QCRI/TechniqueRAG-Datasets huggingface dataset:
Threat description: In addition, although the 2017 campaign has been documented, during our research regarding MirageFox, we found a recently uploaded binary (6/8/2018) from the 2017 campaign, pretty much identical to a RAT mentioned in their RoyalAPT report, barely detected with only 7/66 detections on VirusTotal.  APT15 Code Reuse We found the new version of the RAT on VirusTotal hunting, by a YARA signature we created based off code only found in Mirage and Reaver, both attributed to Chinese government affiliated groups
MITRE ATT&CK techniques:
- T1043: Commonly Used Port
- T1571: Non-Standard Port
Threat description: These files are then transmitted to a threat actor, often over commonly open ports 80 and 443 (HTTP and HTTPS)
MITRE ATT&CK techniques:
- T1043: Commonly Used Port
- T1571: Non-Standard Port
Threat description: KONNI is a RAT that is believed to have  been in use for over four years, with a wide array of functionalities, often leveraging free web hosting providers like 000webhost for its C2 infrastructure
MITRE ATT&CK techniques:
- T1043: Commonly Used Port
- T1571: Non-Standard Port
Threat description: Command and control To traverse the firewall, C2 traffic for most TG-3390 tools occurs over ports 53, 80, and 443
MITRE ATT&CK techniques:
- T1043: Commonly Used Port
- T1571: Non-Standard Port
Threat description: Upon first execution of TONEDEAF, FireEye identified a callback to the C2 server offlineearthquake[.]com over port 80.
MITRE ATT&CK techniques:
- T1043: Commonly Used Port
- T1571: Non-Standard Port
Threat description: The Metasploit reverse HTTP payload was configured to communicate with the command and control (C2) IP address 176.126.85[.]207 with a randomly named resource such as” over TCP port 443.
MITRE ATT&CK techniques:
- T1043: Commonly Used Port
- T1571: Non-Standard Port
Threat description: 1/12/14 3/5/14 127.0.0.1 N/A   3/5/14 3/31/14 103.24.0.142 Hong Kong   3/31/14 10/27/14 103.24.1.54 Hong Kong   10/27/14 11/9/14 127.0.0.1 N/A   11/9/14 5/25/15 127.0.0.3 N/A   5/25/15 Current as of this publication 127.0.0.1 N/A    Table 5
MITRE ATT&CK techniques:
- T1571: Non-Standard Port
Threat description: Figure 5 shows Phishery’s output to the command that injects a URL into a file named “good_test.docx”, which it will save the resulting file to “bad_test.docx”
MITRE ATT&CK techniques:
- T1055: Process Injection
Threat description: It is capable of the following functions:  Collect file/folder/drive information Download files and additional malware Launch/terminate/enumerate process Update configuration data Delete files Inject code from files to other running process Utilize proxy Open reverse shell Run in passive mode — instead of actively connecting to the command and control (C&C) server, the backdoor will open and listen to a port then receive commands through it  Once the backdoor is loaded, it will then load the encrypted configuration file Auditcred.dll.mui/rOptimizer.dll.mui to extract the C&C information and connect to it
MITRE ATT&CK techniques:
- T1055: Process Injection
Threat description: Traps 4.0 can be configured to protect the processes that are cited as being abused in this blog from loading malicious code
MITRE ATT&CK techniques:
- T1055: Process Injection
Threat description: Pupy can communicate using multiple transports, migrate into processes using reflective injection, and load remote python code, python packages and python C-extensions from memory
MITRE ATT&CK techniques:
- T1055: Process Injection
Threat description: 2e0361fd73f60c76c69806205307ccac, update.dll (MiniDuke), 425kb (internal name = “UserCache.dll“) 9e3f3b5e9ece79102d257e8cf982e09e, cache.dll (CozyDuke), 425kb (internal name = “UserCache.dll“) The two share identical export function names in their export directories, and the naming appears to be randomly assigned at compile time
MITRE ATT&CK techniques:
- T1055: Process Injection
Threat description: The loader will then inject a DLL backdoor into dllhost.exe
MITRE ATT&CK techniques:
- T1055: Process Injection
Threat description: TClient is injected into dllhost.exe Malware Analysis  wab32res.dll (FakeRun loader) loads TClient
MITRE ATT&CK techniques:
- T1055: Process Injection
Threat description: POSHSPY leverages two of the tools the group frequently uses: PowerShell and Windows Management Instrumentation (WMI)
MITRE ATT&CK techniques:
- T1047: Windows Management Instrumentation
Threat description: APT29 then created a WMI event subscription in order to execute the backdoor
MITRE ATT&CK techniques:
- T1047: Windows Management Instrumentation
Threat description: This location data gives the attacker a unique edge, as they can specify a target country or city to attack and maximize their accuracy when choosing a particular target.    The .txt file contains information about the C2 domain and infected machine, as detected in a Cybereason Lab environment
MITRE ATT&CK techniques:
- T1041: Exfiltration Over C2 Channel
Threat description: The malware performs the following activities:  Builds imports by dynamically loading APIs Decrypts strings needed for control server communications Performs control server communications Handles commands issued by the control server Uninstalls self from the system  The malicious thread dynamically loads the APIs it needs at the beginning of its execution using LoadLibrary() and GetProcAddress()
