the network. A view from the memory of the beachhead host shows the injected msra process connecting to hosts across the network. ----- ### The service creations were also observed via event id 7045 across all hosts. ## Collection ### Qbot is widely known to steal emails with the intention of collecting information and performing email thread hijacking. Email data will be collected and stored in 1 of 2 locations. ``` C:\Users\Username\EmailStorage_ComputerHostname-Username_TimeStamp C:\Windows\system32\config\systemprofile\EmailStorage_ComputerHostnameUsername_TimeStamp Once exfiltrated from the system this folder is then deleted as seen below cmd.exe /c rmdir /S /Q "C:\Users\REDACTED\EmailStorage_REDACTED-REDACTED_REDACTED" cmd.exe /c rmdir /S /Q "C:\Windows\system32\config\systemprofile\EmailStorage_REDACTED-REDACTED_REDACTED" ``` ----- ### Collection of browser data from Internet Explorer and Microsoft Edge was also observed with Qbot using the built-in utility esentutl.exe. ``` esentutl.exe /r V01 /l"C:\Users\REDACTED\AppData\Local\Microsoft\Windows\WebCache" /s"C:\Users\REDACTED\AppData\Local\Microsoft\Windows\WebCache" /d"C:\Users\REDACTED\AppData\Local\Microsoft\Windows\WebCache" ## Command and Control ### Qbot uses a tiered infrastructure, often using other compromised systems as first tier proxy points for establishing a constantly changing list of C2 endpoints. You can review a in-depth analysis of the modules of this malware in this Checkpoint report. With this type of setup the list of C2 from October 2021, has in large rotated out of use. To keep up to date on current Qbot C2 endpoints you can check out our Threat Feed & All Intel service as we track these changing lists daily. Qbot does use SSL in it’s C2 communication but does not rely soley on port 443 for communication, in the case investigated here the following ports were found in the extracted C2 configuration. Count Port 88 443 25 995 17 2222 3 2078 2 465 2 20 1 993 1 61201 1 50010 1 32100 1 21 1 1194 ``` ----- ### Qbot uses SSL and while the domains do not resolve, they follow a pattern and are detectable with several Suricata ETPRO signatures. Qbot JA3/S: ``` JA3: 72a589da586844d7f0818ce684948eea, c35a61411ee5bdf666b4d64b05c29e64 JA3s: 7c02dbae662670040c7af9bd15fb7e2f ## Impact ### The final actions of the threat actor were not observed, however, the data exfiltrated from the network could be used to conduct further attacks or sold to 3rd parties. ## IOCs ``` Network ----- ``` 120.150.218.241:995 71.74.12.34:443 24.229.150.54:995 185.250.148.74:443 136.232.34.70:443 82.77.137.101:995 75.188.35.168:443 72.252.201.69:443 109.12.111.14:443 68.204.7.158:443 196.218.227.241:995 27.223.92.142:995 76.25.142.196:443 73.151.236.31:443 185.250.148.74:2222 173.21.10.71:2222 189.210.115.207:443 105.198.236.99:443 47.22.148.6:443 24.55.112.61:443 24.139.72.117:443 45.46.53.140:2222 92.59.35.196:2222 95.77.223.148:443 68.186.192.69:443 89.101.97.139:443 173.25.166.81:443 140.82.49.12:443 ``` File ----- ``` ocrafh.html.dll 2897721785645ad5b2a8fb524ed650c0 d836fa75f0682b4c393418231aefca97169d551e 956ecb4afa437eafe56f958b34b6a78303ad626baee004715dc6634b7546bf85 qbbwlwjmlmnaggd.dll e0fafe1b4eb787444ed457dbf05895a4 16b5b1494e211b74e97d9f35ff5a994f70411f2e 9f6e3b0b18f994950b40076d1386b4da4ce0f1f973b129b32b363aac4a678631 hyietnrfrx.uit b6ed9b2819915c2b57d4c58e37c08ba4 e9ff9b7e144bdad9d8955f4a328f7b6daa2b455e 70a49561f39bb362a2ef79db15e326812912c17d6e6eb38ef40343a95409a19a znmxbx.evj 2a8cf6154e6a129ffd07a501bbc0b098 304d8e812a8d988e21af8a865d8dd577dc6f3134 e510566244a899d6a427c1648e680a2310c170a5f25aff53b15d8de52ca11767 