TrojanSpy.Win64.QAKBOT.YXDLQZ

This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system.

Arrival Details

This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan Spy drops a copy of itself in the following folders using different file names:

• %Application Data%\Microsoft\{random}\{random}.dll

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following processes:

• Depending on the number of AV products that was found to be running in the system and the machine architecture it would choose from the following:
  • %System%\wermgr.exe
  • %System%\backgroundTaskHost.exe
  • %System%\dxdiag.exe
• %System%\schtasks.exe /Create /ST {Start Time} /RU "NT AUTHORITY\SYSTEM" /SC ONCE /tr "rundll32.exe \"%Application Data%\{Random}\{Random}.dll,hvsi\" /Z /ET {End Time} /tn {Random}
• whoami /all
• arp -a
• ipconfig /all
• net view
• nslookup -querytype=ALL -timeout=12 _ldap._tcp.dc._msdcs.WORKGROUP
• nltest /domain_trusts /all_trusts
• net share
• route print
• netstat -nao
• net localgroup
• qwinsta

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.. %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• Global\{GUID}

It injects codes into the following process(es):

• Depending on the number of AV products that was found to be running in the system and the machine architecture it would choose from the following:
  • %System%\wermgr.exe
  • %System%\backgroundTaskHost.exe
  • %System%\dxdiag.exe

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

Autostart Technique

This Trojan Spy adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{Random} = rundll32.exe %Application Data%\{Random}\{Random}.dll,hvsi

Other System Modifications

This Trojan Spy adds the following registry entries:

HKEY_CURRENT_USER\Software\Classes\
aeoaofliyg
{8 Random Alphanumeric Characters} = {Hex Value}

Backdoor Routine

This Trojan Spy executes the following commands from a remote malicious user:

• Update Self
• Update Configuration
• Download and Install Plugins
• Terminate Processes
• Drop Files
• Drop Files and Run

Information Theft

This Trojan Spy gathers the following data:

• Computer Name
• Installed Antivirus Products
• IP address
• Operating System Information
• Processor Information
• Running Processes
• Username
• Account Privileges
• System Volume Information

Stolen Information

This Trojan Spy sends the gathered information via HTTP POST to the following URL:

• {BLOCKED}.{BLOCKED}.{BLOCKED}.191:443
• {BLOCKED}.{BLOCKED}.{BLOCKED}.24:443

Other Details

This Trojan Spy adds the following registry keys:

HKEY_CURRENT_USER\Software\Classes\
aeoaofliyg

It connects to the following URL(s) to check for an Internet connection:

• microsoft.com
• google.com
• kernel.org
• www.wikipedia.org
• oracle.com
• verisign.com
• broadcom.com
• yahoo.com
• xfinity.com
• irs.gov
• linkedin.com

It checks for the presence of the following process(es):

• frida-winjector-helper-32.exe
• frida-winjector-helper-64.exe
• tcpdump.exe
• windump.exe
• ethereal.exe
• wireshark.exe
• ettercap.exe
• rtsniff.exe
• packetcapture.exe
• capturenet.exe
• qak_proxy
• dumpcap.exe
• CFF Explorer.exe
• not_rundll32.exe
• ProcessHacker.exe
• tcpview.exe
• filemon.exe
• procmon.exe
• idaq64.exe
• loaddll32.exe
• PETools.exe
• ImportREC.exe
• LordPE.exe
• SysInspector.exe
• proc_analyzer.exe
• sysAnalyzer.exe
• sniff_hit.exe
• joeboxcontrol.exe
• joeboxserver.exe
• ResourceHacker.exe
• x64dbg.exe
• Fiddler.exe
• sniff_hit.exe
• sysAnalyzer.exe
• BehaviorDumper.exe
• processdumperx64.exe
• anti-virus.EXE
• sysinfoX64.exe
• sctoolswrapper.exe
• sysinfoX64.exe
• FakeExplorer.exe
• apimonitor-x86.exe
• idaq.exe

It does the following:

• It checks the presence of the following Anti-Virus and Security Applications in the affected system:
  • ccSvcHst.exe
  • NortonSecurity.exe
  • nsWscSvc.exe
  • Avgcsrvx.exe
  • Avgsvcx.exe
  • Avgcsrva.exe
  • MsMpEng.exe
  • Mcshield.exe
  • Avp.exe
  • Kavtray.exe
  • Equi.exe
  • Ekrn.exe
  • Bdagent.exe
  • Vsserv.exe
  • Vsservppl.exe
  • AvastSvc.exe
  • aswEngSrv.exe
  • aswToolsSvc.exe
  • afwServ.exe
  • Aswidsagent.exe
  • AvastUI.exe
  • coreServiceShell.exe
  • PccNTMon.exe
  • NTRTScan.exe
  • Sophos UI.exe
  • SophosUI.exe
  • SAVAdminService.exe
  • SavService.exe
  • Fshoster32.exe
  • wRSA.exe
  • Vkise.exe
  • Iserv.exe
  • Cmdagent.exe
  • ByteFence.exe
  • MBAMService.exe
  • Mbamgui.exe
  • Fmon.exe
  • Dwengine.exe
  • Dwarkdaemon.exe
  • Dwwatcher.exe
  • SentinelServiceHost.exe
  • SentinelStaticEngine.exe
  • SentinelAgent.exe
  • SentinelStaticEngineScanner.exe
  • SentinelUI.exe
  • SonicWallClientProtectionService.exe
  • SWDash.exe
  • CynetEPS.exe
  • CynetMS.exe
  • CynetConsole.exe
  • CSFalconService.exe
  • CSFalconContainer.exe
  • RepUx.exe
  • CrAmTray.exe
  • Csc_ui.exe
  • Xagtnotif.exe
  • AppUIMonitor.exe
• It establishes its persistence with the following routine:
  • It will only create its autostart registry entry if it detects that the system it is running on is about to restart or shutdown.
  • It will also write its code again in the original binary that was wiped previously before the system reboots or shutdowns.
  • When the system it is running on boots again, it would proceed to inject itself again to its target process and then proceed to wipe the binary and delete the autostart registry entry and binary.
• It stores its encrypted configuration in the registry key that it creates.
• After it is succesful in injecting its codes into its target process, it will wipe its original binary with zeros and leave only the headers intact.

It adds the following scheduled tasks:

• Task Name: {Random}
• Task Action: rundll32.exe %Application Data%\Microsoft\{Random}\{Random}.dll,hvsi

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)