MITRE ATT&CK techniques:
- T1041: Exfiltration Over C2 Channel
Threat description: After obtaining the unique ID from the C2 server, the Trojan calls the “SetAbStatById” method to notify the C2 server of its status of “1” to notify the server it had successfully received the filename and file data
MITRE ATT&CK techniques:
- T1041: Exfiltration Over C2 Channel
Threat description: Log.php validates the sender by User-Agent, saves the data in the “UP” server directory and stores the metadata in the mssql database for later reference
MITRE ATT&CK techniques:
- T1074: Data Staged
Threat description: The dropper installs 2 files:netwf.bat : executes netwf.dllnetwf.dll : the payloadThe dropper implements 2 persistence mechanisms:HKCU\Environment\UserInitMprLogonScript to execute the netwf.bat fileCOM Object hijack of the following CLSID: {BCDE0395-E52F-467C-8E3D-C4579291692E}, the CLSID of the class MMDeviceEnumerator.These 2 techniques have also been previously used by this actor.Finally the payload is executed by rundll32.exe (and the ordinal #1 in argument) or by explorer.exe if the COM Object hijack is performed
MITRE ATT&CK techniques:
- T1218.011: System Binary Proxy Execution - Rundll32
Threat description: BlackEnergy2 was eventually seen downloading more crimeware plugins – a custom spam plugin and a banking information stealer custom plugin
MITRE ATT&CK techniques:
- T1027.002: Obfuscated Files or Information - Software Packing
Threat description: Flash object in the .docx file, stored in uncompressed format The Flash object contains an ActionScript which is responsible for extracting the exploit using a custom packer seen in other FinSpy exploits
MITRE ATT&CK techniques:
- T1027.002: Obfuscated Files or Information - Software Packing
Threat description: Data Exfiltration The second module Irdsnhrxxxfery98.~ is responsible for a vast amount of information stealing, and is able to collect information through hooking, clipboard usage, and monitoring the keystate
MITRE ATT&CK techniques:
- T1115: Clipboard Data
Threat description: Cadelspy’s main payload contains its back door functionality, allowing the threat to carry out the following activities:  Log keystrokes and the titles of open windows Gather clipboard data and system information Steal printer information and any documents that were sent to be printed Record audio Capture screenshots and webcam photos  Cadelspy compresses all of the stolen data into a .cab file and uploads it to the attacker’s C&C servers
MITRE ATT&CK techniques:
- T1115: Clipboard Data
Threat description: Mimikatz The threat actors also uploaded tools to scan for and exploit potential vulnerabilities in the network, such as the well-known SMB vulnerability patched in commonly exploited by EternalBlue to move laterally to other systems on the network.
MITRE ATT&CK techniques:
- T1046: Network Service Discovery
Threat description: What changes in the code can we see in such short time intervals that would not be present in a build tool? In one case, one build was programmed to execute the runmem command for a file named wi.exe while the other was not
MITRE ATT&CK techniques:
- T1036: Masquerading
Threat description: Filename SHA256 Description   7za.exe dd6d7af00ef4ca89a319a230cdd094275c3a1d365807fe5b34133324bdaa0229 7-Zip 17.01 beta    nbt.exe c9d5dc956841e000bfd8762e2f0b48b66c79b79500e894b4efa7fb9ba17e4e9e nbtscan 1.0.35    rx.exe a6a0fbfee08367046d3d26fb4b4cf7779f7fb6eaf7e60e1d9b6bf31c5be5b63e IntelliAdmin Remote Execute v1.0    Table 5
MITRE ATT&CK techniques:
- T1036: Masquerading
Threat description: Filename SHA256 Description   7za.exe dd6d7af00ef4ca89a319a230cdd094275c3a1d365807fe5b34133324bdaa0229 7-Zip 17.01 beta   hb.exe 3ca3a957c526eaeabcf17b0b2cd345c0fffab549adfdf04470b6983b87f7ec62 Hobocopy   nbt.exe c9d5dc956841e000bfd8762e2f0b48b66c79b79500e894b4efa7fb9ba17e4e9e nbtscan 1.0.35   rx.exe a6a0fbfee08367046d3d26fb4b4cf7779f7fb6eaf7e60e1d9b6bf31c5be5b63e IntelliAdmin Remote Execute v1.0   tardigrade.exe fe1b011fe089969d960d2dce2a61020725a02e15dbc812ee6b6ecc6a98875392 Tardigrade application
MITRE ATT&CK techniques:
- T1036: Masquerading
Threat description: In one instance, the threat actor gained remote access to a high-value system in a compromised network, ran quser.exe to identify existing RDP sessions on the device, immediately ran a command to compile a RAR archive that specified file types the threat actor did not want, and used a password to encrypt the archive:  YYYY-MM-DD hh:mm:ss     quser YYYY-MM-DD hh:mm:ss     C:\windows\temp\svchost.exe a -m5 -v2000m -hp{password} -inul -r "{destination_file.rar}" "{multiple user directories linked to the victim's projects}" -x*.exe -x*.msi -x*.cab -x*.inc -x*.dll -x*.db -x*.mdb -x*.htm -x*.html -x*.css -x*.jar -x*.js -x*.tmp -x*.bak -x*.dat -x*.log -x*.xml -x*.dmp -x*.dbf -x*.avi -x*.mp3 -x*.mp4 -x*.mpg -x*.mpeg -x*.asp -x*.aspx -x*.gif -x*.jpg -x*.mpp -x*.pst  The threat actors typically rename the encrypted RAR archives
MITRE ATT&CK techniques:
- T1036: Masquerading
Threat description: SHA256  a77f9e441415dbc8a20ad66d4d00ae606faab370ffaee5604e93ed484983d3ff   MD5 1ff40e79d673461cd33bd8b68f8bb5b8   Compiled 2017.08.06 11:32:36 (GMT), 2.22   Type I386 Windows Console EXE   Size 101 888    Instead of implementing this auxiliary module in the form of a dynamic linked library with its corresponding exported functions, the developers decided to use a standalone executable started by events.exe with the following parameters:    Parameter Description   -scr Screenshot file name to save in Cache006 subdirectory, zipped with password from configuration
