2020-07-21 (Tuesday) - Emotet infection with Qakbot

2020-07-21 (TUESDAY) - EMOTET INFECTION WITH QAKBOT

REFERENCE:

- https://www.malware-traffic-analysis.net/2020/07/21/index.html

INFECTION CHAIN:

- Malspam link --> Word doc --> enable macros --> Emotet infection --> Qakbot infection

NOTES:

- This happened from a US location
- I saw Qakbot as follow-up malware when I tried both Emotet epoch 2 and Emotet epoch 3 infections.
- These IOCs are for the Emotet epoch 2 infection with Qakbot

MALWARE:

- SHA256 hash: e8eff9852fefe1a01b140600735f3b9abecfd2f1bb93929c8955778bb11d0681
- File size: 175,150 bytes
- File location: hxxp://umeedupvanfoundation[.]com/blogs/JB5HY27RGXBM90/
- File name: RSH_070120_FLV_072120.doc
- File description: Word doc with macro for Emotet (epoch 2)

- SHA256 hash: 915a61faf42b819b836fe6901544b30562b93113fbf7626eec63a1b33b011d09
- File size: 770,048 bytes
- File location: hxxps://www.thelibrarysamui[.]com/wp-content/themes/stockholm/t9/
- File location: C:\Users\[username]\332.exe
- File location: C:\Users\[username]\AppData\Local\proquota\wvc.exe
- File description: Initial Emotet EXE retrieved by Word macro (epoch 2)
- Note 1: The file name 332.exe may be a different 3-digit number in the name for a diffent host.
- Note 2: The file path & name proquota\wvc.exe is different for each infection.

- SHA256 hash: a7f46b14baa4d0df476385bdb7316c774842d39faf6efc1f2b0f09ad3c5060de
- File size: 427,520 bytes
- File location: C:\Users\[username]\AppData\Local\proquota\wvc.exe
- File description: Emotet EXE updated shortly after the initial infection
- Note 2: The file path & name proquota\wvc.exe is different for each infection.

- SHA256 hash: 576029dbd4166e9d6548f877bea422da5d7a07adfc5ca60c93dabbecfab3d6c7
- File size: 811,536 bytes
- File location: C:\Users\[username]\AppData\Local\proquota\KBDHU17cd.exe
- File location: C:\Users\[username]\AppData\Roaming\Microsoft\Whimnooaor\jpkwoqx.exe
- File description: Qakbot EXE retrieved by Emotet-infected host
- Note 1: The file name KBDHU17cd.exe is different for each infection.
- Note 2: The file path & name Whimnooaor\jpkwoqx.exe is different for each infected host.

INFECTION TRAFFIC:

WEB TRAFFIC TO DOWNLOAD WORD DOCUMENT FROM EMOTET MALSPAM (EPOCH 2):

- 182.50.151[.]87 port 80 - umeedupvanfoundation[.]com - GET /blogs/JB5HY27RGXBM90/

WEB TRAFFIC BY WORD MACROS TO RETRIEVE THE INITIAL EMOTET EXE:

- 104.238.82[.]165 port 443 (HTTPS) - kipliani[.]com - GET /sys-cache/w84tjs1/
- 163.44.168[.]22 port 80 - phamthuan[.]com - GET /wp-admin/h/
- 134.209.38[.]89 port 80 - rmacadetstore[.]com - GET /cwu/l6y/
- 134.209.38[.]89 port 443 (HTTPS) - rmacadetstore[.]com - GET /cwu/l6y/
- 104.28.22[.]107 port 80 - fivestarcleanerstx[.]com - GET /h/procurement/9uvmim/
- 139.59.228[.]88 port 443 (HTTPS) - www.thelibrarysamui[.]com - /h/procurement/9uvmim/

EMOTET POST-INFECTION TRAFFIC:

