QakBot bb02: Trace the Loader DLL to its C2

A purchasing workstation at Haldren Fabrication tripped the SIEM this morning: an Office-adjacent process spawning a system utility, followed by encrypted traffic to addresses nobody recognizes. Before you pull threads, get oriented. This case starts in a mailbox and ends on the perimeter, and the analyst who caught it has handed it to you. Review the available surfaces and the incident window, then begin working the delivery.

The trail begins with one inbound message that slipped past sender authentication and pointed the recipient at a password-protected archive, with the password helpfully included so no scanner could open it. Establish who sent it.

Downloading the archive and mounting what was inside it did not just open a document. A shortcut on the mounted drive launched a trusted Windows utility that has no business running a payload from a user profile. Identify the system binary the shortcut chain used to register and run the hidden DLL.

The registration utility did not carry the malicious code in plain sight. It registered and executed a module that had been written to the user profile with a deliberately misleading extension. Recover the file name of that payload.

Once the payload ran, it tried a string of external addresses over encrypted web traffic, most of which refused it, before locking onto one and staying there. To contain the host you need the address it settled on. Identify the primary command-and-control endpoint, as an address and port.

For the incident report, classify how the attacker ran the payload through a trusted, signed Windows binary instead of executing it directly. Map that evasive behavior to its MITRE ATT&CK technique.