MITRE ATT&CK techniques:
- T1036: Masquerading
Threat description: The file is named netwf.dat
MITRE ATT&CK techniques:
- T1036: Masquerading
Threat description: The malware drops the Windows batch file dx.bat, which attempts to kill the task daumcleaner.exe; a Korean security program
MITRE ATT&CK techniques:
- T1036: Masquerading
Threat description: The “VPN Client” is a legitimate Juniper VPN software bundled with Helminth,  a malware in use by the OilRig threat agnet: JuniperSetupClientInstaller.exe 6a65d762fb548d2dc56cfde4842a4d3c (VirusTotal link) If the victim downloads and installs the file, their computer would get infected, while the legitimate VPN software is installed
MITRE ATT&CK techniques:
- T1036: Masquerading
Threat description: Figure 10: Network traffic to download final payload (words.exe) Once executed, the file performs the following activities:  Drops a copy of itself in %AppData%\svchost.exe\svchost.exe and drops an XML file, which contains configuration information for Task Scheduler (as shown in Figure 11)
MITRE ATT&CK techniques:
- T1036: Masquerading
Threat description: The Downloader After the exploit or script executes, the system downloads install.exe, which has the following metadata: MD5             5a0c4e1925c76a959ab0588f683ab437 Size            46592 bytes Compile Time    2014-11-19 08:55:10Z Import Hash     6b8611f8148a6b51e37fd68e75b6a81c The file install.exe attempts to write two files (doc.exe and test.exe) to the hard-coded path “C:\Users\Public”, which fails on Windows XP because that path is not present by default
MITRE ATT&CK techniques:
- T1036: Masquerading
Threat description: One example of these samples is given below: SHA256:6500636c29eba70efd3eb3be1d094dfda4ec6cca52ace23d50e98e6b63308fdb The file is a self-extracting RAR, which is a common delivery mechanism for PlugX particularly when the eventual payload will be sideloaded by a legitimate executable
MITRE ATT&CK techniques:
- T1036: Masquerading
Threat description: Filename  Part-I.doc    File Size  11349102 bytes    MD5  92942c54224cd462dd201ae11a560bb8    SHA1  85a21624df2211af3daf05c86a3fbea8271059d3    Notes Malicious RTF document that exploits CVE-2017-8570 and drops QuasarRAT file qrat.exe
MITRE ATT&CK techniques:
- T1036: Masquerading
Threat description: Filename  Part-II.doc    File Size  10156713 bytes    MD5  e32668e569362c96cc56db368b7e821e    SHA1  dadc493abbe3e21610539e1d5a42f523626a6132    Notes Malicious RTF document that exploits CVE-2017-8570 and drops QuasarRAT file mico-audio.exe
MITRE ATT&CK techniques:
- T1036: Masquerading
Threat description: The vmtools.dll file is a modified DLL that both ensures persistence and loads MSBuild.exe, which is the BADNEWS malware renamed to spoof a legitimate Microsoft Visual Studio tool
MITRE ATT&CK techniques:
- T1036: Masquerading
Threat description: These digital certificates are often issued in the name of rogue and legitimate companies to avoid arousing suspicion from researchers and incident responders
MITRE ATT&CK techniques:
- T1036: Masquerading
Threat description: In one instance we observed, one of the initial malware delivered to the victim, RATANKBA (TROJ_RATANKBA.A), connects to a legitimate but compromised website (eye-watch[.]in:443, a mobile application-selling site) from which a hack tool (nbt_scan.exe) is also downloaded
MITRE ATT&CK techniques:
- T1036: Masquerading
Threat description: One archive sample analyzed by CTU researchers contained a legitimate PDF file, a benign image of interest to targets (see Figure 8), and an HttpBrowser installer disguised as an image file
MITRE ATT&CK techniques:
- T1036: Masquerading
Threat description: Whitefly frequently delivers Vcrodat as a malicious DLL that has the same name as DLLs belonging to legitimate software from various security vendors.
MITRE ATT&CK techniques:
- T1036: Masquerading
Threat description: The webshell will save the archives locally to the server in the C:\Users\Public\Libraries\Recorded\Files folder, each with a filename with the following structure: [IP address]_c$_Users_[username]__[Desktop-Documents-Downloads]_[year]-[month]-[day]-[hours]-[minutes]-[seconds].7z It is likely that the threat actors use this functionality to rapidly check for new files created by users on the network
MITRE ATT&CK techniques:
- T1033: System Owner/User Discovery
Threat description: code(2343)", MsgBoxStyle.Critical, null);     The dropper then writes the content of the payload which resides as plaintext in a resource within the .NET assembly to C:\Users\<username>\AppData\Local\Temp\SystemDiskClean.ps1
MITRE ATT&CK techniques:
- T1033: System Owner/User Discovery
Threat description: File starts as mico-audio.exe and installs to C:\Users\%USERNAME%\AppData\Roaming\google-chrome\crome.exe
MITRE ATT&CK techniques:
- T1033: System Owner/User Discovery
Threat description: Unique User-Agents The unique User-Agents used in the HTTP communication between SpeakUp to the C&C are a possible path to the identity of the threat actor behind this campaign
MITRE ATT&CK techniques:
- T1033: System Owner/User Discovery
Threat description: Command ID 17 indexes to a function that collects the system information and sends it to the C2 server.
