Hibernating Qakbot: A Comprehensive Study and In-depth Campaign Analysis

MITRE Techniques

• [T1566] Phishing – Initial delivery via malspam emails that host malicious PDF/HTML/OneNote/ZIP attachments (‘MalSpam -> PDF/HTML/OneNote/ZIP’).
• [T1204] User Execution – Victims are tricked into running downloaded files (JS/WSF/XLL/MSI); article notes files named like ‘Invoice’ to ‘deceive users into executing the file’ (‘deceive users into executing the file’).
• [T1059] Command and Scripting Interpreter – Attackers use obfuscated JS and PowerShell to execute download and payload stages (‘executing a Powershell command’).
• [T1047] Windows Management Instrumentation – Listed as used in execution tactics within the campaign analysis (‘Windows Management Instrumentation’).
• [T1053.005] Scheduled Task – Persistence via scheduled tasks set to run the Qakbot payload periodically (‘scheduled tasks to execute the Qakbot payload every 10 minutes’).
• [T1547.001] Registry Run Keys / Startup Folder – Qakbot creates registry keys to store encoded PowerShell commands and enable execution (‘creates a registry key and adds the base64 encoded Powershell command into the registry key using the reg.exe command line tool’).
• [T1027] Obfuscated Files or Information – Multiple stages are obfuscated (JS, WSF, hex/base64 encoding) to hide behavior (‘obfuscated JS file’, ‘hex-encoded XMLHTTP request’).
• [T1070.004] File Deletion – MSI contained a self-deletion PowerShell script to erase traces after execution (‘a self-deletion PowerShell script was incorporated’).
• [T1112] Modify Registry – Malware writes encoded commands and persistence data into registry entries (‘adds the base64 encoded Powershell command into the registry key’).
• [T1202] Indirect Command Execution – Qakbot uses conhost.exe as a proxy to execute commands indirectly (‘conhost.exe as a proxy binary to bypass defensive measures’).
• [T1574.002] DLL Side-Loading – Attack chains load hidden DLLs to execute malicious code (EXE -> hidden DLL -> curl download) (‘DLL side loading technique’).
• [T1574.001] DLL Search Order Hijacking – The analysis lists DLL search order techniques used to load malicious libraries (‘DLL Search Order Hijacking’).
• [T1564.001] Hidden Files and Directories – Payload fragments (1.dat/2.dat) are dropped into AppData and combined into 3.dat to hide the PE (‘drops two files, “1.dat” and “2.dat”, into the UsersUserAppDataRoaming directory’).
• [T1055] Process Injection – Process injection is listed among defense-evasion techniques observed in samples (‘Process Injection’).
• [T1218] System Binary Proxy Execution – Use of system binaries (conhost.exe) to proxy execution is recorded (‘System Binary Proxy Execution’, ‘conhost.exe as a proxy binary’).
• [T1003] OS Credential Dumping – Qakbot’s goal includes credential harvesting and OS credential dumping techniques to obtain sensitive credentials (‘stealing financial data and login credentials from web browsers’).
• [T1555.003] Credentials from Web Browsers – Qakbot specifically targets browser-stored credentials for theft (‘stealing … login credentials from web browsers’).
• [T1016] System Network Configuration Discovery – Network discovery is part of reconnaissance for target identification (‘System Network Configuration Discovery’).
• [T1071] Application Layer Protocol – C2 uses application-layer protocols for communications as part of the command-and-control configuration (‘Application Layer Protocol’).
• [T1095] Non-Application Layer Protocol – Non-application-layer C2 protocols are also enumerated for command-and-control communications (‘Non-Application Layer Protocol’).