- 124.45.106[.]173 port 443 - 124.45.106[.]173:443 - POST /Edif/
- 124.45.106[.]173 port 443 - 124.45.106[.]173:443 - POST /G3tJeBBYQ455y/YocO7QfQZ1QRAAW/
- 124.45.106[.]173 port 443 - 124.45.106[.]173:443 - POST /L0Ekr/IFWDb8/
- 124.45.106[.]173 port 443 - 124.45.106[.]173:443 - POST /O1G3KKGd/
- 124.45.106[.]173 port 443 - 124.45.106[.]173:443 - POST /LFKovAiCaYStgjSr/79emciYyrsQ90JeqAW/0WeN/q8HqypuBr8I/q1oJ2kQ6W/
- 198.144.158[.]120 port 443 - 198.144.158[.]120:443 - POST /SyijpY8HtMg7yG/doPfqxoTHOiNmmTlzMY/KctCHNQ8jDAgfR/
- 124.45.106[.]173 port 443 - 124.45.106[.]173:443 - POST /qlQ1/XqzH/lp9O87HKvTCVyd/ZYyi3rQR2pIm4w/PDqn0JWecLQHmo7sZ/
- 124.45.106[.]173 port 443 - 124.45.106[.]173:443 - POST /0f68oLBb/Bl7lsW2ppvf2D3h/qLMDW/LMhHiMMrZ73oI/1Kb98oiQNUBNb8WF/
- 124.45.106[.]173 port 443 - 124.45.106[.]173:443 - POST /AvPxevvvO/NNo7xktyceeX/bm0jvwGUrLs/dKYYGfX0GZrR5k/
- 124.45.106[.]173 port 443 - 124.45.106[.]173:443 - POST /rkaLBO7N/
- 124.45.106[.]173 port 443 - 124.45.106[.]173:443 - POST /iTOzKRl/z0hIjDx6c0cq0xO/
- 198.144.158[.]120 port 443 - 198.144.158[.]120:443 - POST /NnDwHpG
- 124.45.106[.]173 port 443 - 124.45.106[.]173:443 - POST /PXX8rq7y23jiXtOL7zR/YINnNyNRVgf/
- 198.144.158[.]120 port 443 - 198.144.158[.]120:443 - POST /Jevuka8q8RYAKW5/40cu7wK8ecnI1l/l1zq0aNhvrb/qhBYRz/
- 198.144.158[.]120 port 443 - 198.144.158[.]120:443 - POST /xBtHgDZq92bco
- 124.45.106[.]173 port 443 - 124.45.106[.]173:443 - POST /69W36/RzDkJoOrfDOLC/
- 124.45.106[.]173 port 443 - 124.45.106[.]173:443 - POST /VRgpDSSw7Y2m5W/QZna2EW8/u3jJ6cI6LEmkY0o45A/e0iO6MnC/FRioD/
- 94.49.254[.]194 port 80 -  94.49.254[.]194 - POST /giPRh9IB2ksBRG36p/R4aRVfgRdYf9KtjwY/rsBcW7TrytfZoU/mBDg9WWwy/pdgso31rnTMTy5uIW/z5pNWkPilsOGJ/
- 94.49.254[.]194 port 80 -  94.49.254[.]194 - POST /dZHhFxlmbYSyC/WAs7SsslRpphq/

QAKBOT (QBOT) POST-INFECTION TRAFFIC:

- 24.234.86[.]201 port 995 - HTTPS traffic
- 82.118.22[.]125 port 443 - HTTPS traffic
- port 443 - cdn.speedof[.]me - HTTPS traffic
- 89.105.198[.]119 port 80 - a.strandsglobal[.]com - GET /redir_chrome.html
- 54.36.108[.]120 port 65400

ATTEMPTED TCP CONNECTIONS BUT NO RESPONSE FROM THE SERVER (PROBABLY CAUSED BY QAKBOT):

- 70.183.127[.]6 port 995
- 190.220.8[.]10 port 443
- 98.116.62[.]242 port 443
- 72.204.242[.]138 port 20
- 76.187.8[.]160 port 443
- 2.50.47[.]97 port 2222
- 104.235.72[.]17 port 443
- 179.51.23[.]31 port 443
- 24.234.86[.]201 port 995