MITRE ATT&CK techniques:
- T1033: System Owner/User Discovery
Threat description: According to the server’s code, the default command that it would issue to newly infected systems was a batch script contained in a file named 0000000000.bat
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
- T1064: Scripting
Threat description: After execution, the malware will use the Dropbox API to make an HTTP GET request using HTTPS over TCP port 443 for the files:  MD5  Filename  d76261ba3b624933a6ebb5dd73758db4  WmiApCom  79b68cdd0044edd4fbf8067b22878644  WmiApCom.bat   The “WmiApCom.bat” file is simply used to start “WmiApCom”, which happens to be the exact same file as the one dropped by the malicious Word documents
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
- T1064: Scripting
Threat description: Attackers using Comnie are leveraging malicious macros that initially hide decoy documents and shows them when the victim enables macros
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
- T1064: Scripting
Threat description: While all payloads can be dynamically updated, at the time of delivery, this task launched a COM scriptlet (“.sct” file extension) that downloaded and executed Meterpreter hosted on images.chinabytes[.]info
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
- T1064: Scripting
Threat description: VBScript #1 The dropped script “58d2a83f7778d5.36783181.vbs” acts as a launcher
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
- T1064: Scripting
Threat description: For example, they stated DROPSHOT uses more advanced anti-emulation techniques, utilizes external scripts for self-deletion, and uses memory injection versus external drivers for deployment
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
- T1064: Scripting
Threat description: The following are the three files:   Defender.sct – The malicious JavaScript based scriptlet file
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
- T1064: Scripting
Threat description: Users can protect themselves from such attacks by disabling Office macros in their settings and also by being more vigilant when enabling macros (especially when prompted) in documents, even if such documents are from seemingly trusted sources
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
- T1064: Scripting
Threat description: While we have not been able to obtain a secondary payload from the Unicorn generated PowerShell script, we believe that this group uses the script to deliver Metasploit’s Meterpreter as a potential payload as well
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
- T1064: Scripting
Threat description: Via WMI (winmgmt), the JavaScript or VBscript code in the SCT file spawns a PowerShell one-liner which finally consumes the text file
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
- T1064: Scripting
Threat description: Character  Description  0  File contains batch commands, it executes the batch commands  1  Rename the temporary file as .ps1 extension  2  Rename the temporary file as .vbs extension   Table 2: BONDUPDATER Actions Figure 8 is a screenshot of BONDUPDATER’s DGA implementation
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
- T1064: Scripting
Threat description: To run persistently on the system, the Trojan will first create a VBScript file:SpecialFolder.CommonApplicationData\srvResesponded.vbs that contains:CreateObject(“WScript.Shell”).Run(“%app%”) The Trojan replaces the %app% string in the above VBScript with the path to its executable
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
- T1064: Scripting
Threat description: The group often uses the trial version of Cobalt Strike, a publicly available commercial software for “Adversary Simulations and Red Team Operations.” Other public tools used by the group are Metasploit, a well-known free and open source framework for developing and executing exploit code against a remote target machine; Mimikatz, a post-exploitation tool that performs credential dumping; and Empire, “a PowerShell and Python post-exploitation agent.” For detection and exploitation of internet-facing web servers, CopyKittens use Havij, Acunetix and sqlmap
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
- T1064: Scripting
Threat description: The second file is a PowerShell script which appears to be based on a Rapid7 Ruby Exploitation script that loads arbitrary shellcode
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
- T1064: Scripting
Threat description: Next, it will copy the first stage shellcode in memory and create a new thread with the shellcode running in it, the code responsible for this execution is shown in Figure 1
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
- T1064: Scripting
Threat description: For that we can use a Python script, included in Appendix B – Python Scripts
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
- T1064: Scripting
Threat description: Essentially, we are discussing ongoing activity revolving around several malware families:  KopiLuwak and IcedCoffeer Carbon Mosquito WhiteBear  Technical Rattle Turla’s Shifting to Scripting KopiLuwak and IcedCoffee, WhiteBear, and WhiteAtlas Since at least 2015 Turla has leveraged Javascript, powershell, and wsh in a number of ways, including in their malware dropper/installation operations as well as for implementing complete backdoors
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
- T1064: Scripting
Threat description: The image is downloaded directly, and the shellcode is loaded and executed in memory
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
- T1064: Scripting
Threat description: (On the left is NavRAT, and on the right is the shellcode of ROKRAT):    We performed the same analysis for the shellcode located in the downloaded image file and the shellcode is not exactly the same, but the design is very similar
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
- T1064: Scripting
Threat description: Figure 3: Script code embedded in 29[.]html used to download and run Revenge RAT The script shown in Figure 4 is almost identical to the one used by the script contents of 29[.]html (in Figure 3), the only difference being the absence of a sleep command and the usage of the “forfiles” utility
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
- T1064: Scripting
Threat description: The downloaded document template contains the malicious macro codes, which executes a VBScript (VBS).
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
- T1064: Scripting
Threat description: The attackers typically distribute Netwalker ransomware with the use of a reflective PowerShell loader script that has been protected from casual analysis with several layers of obfuscation.
