QCRI/TechniqueRAG-Datasets huggingface dataset:
Threat description: The code of this module is loaded directly into the exploited application and has several methods of payload execution. One of method uses a very interesting technique of payload execution which is designed mostly to bypass modern anti-malware products. This uses an interesting bug in the Windows DDE component. It is not a secret that anti-malware systems trigger on special system functions that are called in the context of potential vulnerable applications to make a deeper analysis of API calls such as CreateProcess, WinExec or ShellExecute
MITRE ATT&CK techniques:
- T1189: Drive-by Compromise
Threat description: So attackers specify an external C&amp;C server in the command line and the tool connects to this server using HTTP. This remote server is used as a proxy by attackers: the connection that goes to this server is redirected to the internal network by the tool and any response that the tool gets from a computer in the internal network goes to the C&amp;C server. Thus, attackers can communicate with internal servers that are normally unreachable from the internet
MITRE ATT&CK techniques:
- T1090: Proxy
Threat description: IronNetInjector is made of an IronPython script that contains a .NET injector and one or more payloads. The payloads can be also .NET assemblies (x86/64) or native PEs (x86/64). When an IronPython script is run, the .NET injector gets loaded, which in turn injects the payload(s) into its own or a remote process
MITRE ATT&CK techniques:
- T1055: Process Injection
Threat description: In the third phase of the operation, the attackers harvested credentials stored on the compromised machines and performed lateral movement and infected new machines. The attackers also introduced a very rare and stealthy technique to communicate with their servers and exfiltrate data using Microsoft Outlook
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: The crypter mainly contains junk code to increase entropy of the sample and hide the actual code. We have found 2 crypter variants with some code differences, but mostly with the same logic applied
MITRE ATT&CK techniques:
- T1027.001: Obfuscated Files or Information - Binary Padding
Threat description: The operators used the HyperBro Trojan as their last-stage in-memory remote administration tool (RAT). The timestamps for these modules are from December 2017 until January 2018. The anti-detection launcher and decompressor make extensive use of Metasploit’s shikata_ga_nai encoder as well as LZNT1 compression
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: Actors have downloaded POWERTRICK, Metasploit Meterpreter, and Cobalt Strike BEACON payloads following the initial compromise. BEACON payloads have commonly been executed after moving laterally to new hosts within the victim network. The attackers have employed Cobalt Strike payloads crafted to maintain persistence through reboot via a scheduled task on critical systems in victim environments. We have observed actors executing encoded PowerShell commands that ultimately executed instances of the PowerShell EMPIRE backdoor. In at least once case, attackers have maintained access to a victim environment using stolen credentials to access corporate VPN infrastructure configured to require only single-factor authentication
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
Threat description: Initially the Cobalt group focused on jackpotting ATMs: they launched a program that sent commands directly to the dispenser to issue cash. Network penetration In all cases investigated by Group-IB, the Cobalt group used a set of spear phishing emails to gain initial access to the corporate infrastructure. However, some of the email addresses belong to employees that no longer work at the organization, which means that the Cobalt group likely uses out-of-date mailing lists. Each message contains an attachment that loads the payload – part of Cobalt Strike software – to the computer's operating memory. In order to make this download possible, attackers have tried several different formats of attachments and emails, as their primary task is to bypass mail filters, protection measures, and the company's security policy. 3 Example of a message with an executable attachment (.exe) The archive is password-protected in order to bypass anti-virus scans, security systems, and mail filters. However, when there is use of a security policy that prohibits the transfer of encrypted archives, such an email message may be blocked, so the attackers would send .doc files that contain exploits for Microsoft Office (fig. For organizations that perform timely updates of their systems and adhere to strict security policies, the Cobalt group employs another method to deliver malicious code through emails with Word documents containing a malicious macro. 6 Example of a message sent by attackers from a domain whose name is similar to the name of a real domain . As soon as the attachment is launched and the malicious code is executed, the Cobalt Strike payload is loaded in the memory. Provision of the malware survivability The Cobalt group uses different methods to ensure malware survivability on corporate networks
