Cyble researchers report Qakbot’s evolving delivery using OneNote attachments that drop CHM files, which load a PowerShell script to download and execute a DLL via rundll32. This method—along with embedded ISO content and hardcoded URLs—helps Qakbot evade detection and install additional malware such as Cobalt Strike or Brute Ratel. #Qakbot #OneNote #CHM #PowerShell #Rundll32
Keypoints
- Qakbot is increasingly delivered via OneNote attachments in spam campaigns, including CHM-containing pages.
- The OneNote attachment leads to an embedded CHM that triggers a PowerShell script for payload delivery.
- A PowerShell script downloads a DLL named PenochiAcestes.embryon from hardcoded URLs using wget.
- The downloaded DLL is executed via rundll32.exe, with the PowerShell command configured to run in hidden mode.
- The malware family can steal credentials and install other tools (e.g., Cobalt Strike, Brute Ratel) for additional attacks.
- Campaigns often reuse hijacked email threads to appear legitimate, enhancing infection likelihood.
MITRE Techniques
- [T1566] Phishing – “Qakbot is known to use spam email campaigns to distribute itself, and it often uses hijacked email threads to make its messages appear convincing and legitimate. The figure below shows the spam email with the subject line “Re: ordine cartelle portaprogetti” and a OneNote attachment named “Nobis.one”.”
- [T1059.001] PowerShell – “The PowerShell script is responsible for downloading a DLL containing the Qakbot malware, which is executed using rundll32.exe.”
- [T1218.011] Rundll32 – “executed using rundll32.exe.”
- [T1140] Deobfuscate/Decode Files or Information – “base64 encoded PowerShell content.”
- [T1564.001] Hide Artifacts: Hidden Window – “powershell – WindowStyle Hidden – ExecutionPolicy Bypass – NoLogo – NoProfile – encodedcommand …”
- [T1055] Process Injection – “The PowerShell command to run the downloaded dll file is: powershell – WindowStyle Hidden – ExecutionPolicy Bypass – NoLogo – NoProfile – encodedcommand “start rundll32 $env:TEMPPenochiAcestes.embryon,Motd;”
- [T1071] Application Layer Protocol – “Application Layer Protocol” (C2 channel described in MITRE techniques).
Indicators of Compromise
- [Hash] .eml file – ee4abe2bfbb1e212a52a42933c6f0a4361f3e146e9180f07753012da38762253, 58b54ac8687169e4f92da3446b433adc39af5820, and 1 more hashes
- [Hash] .one file – e030ea871e4ef05f0b9a75f8fc2ef4a1a90a42f46f5ec5f9a7ec199bd49e1e47, 4232915f680e8aeaf3a83c08f8f9fd38d00647e2, and 1 more hashes
- [Hash] .chm file – 2598dd1019aee192c357567e92f9b45622ad789e60f20ed3df26d32952b3a1ef, cb0679e56e658d8b177e2170222d08ba827ef0d8, and 1 more hashes
- [Hash] .one file – 2ec633b615864d6a8fc7fd7f1c906f1b6538af5719d671f8459d4a5627be6fa7, b98738b6e0051b4fd730596b4d2dfe2a678b0a2b, and 1 more hashes
Read more: https://blog.cyble.com/2023/04/21/qakbot-malware-continues-to-morph/