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
- T1064: Scripting
Threat description: The attackers orchestrate attacks using batch or PowerShell scripts that are executed, with the help of domain controllers, on any machine the DC can reach.
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
- T1064: Scripting
Threat description: The files uploaded to this webshell included the same compiled python script that would scan remote systems that were vulnerable to CVE-2017-0144 (EternalBlue) that we saw uploaded to the other errr.aspx webshell.
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
- T1064: Scripting
Threat description: Screenshot in leak of administrative panel for an account at DeltaHost If we use the filename of this screenshot and assume that it was taken on March 29, 2019 and subtract 194 days from this date, it is possible that this server had been operational since at least September 16, 2018
MITRE ATT&CK techniques:
- T1113: Screen Capture
Threat description: The malware can exfiltrate keystrokes, screenshots, browser-related data like cookies and history, decrypted when possible
MITRE ATT&CK techniques:
- T1113: Screen Capture
Threat description: Malware features Remexi boasts features that allow it to gather keystrokes, take screenshots of windows of interest (as defined in its configuration), steal credentials, logons and the browser history, and execute remote commands
MITRE ATT&CK techniques:
- T1113: Screen Capture
Threat description: The command handle looks for the following command strings in Table 3:    Command Description   $fileDownload Uploads the contents of a specified file to C2   $importModule Adds a specified PowerShell module to the current script   $screenshot Executes the contents of the command, which should be the string ‘$screenshot’
MITRE ATT&CK techniques:
- T1113: Screen Capture
Threat description: SpyNote RAT captured the device’s screen activities along with audio using the  MediaProjectionCallback functionality (available with Lollipop, the Android 5.0 release, and later) and saved the output in a file named "video.mp4" as shown in the following screenshot:          Figure 5 : Output File     SMS stealing  SpyNote RAT was also observed stealing SMS messages from the affected devices, as shown in screenshot below:          Figure 6: Reading SMS messages     Stealing contacts The ability to steal contacts is a favorite feature for spyware developers, as the stolen contacts can be used to further spread the spyware
MITRE ATT&CK techniques:
- T1113: Screen Capture
Threat description: This simply acts as cleanup to ensure original file artifacts no longer reside on the infected machine
MITRE ATT&CK techniques:
- T1070: Indicator Removal
Threat description: This is a guest post by independent security researcher James Quinn. This will be Part 1 of a series titled Reversing Gh0stRAT Variants.  As 2018 drew to a close and 2019 took over, I began to see a different behavior from SMB malware authors.  Instead of massive, multi-staged cryptocurrency miners, I began to see more small, covert RATs serving as partial stage1’s.  Of these samples, there was one specific sample that stood out to me.  A Gh0stRAT variant, this sample not only changed the Gh0stRAT header from “Gh0st” to “nbLGX”, it also hid its traffic with an encryption algorithm over the entire TCP segment, in addition to the standard Zlib compression on the Gh0stRAT data.  Some key functionality is below:   Can download more malware   Offline Keylogger   Cleans Event logs
MITRE ATT&CK techniques:
- T1070: Indicator Removal
Threat description: The keylogger then records keystrokes in encrypted files, for example: thumbcache_96.dbx
MITRE ATT&CK techniques:
- T1056: Input Capture
Threat description: NetWire has a built-in keylogger that can capture inputs from peripheral devices such as USB card readers
MITRE ATT&CK techniques:
- T1056: Input Capture
Threat description: 63 64 ku64.dll ku32.dll Keylogger & clipboard monitor
MITRE ATT&CK techniques:
- T1056: Input Capture
Threat description: However, the campaign that the PDC has recently observed has been delivering this keylogger exclusively
MITRE ATT&CK techniques:
- T1056: Input Capture
Threat description: There does appear to be function names however, including PeekMessageA, which has been previously observed in other keylogging malware
MITRE ATT&CK techniques:
- T1056: Input Capture
Threat description: Keylogging Functionality XAgent also has a keylogger functionality that allows the threat actors to steal credentials as the user types them
MITRE ATT&CK techniques:
- T1056: Input Capture
Threat description: Figure 1 Side-by-side of the lure images within ThreeDollars in the October 2017 and the January 2018 attacks   Superficially, we can immediately see the images are quite similar, but with some glaring differences
MITRE ATT&CK techniques:
- T1574.002: Hijack Execution Flow - DLL Side-Loading
Threat description: Send exfiltrated data   taskkill.exe Ends working cycle of modules    Persistence Persistence modules are based on scheduled tasks and system registry
MITRE ATT&CK techniques:
