Trend Micro Black Basta October 2022

QakBot can use net config workstation, arp -a, `nslookup`, and ipconfig /all to gather network configuration information.

QakBot can identify remote systems through the net view command.

Cobalt Strike can use Window admin shares (C$ and ADMIN$) for lateral movement.

QakBot has been delivered in ZIP files via HTML smuggling.

QakBot can use obfuscated and encoded scripts.

QakBot can identify the user name on a compromised system.

The QakBot payload has been disguised as a PNG file and hidden within LNK files using a Microsoft File Explorer icon.

QakBot can use netstat to enumerate current network connections.

QakBot can inject itself into processes including explore.exe, Iexplore.exe, Mobsync.exe., and wermgr.exe.

QakBot can use cmd.exe to launch itself and to execute multiple C2 commands.

Cobalt Strike uses a command-line interface to interact with systems.

QakBot can use VBS to download and execute malicious files.

The QakBot web inject module can inject Java Script into web banking pages visited by the victim.

QakBot can use net localgroup to enable discovery of local groups.

Brute Ratel C4 can use `net group` for discovery on targeted domains.

Brute Ratel C4 can use HTTPS and HTTPS for C2 communication.

Brute Ratel C4 can use DNS over HTTPS for C2.

Brute Ratel C4 can use LDAP queries, `net group "Domain Admins" /domain` and `net user /domain` for discovery.

QakBot has gained execution through users opening malicious links.

QakBot can use Regsvr32 to execute malicious DLLs.

QakBot has used Rundll32.exe to drop malicious DLLs including Brute Ratel C4 and to enable C2 communication.

Cobalt Strike can use `rundll32.exe` to load DLL from the command line.

Brute Ratel C4 can use LDAP queries and `nltest /domain_trusts` for domain trust discovery.

QakBot has been packaged in ISO files in order to bypass Mark of the Web (MOTW) security measures.

BloodHound can compress data collected by its SharpHound ingestor into a ZIP file to be written to disk.

QakBot has placed its payload in hidden subdirectories.

QakBot has spread through emails with malicious links.

Brute Ratel C4 can use DNS over HTTPS for C2.