MITRE ATT&CK techniques:
- T1566.001: Phishing - Spearphishing Attachment
Threat description: The attackers execute several Base64-encoded PowerShell commands in order to determine if the infected machine’s user is in the admin or domain admin group
MITRE ATT&CK techniques:
- T1087.002: Account Discovery - Domain Account
Threat description: The injected payload is known as Cobalt Strike Beacon and can be used to execute commands, inject other processes, elevate current processes or impersonate other processes, and upload and download files. The Get-NetComputer command from PowerView is renamed by the attackers to a random name
MITRE ATT&CK techniques:
- T1018: Remote System Discovery
Threat description: Once unpacked, the malware creates a copy of its own process with a suspended thread and injects the unpacked code into the new process before calling the ResumeThread API. Breaking on this function call in a debugger allows an analyst to dump the process and extract the unpacked Karagany binary for further analysis
MITRE ATT&CK techniques:
- T1055.003: Process Injection - Thread Execution Hijacking
Threat description: Microsoft has been monitoring these attacks and notifying targeted customers for several months, but only recently reached a point in our investigation where we can attribute the activity to Strontium with high confidence. MSTIC’s investigation revealed that Strontium has evolved its tactics since the 2016 election to include new reconnaissance tools and new techniques to obfuscate their operations. In recent months, it has engaged in brute force attacks and password spray, two tactics that have likely allowed them to automate aspects of their operations. Strontium also disguised these credential harvesting attacks in new ways, running them through more than 1,000 constantly rotating IP addresses, many associated with the Tor anonymizing service. Strontium even evolved its infrastructure over time, adding and removing about 20 IPs per day to further mask its activity
MITRE ATT&CK techniques:
- T1110.003: Brute Force - Password Spraying
Threat description: Apart from targeting Gmail users, Pawn Storm has also abused OAuth in credential phishing attacks against high profile Yahoo users. Here is an example from 2015 where “McAfee Email Protection” is offered
MITRE ATT&CK techniques:
- T1528: Steal Application Access Token
Threat description: ISMAgent prioritizes HTTP as its mechanism to communicate with the C2 server, but if it is unable to reach the C2 server it will switch to the DNS tunneling mechanism. To carry out its HTTP C2 communications, the Trojan prepends "www. to the configured C2 domain and issues a DNS query to resolve this domain
MITRE ATT&CK techniques:
- T1008: Fallback Channels
Threat description: Last week, Unit 42 released a blog on a newly named threat group called DarkHydrus that we observed targeting government entities in the Middle East. The attack that we discussed in our previous publication involved spear-phishing to deliver a PowerShell payload we call RogueRobin; however, we are aware of DarkHydrus carrying out a credential harvesting attack in June 2018. It also appears that this an ongoing campaign, as we have evidence of previous credential harvesting attempts using the same infrastructure dating back to the Fall of 2017. The credential harvesting attacks used spear-phishing emails that contained malicious Microsoft Office documents that leveraged the “attachedTemplate” technique to load a template from a remote server. When attempting to load this remote template, Microsoft Office will display an authentication dialog box to ask the user to provide login credentials. When entered, these credentials are then sent to the C2 server, which allows DarkHydrus to collect the user account credentials. Based on Unit 42’s analysis, DarkHydrus used the open-source Phishery tool to create two of the known Word documents used in these credential harvesting attacks. As discussed in our previous blog, this further strengthens DarkHydrus’ use of the open source for their attack tools. A phishing attack to steal credentials like this is not new: US-CERT warned of the same technique by a different threat group in 2017. Based on this, we can reasonably presume this group will continue to carry out attacks against these kinds of targets in the Middle East in the near-future
MITRE ATT&CK techniques:
- T1566.001: Phishing - Spearphishing Attachment
Threat description: To deliver the malware to the victim machines, the Rocke group exploits vulnerabilities in Apache Struts 2, Oracle WebLogic, and Adobe ColdFusion. For example, by exploiting Oracle WebLogic vulnerability CVE-2017-10271 in Linux shown in Figure 1, a compromised Linux victim machine downloads backdoor 0720.bin and opens a shell
MITRE ATT&CK techniques:
- T1190: Exploit Public-Facing Application
Threat description: The malware displays fake forms on top of the banking sites and intercepts credentials from the victims. It can also display a fake Windows Update whenever there is nefarious activity in the background, as seen in Figure 23
MITRE ATT&CK techniques:
- T1056.002: Input Capture - GUI Input Capture
Threat description: Zlh.exe is a legitimate, signed Norman Safeground AS application, which is used to sideload a malicious nflogger.dll DLL.The encrypted ZeroT payload is usually named NO.2.mui. The sideloaded DLL does not always use the same vulnerable executable, but it is always similar in functionality. Usually the DLL is not packed, but we have observed instances compressed by UPX. This malicious DLL is usually obfuscated with the same junk code: dummy API calls inserted in between real instructions (Fig. 7). The same obfuscation can be found in multiple functions in ZeroT itself
MITRE ATT&CK techniques:
- T1027.001: Obfuscated Files or Information - Binary Padding
Threat description: During one investigation, APT32 was observed using a privilege escalation exploit (CVE-2016-7255) masquerading as a Windows hotfix. In another investigation, APT32 compromised the McAfee ePO infrastructure to distribute their malware as a software deployment task in which all systems pulled the payload from the ePO server using the proprietary SPIPE protocol. APT32 also used hidden or non-printing characters to help visually camouflage their malware on a system. For example, APT32 installed one backdoor as a persistent service with a legitimate service name that had a Unicode no-break space character appended to it. Another backdoor used an otherwise legitimate DLL filename padded with a non-printing OS command control code
MITRE ATT&CK techniques:
- T1036.004: Masquerading - Masquerade Task or Service
- T1027: Obfuscated Files or Information
Threat description: The attackers also ran the nmap utility on the router VM and scanned ports on systems within the restricted segment of the enterprise network. On September 27, the attackers started removing all traces of their activity from the router, using the logrotate utility to set up automatic deletion of log files
MITRE ATT&CK techniques:
- T1070.003: Indicator Removal - Clear Command History
- T1046: Network Service Discovery
Threat description: Four files tested in 2014 are based on the open-source project, cryptcat. Analysis of these cryptcat binaries indicates that the actor continually modified them to decrease AV detection rates. One of these files was deployed in a TEMP.Veles target’s network. The compiled version with the least detections was later re-tested in 2017 and deployed less than a week later during TEMP.Veles activities in the target environment. TEMP.Veles’ lateral movement activities used a publicly-available PowerShell-based tool, WMImplant. On multiple dates in 2017, TEMP.Veles struggled to execute this utility on multiple victim systems, potentially due to AV detection. Four files tested in 2014 are based on the open-source project, cryptcat. Analysis of these cryptcat binaries indicates that the actor continually modified them to decrease AV detection rates. One of these files was deployed in a TEMP.Veles target’s network. On multiple dates in 2017, TEMP.Veles struggled to execute this utility on multiple victim systems, potentially due to AV detection
MITRE ATT&CK techniques:
- T1027.005: Obfuscated Files or Information - Indicator Removal from Tools
Threat description: Another interesting discovery was a tool that was used during attacks to make queries to Active Directory using LDAP. This tool is able to dump detailed information about computers and usernames listed in Active Directory, and is tailored for a specific victim’s domain
MITRE ATT&CK techniques:
- T1018: Remote System Discovery
- T1087.002: Account Discovery - Domain Account
Threat description: The attackers then created scheduled tasks that would launch the ransomware with names based on variants of Windows Update Security or Windows Update Security Patches
MITRE ATT&CK techniques:
- T1053.005: Scheduled Task/Job - Scheduled Task
Threat description: In what appears to be a first on the cyber-espionage scene, a nation-state-backed hacking group has used a Google Chrome extension to infect victims and steal passwords and cookies from their browsers
MITRE ATT&CK techniques:
- T1555.003: Credentials from Password Stores - Credentials from Web Browsers
- T1176: Browser Extensions
Threat description: The shellcode loaded by the macro contains an encrypted DLL which is decrypted at runtime and then manually mapped into memory by the shellcode. After mapping the DLL, the shellcode jumps to the entry point of that DLL. The shellcode uses some kind of custom hashing method to resolve the APIs. We used hollows_hunter to dump the DLL and reconstruct the IAT once it is fully mapped into memory
MITRE ATT&CK techniques:
- T1620: Reflective Code Loading
- T1140: Deobfuscate/Decode Files or Information
Threat description: Based on our technical analysis, telemetry, and data from submissions, we can assert with high confidence that this is the work of the Hidden Cobra group. These initial findings appear to be the first stage of Operation GhostSecret. For more on the global aspect of this threat, see “Global Malware Campaign Pilfers Data from Critical Infrastructure of Entertainment, Finance, Health Care, and Other Industries
MITRE ATT&CK techniques:
- T1573.001: Encrypted Channel - Symmetric Cryptography
Threat description: Interestingly, the ChChes samples we observed were digitally signed using a certificate originally used by HackingTeam and later part of the data leaked when they were themselves hacked. Wapack labs also observed a similar sample targeting Japan in November. It’s not clear why the attackers chose to use this certificate, as it was old, had been leaked online, and had already been revoked by the time they used it. Digital certificates are typically used because they afford an air of legitimacy, which this one definitely does not
MITRE ATT&CK techniques:
- T1553.002: Subvert Trust Controls - Code Signing
Threat description: The attacker’s choice of IP addresses was also optimized to evade detection. The attacker primarily used only IP addresses originating from the same country as the victim, leveraging Virtual Private Servers
MITRE ATT&CK techniques:
- T1036: Masquerading
Threat description: SUNSPOT is StellarParticle’s malware used to insert the SUNBURST backdoor into software builds of the SolarWinds Orion IT management product. SUNSPOT monitors running processes for those involved in compilation of the Orion product and replaces one of the source files to include the SUNBURST backdoor code. Several safeguards were added to SUNSPOT to avoid the Orion builds from failing, potentially alerting developers to the adversary’s presence
MITRE ATT&CK techniques:
- T1195.002: Supply Chain Compromise - Compromise Software Supply Chain
Threat description: The modules are signed by an invalid digital certificates listed as “Tencent Technology (Shenzhen) Company Limited” with serial numbers, copied from real Tencent certificates
MITRE ATT&CK techniques:
- T1036.001: Masquerading - Invalid Code Signature
Threat description: Capable of stealing documents sent to the printer queue. Steals written CD images. Capable of stealing files previously seen on removable drives once they are available again. Steals Internet Explorer, Netscape Navigator, FireFox and RealNetworks cookies. If deleted from Frontend file or related registry values, it will reappear after reboot with a new name and startup type
MITRE ATT&CK techniques:
- T1025: Data from Removable Media
Threat description: Recall that when the malicious code is executed, it invokes the extract_ei function on its own binary image, to check if the file is infected. If so, it opens itself, and reads the trailer to get the offset of where the file’s original bytes are located. It then writes these bytes out to a new file named: .&lt;orginalfilename&gt;1. This file is then set executable (via chmod) and executed (via execl
MITRE ATT&CK techniques:
- T1554: Compromise Host Software Binary
Threat description: Next, the shellcode iterates through the PEB’s loader module list looking for the base address of Kernel32.dll. This is typical of shellcode, as the Kernel32.dll base address is necessary to resolve any dependency files required by the shellcode to run. With this address, the shellcode loads its dependency modules and resolves any necessary Windows Application Programming Interface (API) calls using standard shellcode API hashing. The following modules are loaded
MITRE ATT&CK techniques:
- T1106: Native API
Threat description: NOBELIUM, with existing administrative permissions, was observed to drop a malicious loader named version.dll in the %WinDir%\ADFS\ folder where the AD FS service executable Microsoft.IdentityServer.ServiceHost.exe is located. Once the system or the AD FS service is restarted, Microsoft.IdentityServer.ServiceHost.exe loads mscoree.dll, which in turn loads mscoreei.dll. As mentioned above, mscoreei.dll has a delay load import named version.dll
MITRE ATT&CK techniques:
- T1574.001: Hijack Execution Flow - DLL Search Order Hijacking
Threat description: In recent BitPaymer IR engagements, Falcon Intelligence linked the initial infection vector to fake updates for a FlashPlayer plugin and the Chrome web browser. These fake updates are served via legitimate websites that have been compromised, and use social engineering to trick users into downloading and running a malicious executable. These fake update campaigns appear to be a pay-per-install service that is simply used by INDRIK SPIDER to deliver its malware, as other malware has also been delivered via the same campaigns
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
- T1584.004: Compromise Infrastructure - Server
Threat description: One of the reconnaissance commands was to run a modified nbtscan tool ("NetBIOS nameserver scanner") to identify available NetBIOS name servers locally or over the network. Nbtscan has been used by APT10 in Operation Cloud Hopper to search for services of interest across the IT estate and footprint endpoints of interest. It is also capable of identifying system information