- T1053: Scheduled Task/Job
- T1053.005: Scheduled Task/Job - Scheduled Task
Threat description: For newer operating systems, events.exe creates task.xml as follows:  Then it creates a Windows scheduled task using the following command:       schtasks.exe /create /TN \"Events\\CacheTask_<user_name_here>" /XML \"<event_cache_dir_path>t /F"     At the system registry level, modules achieve persistence by adding themselves into the key: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit when it finds possible add values to the Winlogon subkey, and in HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Activity Manager
MITRE ATT&CK techniques:
- T1053: Scheduled Task/Job
- T1053.005: Scheduled Task/Job - Scheduled Task
Threat description: In addition, the PowerShell implant did not contain a mechanism to persist beyond a simple scheduled task
MITRE ATT&CK techniques:
- T1053: Scheduled Task/Job
- T1053.005: Scheduled Task/Job - Scheduled Task
Threat description: After execution of every task, the malware sleeps for one minute before executing the next task
MITRE ATT&CK techniques:
- T1053: Scheduled Task/Job
- T1053.005: Scheduled Task/Job - Scheduled Task
Threat description: The main similarities include the use of a scheduled task to persistently execute on the system, as well as the same general process to communicate with its C2 server
MITRE ATT&CK techniques:
- T1053: Scheduled Task/Job
- T1053.005: Scheduled Task/Job - Scheduled Task
Threat description: The decoded string from the Sch resource is: SchTasks /Create /SC MINUTE /MO 3 /TN “%n%” /TR “wscript %path%” /f The decoded string from the VBS resource is: CreateObject(“WScript.Shell”).Run(“%app%”) The %n% string in the schtasks command above will be replaced with the GUID saved to GDI.bin
MITRE ATT&CK techniques:
- T1053: Scheduled Task/Job
- T1053.005: Scheduled Task/Job - Scheduled Task
Threat description: This differs from the previous OopsIE variant that used a hardcoded task name for the scheduled task
MITRE ATT&CK techniques:
- T1053: Scheduled Task/Job
- T1053.005: Scheduled Task/Job - Scheduled Task
Threat description: After creating this scheduled task for persistence, the Trojan will begin communicating with its C2 server
MITRE ATT&CK techniques:
- T1053: Scheduled Task/Job
- T1053.005: Scheduled Task/Job - Scheduled Task
Threat description: A scheduled task is also generated to maintain persistence of the payload
MITRE ATT&CK techniques:
- T1053: Scheduled Task/Job
- T1053.005: Scheduled Task/Job - Scheduled Task
Threat description: Office365DCOMCheck or SystemDiskClean) as the name for the scheduled task to maintain persistence on the victim host
MITRE ATT&CK techniques:
- T1053: Scheduled Task/Job
- T1053.005: Scheduled Task/Job - Scheduled Task
Threat description: The malware component, test.exe, uses the Windows command "cmd.exe" /C whoami” to verify it is running with the elevated privileges of “System” and creates persistence by creating the following scheduled task:     schtasks /create /tn "mysc" /tr C:\Users\Public\test.exe /sc ONLOGON     /ru "System" When executed, the malware first establishes a SOCKS5 connection to 192.157.198.103 using TCP port 1913
MITRE ATT&CK techniques:
- T1053: Scheduled Task/Job
- T1053.005: Scheduled Task/Job - Scheduled Task
Threat description: This DLL is used to create a scheduled task that points to the QuasarRAT binary, microsoft_network.exe, allowing it to remain persistent after reboot
MITRE ATT&CK techniques:
- T1053: Scheduled Task/Job
- T1053.005: Scheduled Task/Job - Scheduled Task
Threat description: They use At.exe to schedule tasks to run self-extracting RAR archives, which install either HttpBrowser or PlugX
MITRE ATT&CK techniques:
- T1053: Scheduled Task/Job
- T1053.005: Scheduled Task/Job - Scheduled Task
Threat description: Another batch script run by a scheduled task renames the archives on the file server (see Figure 15)
MITRE ATT&CK techniques:
- T1053: Scheduled Task/Job
- T1053.005: Scheduled Task/Job - Scheduled Task
Threat description: The scripts create scheduled tasks and also retrieve, decode, and execute a copy of Revenge RAT
MITRE ATT&CK techniques:
- T1053: Scheduled Task/Job
- T1053.005: Scheduled Task/Job - Scheduled Task
Threat description: The spreadsheet also creates a scheduled task named "windows update check" that runs the file C:\Users\<user_name>\.templates\System Manager.exe every minute.
MITRE ATT&CK techniques:
- T1053: Scheduled Task/Job
- T1053.005: Scheduled Task/Job - Scheduled Task
Threat description: When the trojan starts up it will attempt to install a scheduled task with the name of “Java Maintenance64” to keep itself running.
MITRE ATT&CK techniques:
- T1053: Scheduled Task/Job
- T1053.005: Scheduled Task/Job - Scheduled Task
Threat description: The campaigns maintain persistence on machines by creating two daily scheduled task entries.
MITRE ATT&CK techniques:
- T1053: Scheduled Task/Job
- T1053.005: Scheduled Task/Job - Scheduled Task
Threat description: The script writes files to the path % appdata %\Roaming\Microsoft\Templates\, then creates two task entries triggered to run daily.
