Morphisec Labs has tracked a massive maldoc campaign delivering the QakBot/QBot banking trojan, starting earlier this month. Qakbot leverages advanced techniques to evade detection and hamper manual analysis of the threat. In this post we will mention two of those interesting techniques.
QakBot attacks typically include a malicious attachment to a phishing email. Often these are bare Microsoft Word documents attached to the spam email. This particular campaign features a ZIP file; within the ZIP attachment is a Word document that includes macros within the document. These macros execute a PowerShell script that then downloads the Qakbot payload from specific URLs.
This particular QakBot campaign also includes two new techniques: a bypass of the content disarm and reconstruction (CDR) technology through zipping the Word document, and a bypass of child-parent pattern detection because Visual Basic is executed using Explorer.
The first step in the attack chain is a phishing email sent with a ZIP file attached. As in classic phishing attacks, the email is designed to encourage the target to click on the file and download it. Though phishing through ZIP is very popular today and you would expect to find executable in the zip, in this case it was just a simple word phishing document. The question then is why would an attacker send a document through zip and not directly? The reason is that many content disarm and reconstruction (CDR) systems will strip a document delivered as an attachment from all the malicious artifacts. Sending a Word document in a ZIP file, as the attacker does here, is a perfect way to bypass CDR systems.
Figure 1: An example of the phishing email the target receives
The ZIP file contains a Microsoft Word document. The attackers use a common tactic to lure the victim to enable macros: when the target downloads the file, it asks for the target to enable editing and then enable content in order to view the document.
Figure 2: The maldoc asks for the target to enable editing and to enable content
When we looked at the macros, we noticed two automatically triggered functions: AutoOpen and AutoClose. As the names suggest, these two functions activate when the document is opened and when the document is closed.
Figure 3: The AutoOpen and AutoClose triggered functions
The AutoOpen function creates a decoy VBS file filled with some spaces in the ProgramData directory, then triggers the AutoClose function by executing the command Application.Quit.
When triggered, the AutoClose function dumps all of the form caption into another VBS file in ProgramData, which is then executed using the WScript.Shell Exec method with the command "explorer.exe C:\ProgramData\Portes.vbs" that is stored in the DefaultTargetFrame property. Executing through explorer.exe is simple but still very unique and will break many of the existing pattern recognition capabilities of different EDR products. This may reduce the score of the attack just enough to stay under the radar.
Figure 4: WScript.Shell
When the script is executed, it dumps a couple of commands to a separate batch script and executes it. The batch script kills the WINWORD.exe process, and then runs a PowerShell command that iterates over several URLs. If active, it will download and execute the payload, which is QakBot(QBot). Last, the batch script deletes all of the artifacts from the infected machine.
Morphisec identified an increase in QakBot/QBot delivery during the last several months. EDRs / AVs have a hard time detecting distributed behaviour in which not a single process does something malicious but all the processes combined act in a malicious way. We identified a similar execution in the delivery of other malwares such as Emotet, Tesla and more.
A proactive, prevention-first approach to cybersecurity is key to protecting your enterprise against these evasive threats. This approach includes hardening your environment or deploying advanced preventive technology in your enterprise. The moving target defense technology that underpins Morphisec Shield and Morphisec Guard immunizes your enterprise and protects you against advanced evasive threats such as QakBot.
IOCs(SHA-1):
Docs:
Qakbot(QBot):
URLs: