title: Qakbot Rundll32 Exports Execution
id: 339ed3d6-5490-46d0-96a7-8abe33078f58
status: test
description: Detects specific process tree behavior of a "rundll32" execution with exports linked with Qakbot activity.
references:
- https://github.com/pr0xylife/Qakbot/
author: X__Junior (Nextron Systems)
date: 2023-05-24
modified: 2023-05-30
tags:
- attack.execution
- detection.emerging-threats
- attack.stealth
logsource:
product: windows
category: process_creation
detection:
selection_paths:
ParentImage|endswith:
# Note: Only add processes seen used by Qakbot to avoid collision with other strains of malware
- '\cmd.exe'
- '\cscript.exe'
- '\curl.exe'
- '\mshta.exe'
- '\powershell.exe'
- '\pwsh.exe'
- '\wscript.exe'
Image|endswith: '\rundll32.exe'
CommandLine|contains:
# Note: Only add paths seen used by Qakbot to avoid collision with other strains of malware
- ':\ProgramData\'
- ':\Users\Public\'
- '\AppData\Local\Temp\'
- '\AppData\Roaming\'
selection_exports:
CommandLine|endswith:
# Note: Only add additional exports seen used by Qakbot
- 'aslr' # https://tria.ge/230524-scgq9add9v/behavioral1#report
- 'bind'
- 'DrawThemeIcon'
- 'GG10'
- 'GL70'
- 'jhbvygftr'
- 'kjhbhkjvydrt'
- 'LS88'
- 'Motd'
- 'N115'
- 'next' # https://tria.ge/230530-n3rxpahf9w/behavioral2
- 'Nikn'
- 'print'
- 'qqqb'
- 'qqqq'
- 'RS32'
- 'Test'
- 'Time'
- 'Updt'
- 'vips'
- 'Wind'
- 'WW50'
- 'X555'
- 'XL55'
- 'xlAutoOpen'
- 'XS88'
condition: all of selection_*
falsepositives:
- Unlikely
level: critical