MITRE ATT&CK techniques:
- T1053: Scheduled Task/Job
- T1053.005: Scheduled Task/Job - Scheduled Task
Threat description: On occasions, the phishing emails contained links to external domains to download the first stage, and sometimes the first stage was attached to the email itself
MITRE ATT&CK techniques:
- T1598.003: Phishing for Information - Spearphishing Link
Threat description: The first link was labeled as "Comparison of Major Tasks in '16 & '17" and the second link was identified as "Comparison between '16 & '17".Upon opening these links the user was presented with a further decoy Hangul document
MITRE ATT&CK techniques:
- T1598.003: Phishing for Information - Spearphishing Link
Threat description: Using this example, Comnie will then request data to supply to the BAT script, via the following decrypted request: h=HOSTNAME-PC&f=gethostinfo.bat&c=& Based on network traffic witnessed, the remote C2 server was found to respond with the following information:       netstat -ano > %TEMP%\info.datipconfig /all >> %TEMP%\info.datroute PRINT >> %TEMP%\info.datnet view >> %TEMP%\info.dattasklist >> %TEMP%\info.datnet user >> %TEMP%\info.datnet start >> %TEMP%\info.dat       This script is written to a temporary file prior to be executed
MITRE ATT&CK techniques:
- T1007: System Service Discovery
Threat description: The locations:  For root user  path: /Library/CoreMediaIO/Plug-Ins/FCP-DAL/iOSScreenCapture.plugin/Contents/Resources/ processname: screenassistantd  For regular user  path: ~/Library/Spelling/ processname: spellagentd Subsequently, it implements the Loader::installLoader method, reading the hardcoded 64-bit Mach-O executable (magic value 0xFEEDFACF), and writing to the previously determined path and file
MITRE ATT&CK techniques:
- T1564.001: Hide Artifacts - Hidden Files and Directories
Threat description: This field contains a URL that the Trojan will use to upload the contents of the <process ID of Trojan>.txt file, which will be structured as <process ID of Trojan>.<C2 domain> where the process ID is encoded with the same character substitution function as seen previously in Table 4
MITRE ATT&CK techniques:
- T1057: Process Discovery
Threat description: Figure 2: Process chain for the first part of the campaign Although the actual VBS script changed from sample to sample, with different levels of obfuscation and different ways of invoking the next stage of process tree, its final purpose remained same: invoking PowerShell to decode the Base64 encoded PowerShell command in the INI file that was dropped earlier by the macro, and executing it
MITRE ATT&CK techniques:
- T1057: Process Discovery
Threat description: What does the Poseidon Group do? What happens after a target machine is infected? Once the target’s machine is compromised, the attacker first enumerates all processes running in the system and all services
MITRE ATT&CK techniques:
- T1057: Process Discovery
Threat description: The command does not attempt to kill the specific Office process that would load the particular delivery document, such as Excel in the case of this “.xlam” file, but instead attempts to kill processes associated with Word, Excel, PowerPoint and Publisher
MITRE ATT&CK techniques:
- T1057: Process Discovery
Threat description: The tokens for each platform are hardcoded within the sample:November 2016 to January 2017: "Evil New Year" CampaignIn the early part of 2017, Group123 started the "Evil New Year" campaign
MITRE ATT&CK techniques:
- T1134: Access Token Manipulation
Threat description: Figure 6 Relational diagram of artifacts  We created a timeline of the activity based off the data we collected, and found that the attack dates were tightly clustered into two waves in mid- to late-October and in mid-November as we see in Figure 7 using the timestamps from Table 3
MITRE ATT&CK techniques:
- T1562.001: Impair Defenses - Disable or Modify Tools
Threat description: Ability to disable Microsoft Office Protected View (as shown in Figure 15) by setting the following keys in the Windows Registry: DisableAttachmentsInPV DisableInternetFilesInPV DisableUnsafeLocationsInPV       Figure 15: Disabling Microsoft Office Protected View  Ability to remotely reboot or shut down or clean the system based on the command received from the C2 server, as shown in Figure 16
MITRE ATT&CK techniques:
- T1562.001: Impair Defenses - Disable or Modify Tools
Threat description: From an infrastructure point of view there is no overlap between the two sets of activity, the only overlap is the use of the unique tool “DNSMessenger”  When these points are considered together in conjunction with the significant difference in targeting they make a strong case for classifying this activity as distinct from FIN7 activity
MITRE ATT&CK techniques:
- T1562.001: Impair Defenses - Disable or Modify Tools
Threat description: Restricting these privileges may prevent malware from running or limit its capability to spread through the network.Carefully consider the risks before granting administrative rights to users on their own machines.Scrub and verify all administrator accounts regularly.Configure Group Policy to restrict all users to only one login session, where possible.Enforce secure network authentication, where possible.Instruct administrators to use non-privileged accounts for standard functions such as web browsing or checking webmail.Segment networks into logical enclaves and restrict host-to-host communication paths
MITRE ATT&CK techniques:
- T1087: Account Discovery
Threat description: With these outputs, FIN6 was able to identify user accounts that could access additional hosts in the domain
MITRE ATT&CK techniques:
- T1087: Account Discovery
Threat description: The PowerShell script collects all possible information on the user and the network, including snapshots, computer and user names, emails from registry, tasks in task scheduler, system information, AVs registered in the system, privileges, domain and workgroup information
MITRE ATT&CK techniques:
- T1087: Account Discovery
Threat description: Its use of a PowerShell payload means that only legitimate system processes are utilized and that the malicious code execution can only be identified through enhanced logging or in memory
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
- T1546.013: Event Triggered Execution - PowerShell Profile
Threat description: Mandiant initially identified an early variant of the POSHSPY backdoor deployed as PowerShell scripts during an incident response engagement in 2015
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
- T1546.013: Event Triggered Execution - PowerShell Profile
Threat description: Figure 2: WindowsParentalControlsMigration CommandLineTemplate Figure 3 contains the decoded PowerShell command from the “CommandLineTemplate.”      Figure 3: Decoded CommandLineTemplate PowerShell code POSHSPY PowerShell Component The full code for a POSHSPY sample is available here
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
