QBOT – A HTML Smuggling method to focus on victims | Saga Tech

Why is this system used?

When the sufferer opens the HTML attachment, it decodes the embedded information and saves them domestically. Because of the encoded patterns, no malicious content material passes by means of the community, bypassing community filters and firewalls; due to this fact, this assault methodology is gaining recognition amongst cyber criminals.

QBot Assault Move:

In one of many paperwork we analyzed, it was discovered that an embedded HTML ingredient was created with the “doc.createElement” methodology. Attackers exploited this tag to distribute payloads in zip information. We are able to see within the following picture base64 encoded information for the zip file:-

Fig.1- HTML Bootleg Template

When opening an HTML file, it tips the person as if they’re downloading a zipper file, whereas the zip is already embedded in an HTML file. The password is highlighted within the picture under, “abc555”.

Fig.2 – Zip Obtain

After extracting the zip file, we get the disk picture file “REJ_2975”, which once more accommodates a number of information.

Fig.3 – Information extracted from iso

The “REJ” shortcut file is then liable for finishing up the extra assault. The duty of this file is to run the “reprocess” command script within the “oslo” folder. Subsequently, the script will execute the ultimate QBot Loader DLL with the title “counteractively.dat” as proven within the following determine:

Fig.4 – Execution Instructions

Later, the payload is injected into wermgr.exe by way of course of flush:-

Fig.5 – Execution Instructions

DLL evaluation:

This Qbot Loader DLL is a compiled x32-bit Delphi binary with no export capabilities.

Fig. 6- QBot charger data

Qbot is utilizing protection evasion controls; on this case, it’s for Home windows Defender simulation by checking the “C:INTERNAL__empty” file.

Fig. 7: QBot checking Home windows Defender

achieve persistence:

Qbot makes use of registry entries and self-replication to attain persistence. Because the payload is executed, the Qbot good points its persistence in 2 steps:

1. Copying itself into the folder talked about under:
   %AppDatapercentRoamingMicrosoftRandom Strings
2. Create a registry worth that factors to the earlier payload

Folder creation and eliminated DLLs are loaded by way of regsvr32.exe, as proven under:

Fig. 8- Creation of a Folder with a random title

Dump of configuration information within the Registry. Within the newest payload releases, Qbot has stopped creating its configuration file in “.dat” format. Now, write your cloned DLL entry to the sufferer as encrypted registry keys in ‘HKCUSoftwareMicrosoft[RandomString]’ hive.

Fig. 9 – Log entries

C2 communication:

As proven within the following determine, the injected course of “wermgr.exe” is making a reference to encrypted IPs:-

Fig. 10 – C2 communication IPs

Conclusion:

It isn’t possible to disable JavaScript in most environments, as too many authentic techniques and net functions require its use. On high of that, many authentic JavaScript frameworks use obfuscation strategies to reduce file sizes and enhance the pace of net functions. Due to this fact, blocking obfuscated JavaScript just isn’t a sensible choice. Due to this fact, customers are suggested to be very cautious whereas dealing with suspicious emails with HTML attachments. Fast Heal clients are already protected in opposition to all these assaults.

IoC:

html attachment

Md5: 6783003a0737331c66a0b8fc0a35754d

Detection Title: HTML.QBot.47153

QBot Loader DLL

MD5: 52EC63A6F7F089862E648112FE8E9F1D

Detection title: Trojan.Qakbot

URL:

http://156.221.50.70:995

http://190.26.159.108:995

https://82.205.9.83

https://14.54.83.74

http://190.199.186.80:2222

https://134.35.3.115

https://176.44.119.201

https://45.160.33.131

http://37.245.136.224:2222

https://132.251.244.3

http://206.1.216.174

https://1.20.185.200

http://196.89.213.210:995

http://182.183.211.179:995

https://163.182.177.140

http://190.26.159.29:995

https://197.205.161.175

http://91.171..72.224:32100

http://101.109.135.92:995

https://41.97.56.148

https://14.246.151.165

https://94.36.5.99

https://186.18.210.235

https://79.155.159.202

http://190.204.112.15:2222

MITER Mapping:

Subject material consultants:

Anjali Raut

Nihar Deshpande