ATT QakBot April 2021

QakBot has the ability to enumerate windows on a compromised host.

QakBot can use process hollowing to execute its main payload.

QakBot has the ability to check running processes.

QakBot can use cmd.exe to launch itself and to execute multiple C2 commands.

QakBot can delete folders and files including overwriting its executable with legitimate programs.

QakBot can collect system information including the OS version and domain on a compromised host.

QakBot can identify whether it has been run previously on a host by checking for a specified folder.

QakBot can use GetProcAddress to help delete malicious strings from memory.

QakBot can deobfuscate and re-assemble code strings for execution.

QakBot has gained execution through users opening malicious links.

QakBot has gained execution through users opening malicious attachments.

QakBot can use Regsvr32 to execute malicious DLLs.

QakBot has used Rundll32.exe to drop malicious DLLs including Brute Ratel C4 and to enable C2 communication.

QakBot can check the compromised host for the presence of multiple executables associated with analysis tools and halt execution if any are found.

QakBot can identify the installed antivirus product on a targeted system.

QakBot can use signed loaders to evade detection.

QakBot has spread through emails with malicious attachments.

QakBot has spread through emails with malicious links.