- T1546.013: Event Triggered Execution - PowerShell Profile
Threat description: Additional Reading This PowerShell logging blog post contains more information on improving PowerShell visibility in your environment
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
- T1546.013: Event Triggered Execution - PowerShell Profile
Threat description: However, in this new variant, all the DNS activity is initiated and executed solely from memory – unlike previous attacks which used PowerShell commands
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
- T1546.013: Event Triggered Execution - PowerShell Profile
Threat description: The PowerShell script executes a compressed first stage PowerShell child process, which then performs a second stage PowerShell process
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
- T1546.013: Event Triggered Execution - PowerShell Profile
Threat description: The PowerShell implant used in the Olympics campaign was a stager based on the PowerShell Empire framework that created an encrypted channel to the attacker’s server
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
- T1546.013: Event Triggered Execution - PowerShell Profile
Threat description: (For more on steganography, see the McAfee Labs Threats Report, June 2017, page 33.) The implants covered in this research establish a permanent presence on the victim’s system once the PowerShell implant is executed
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
- T1546.013: Event Triggered Execution - PowerShell Profile
Threat description: The main function performed by the SCT file is to Base64 decode the contents of WindowsDefender.ini file and execute the decoded PowerShell Script using the following command line: powershell.exe -exec Bypass -c iex([System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String((get-content C:\\ProgramData\\WindowsDefender.ini) The rest of the malicious activities are performed by the PowerShell Script
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
- T1546.013: Event Triggered Execution - PowerShell Profile
Threat description: PowerShell File Analysis The PowerShell script employs several layers of obfuscation to hide its actual functionality
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
- T1546.013: Event Triggered Execution - PowerShell Profile
Threat description: Figure 11: PowerShell script is XOR encoded using a single byte key After deobfuscating the contents of the PowerShell Script, we can divide it into three sections
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
- T1546.013: Event Triggered Execution - PowerShell Profile
Threat description: The malicious macros were all designed to use Windows PowerShell to download a shellcode-based payload from a remote server
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
- T1546.013: Event Triggered Execution - PowerShell Profile
Threat description: The macro uses PowerShell to download a shellcode-based payload from a remote server using one of two available techniques
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
- T1546.013: Event Triggered Execution - PowerShell Profile
Threat description: On January 1, 2017, we observed this URL responding to the above HTTP request with the following data:powershell.exe -exec bypass -window hidden -noni -nop -encoded JABjAG8AbQBtAGEAbgBkACAAPQAgACcAVwB3AEIATwBBAEcAVQBBAGQAQQBBAHUAQQBGAE0AQQBaAFEAQgB5AEEASABZAEEAYQBRAEIAagBBAEcAVQBBAFUAQQBCAHYAQQBHAGsAQQBiAGcAQgAwAEEARQAwAEEAWQBRAEIAdQBBAEcARQBBAFoAdwBCAGwAQQBIAEkAQQBYAFEAQQA2AEEARABvAEEAVQB3AEIAbABBAEgASQBBAGQAZwBCAGwAQQBIAEkAQQBRAHcAQgBsAEEASABJAEEAZABBAEIAcABBAEcAWQBBAGEAUQBCAGoAQQBHAEUAQQBkAEEAQgBsAEEARgBZAEEAWQBRAEIAcwBBAEcAawBBAFoAQQBCAGgAQQBIAF..snip..As you can see, the C2 server responds with a PowerShell command that will run on the system
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
- T1546.013: Event Triggered Execution - PowerShell Profile
Threat description: Upon execution in a vulnerable environment, the PowerShell based payload takes over
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
- T1546.013: Event Triggered Execution - PowerShell Profile
Threat description: The PowerShell script is responsible for downloading the final payload from C2 server to execute it
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
- T1546.013: Event Triggered Execution - PowerShell Profile
Threat description: Use of the non-public PowerShell backdoor previously described by Morphisec and MalwareBytes (which we refer to as POWERSTATS)
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
- T1546.013: Event Triggered Execution - PowerShell Profile
Threat description: Attacker deception and attribution The deobfuscated PowerShell code used by the MuddyWater group resembles previously seen PowerShell scripts that most likely served as prototypes
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
- T1546.013: Event Triggered Execution - PowerShell Profile
Threat description: Lock PowerShell Execution Policy, must be set to “AllSigned” via GPO
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
- T1546.013: Event Triggered Execution - PowerShell Profile
Threat description: These PowerShell scripts are final stage payloads – they include a downloader with domain generation algorithm (DGA) functionality and the backdoor component, which connect to the C2 server to receive commands and perform additional malicious activities.  hUpdateCheckers.ps1 (POWRUNER) The backdoor component, POWRUNER, is a PowerShell script that sends and receives commands to and from the C2 server
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
- T1546.013: Event Triggered Execution - PowerShell Profile
Threat description: The contents within the releasenotes.txt file (SHA256: bf925f340920111b385078f3785f486fff1096fd0847b993892ff1ee3580fa9d)  contains the following formula that Excel will save to the “A0” cell in the worksheet:  The formula uses a command prompt to run a PowerShell script that attempts to download and execute a second PowerShell script hosted at the URL hxxp://micrrosoft[.]net/winupdate.ps1
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
- T1546.013: Event Triggered Execution - PowerShell Profile
Threat description: It will run the newly downloaded PowerShell script by running the following command via cmd /c:       wscript.exe "Office365DCOMCheck.vbs" "PowerShell.exe-ExecutionPolicy bypass -WindowStyle hidden -NoProfile <path to Office365DCOMCheck.ps1 script>"     The payload will then notify the C2 it has successfully downloaded and executed the secondary PowerShell payload
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
- T1546.013: Event Triggered Execution - PowerShell Profile
Threat description: The Information Gathering Tool (IGT) tool is coded in Delphi and includes powershell and SQL components across a dozen different drops
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
- T1546.013: Event Triggered Execution - PowerShell Profile