zsokarzi.xpq 43660d21bfa1431e0ee3426cd12ddf38 5d3b7e0c05e65aa0dfc8b5e48142d782352e36be cbfc135bff84d63c4a0ccb5102cfa17d8c9bf297079f3b2f1371dafcbefea77c tuawktso.vbe ad413cd422c1a0355163618683e936a0 5fca07dfc68a13b3707636440d5c416e56149357 1411250eb56c55e274fbcf0741bbd3b5c917167d153779c7d8041ab2627ef95f jtrbde.dll 5dd964c8d9025224eb658f96034babea 6c526a28ed49b2ef83548e20a71610877e69d450 3d913a4ba5c4f7810ec6b418d7a07b6207b60e740dde8aed3e2df9ddf1caab27 rzmulxiilw.dll 000df43b256cdc27bb22870919bb1dfa f94d5bf14dee6a6e8db957d49c259082dd82350b ca564c6702d5e653ed8421349f4d37795d944793a3dbd1bb3c5dbc5732f1b798 ljncxcwmsg.gjf 88834d17d2cdce884a73e38638a4e0dd b5b264d00a7d6d6b3dd4965dbe2bd00e0823ba6c c789bb45cacf0de1720e707f9edd73b4ed0edc958b3ce2d8f0ad5d4a7596923a ## Detections ``` Network ``` ETPRO TROJAN Observed Qbot Style SSL Certificate ETPRO TROJAN Possible Qbot SSL Cert ET POLICY PE EXE or DLL Windows file download HTTP ``` Sigma ----- ``` title: QBot process creation from scheduled task REGSVR32 (regsvr32.exe), s flag and SYSTEM in the command line id: 33d9c3f4-57a6-4ddb-a2a0-b2ccf8482607 status: test description: Detects the process creation from Scheduled Task with REGSVR32 (regsvr32.exe), -s flag and SYSTEM in the command line author: tas_kmanager, TheDFIRReport references:https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/ date: 2022/02/06 modified: 2022/02/06 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - 'schtasks.exe' - 'regsvr32.exe -s' - 'SYSTEM' condition: selection falsepositives: - unknown level: high tags: - attack.persistence - attack.privilege_escalation - attack.t1053.005 - qbot ``` ----- ``` title: QBot scheduled task REGSVR32 and C$ image path id: 014da553-5727-4e47-9544-56da83b3eb6f description: Detects the creation of Scheduled Task with REGSVR32 (regsvr32.exe) and C$ in the image path field status: test author: tas_kmanager, TheDFIRReport references:https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/ date: 2022/02/06 modified: 2022/02/06 logsource: product: windows service: system detection: selection: Provider_Name: 'Service Control Manager' EventID: 7045 ImagePath|contains|all: - 'regsvr32.exe' - 'C$' condition: selection level: high falsepositives: - low tags: - attack.persistence - attack.privilege_escalation - attack.t1053.005 - qbot title: EmailStorage file deletion - QBot id: 695e7200-c733-44b3-9231-6d3459c668ba status: test description: Detect EmailStorage file deletion after QBot infection author: tas_kmanager, TheDFIRReport references:https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/ date: 2022/02/06 modified: 2022/02/06 logsource: category: process_creation product: windows detection: selection: ParentCommandLine|contains: - '\EmailStorage_' - 'rmdir' Image|endswith: '\cmd.exe' condition: selection falsepositives: - low level: high tags: - attack.defense_evasion - attack.t1070.004 - qbot ``` ----- Yara ----- ``` / YARA Rule Set Author: The DFIR Report Date: 2022-02-07 Identifier: Case 7685 Reference: https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/ */ /* Rule Set ----------------------------------------------------------------- */ import "pe" rule tuawktso_7685 { meta: description = "Files - file tuawktso.vbe" author = "The DFIR Report" reference = "https://thedfirreport.com" date = "2022-02-01" hash1 = "1411250eb56c55e274fbcf0741bbd3b5c917167d153779c7d8041ab2627ef95f" strings: $s1 = "* mP_5z" fullword ascii $s2 = "44:HD:\\C" fullword ascii $s3 = "zoT.tid" fullword ascii $s4 = "dwmcoM<" fullword ascii $s5 = "1iHBuSER:" fullword ascii $s6 = "78NLog.j" fullword ascii $s7 = "-FtP4p" fullword ascii $s8 = "x