Thread by @malmoeb

1/ Visibility is key for eradication 🥷

In a recent IR case, the TA created persistences with #QakBot on almost every system in the network.

If only individual systems in the network were forensically examined, one or more infected systems would undoubtedly be missed.

🧵

2/ By examing the network connections made by the clients & servers with a forensic agent, it is apparent that QakBot has made a process injection into the following two processes:

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\mobsync.exe

3/ The analysis of the network connections gives us active C2 addresses that we can use for additional hunting inside the network (and in the FW logs).

4/ Persistence via Scheduled Tasks

QakBot has created various tasks on the systems with the following naming scheme (names are random, the following are two examples):

\2415919104
\{59024EB5-14A1-45D3-A38F-4613C0AFE9A4}

5/ The tasks containing the following launch string:

"cmd" /c start /min "" powershell.exe -Command IEX([System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String((Get-ItemProperty -Path HKCU:\SOFTWARE\Aoqaeqfsiyapyap).ahscqpvwo))).

The values are random.

7/ Persistence via run keys

In addition to Scheduled Tasks, persistences were created in the registry using run keys:

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\miphpfdz

Value:
regsvr32.exe -s "C:\Users\<user>\AppData\Roaming\Microsoft\Xmntohpk\cqdron.dll"

8/ Again, the key, the path in the user home and the DLL are random, which makes generic hunting more difficult.

9/ With the @velocidex Velociraptor Hunt Windows.Search.FileFinder, we can easily search for DLLs in different paths.

10/ The attackers have installed one (or both) of the two persistences presented above on almost every system in the compromised network.

We must be very thorough, find all infected systems and persistences, and kick the attackers off the network in a coordinated eradication.

11/ An overlooked persistence could result in the (easy) re-entry of the attacker into the network.

This case is an example of the fact that every system must be examined carefully in the case of an IR, otherwise backdoors or infections will not be found.

Good luck 🍀