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
- T1018: Remote System Discovery
Threat description: The attacker used a temporary file replacement technique to remotely execute utilities: they replaced a legitimate utility with theirs, executed their payload, and then restored the legitimate original file. They similarly manipulated scheduled tasks by updating an existing legitimate task to execute their tools and then returning the scheduled task to its original configuration. They routinely removed their tools, including removing backdoors once legitimate remote access was achieved
MITRE ATT&CK techniques:
- T1070: Indicator Removal
- T1053.005: Scheduled Task/Job - Scheduled Task
- T1070.004: Indicator Removal - File Deletion
Threat description: 1) Suckfly's first step was to identify a user to target so the attackers could attempt their initial breach into the e-commerce company's internal network. 2) On April 22, 2015, Suckfly exploited a vulnerability on the targeted employee's operating system (Windows) that allowed the attackers to bypass the User Account Control and install the Nidiran back door to provide access for their attack. 3) After the attackers successfully exploited the employee’s system, they gained access to the e-commerce company's internal network. To do this the attackers used a signed credential-dumping tool to obtain the victim's account credentials. With the account credentials, the attackers were able to access the victim's account and navigate the internal corporate network as though they were the employee. 4) On April 27, the attackers scanned the corporate internal network for hosts with ports 8080, 5900, and 40 open. Ports 8080 and 5900 are common ports used with legitimate protocols, but can be abused by attackers when they are not secured. Based on Suckfly scanning for common ports, it’s clear that the group was looking to expand its foothold on the e-commerce company's internal network. 5) The attackers’ final step was to exfiltrate data off the victim’s network and onto Suckfly’s infrastructure. While we know that the attackers used the Nidiran back door to steal information about the compromised organization, we do not know if Suckfly was successful in stealing other information
MITRE ATT&CK techniques:
- T1078: Valid Accounts
Threat description: In April, security researchers in the Microsoft Threat Intelligence Center discovered infrastructure of a known adversary communicating to several external devices. Further research uncovered attempts by the actor to compromise popular IoT devices (a VOIP phone, an office printer, and a video decoder) across multiple customer locations. The investigation uncovered that an actor had used these devices to gain initial access to corporate networks. In two of the cases, the passwords for the devices were deployed without changing the default manufacturer’s passwords and in the third instance the latest security update had not been applied to the device
MITRE ATT&CK techniques:
- T1078: Valid Accounts
Threat description: When exploiting the intended targets, the threat actors used malicious .docx files to capture user credentials. The documents retrieved a file through a “file://” connection over SMB using Transmission Control Protocol (TCP) ports 445 or 139. When a user attempted to authenticate to the domain, the C2 server was provided with the hash of the password. Local users received a graphical user interface (GUI) prompt to enter a username and password, and the C2 received this information over TCP ports 445 or 139. Note: a file transfer is not necessary for a loss of credential information. Symantec’s report associates this behavior to the Dragonfly threat actors in this campaign. 1](link is external
MITRE ATT&CK techniques:
- T1187: Forced Authentication
Threat description: The logging functions are hooked so that whenever the backdoor is used, nothing gets sent to the logging facility, leaving no trace of the backdoor in the log files on disk. If the backdoor is not in use, logging will behave normally and function calls will get redirected to the original function implementation
MITRE ATT&CK techniques:
- T1562.006: Impair Defenses - Indicator Blocking
Threat description: The output of the downloaded batch file is saved to “%PUBLIC%\Libraries\tp\&lt;batch filename&gt;.txt”. The script will then upload the output of this batch file by including the data in a sequence of DNS queries. The exfiltrates the output of the batch script by splitting up the data within the text file into chunks up to 23 bytes and sends the data within a series of DNS queries that have the following structure
MITRE ATT&CK techniques:
- T1030: Data Transfer Size Limits
Threat description: Ryuk does not encrypt files from within its own process memory space, but injects into a remote process. Before injecting into a remote process, Ryuk attempts to adjust its token privileges to have the SeDebugPrivilege. Before injecting into a remote process, Ryuk also calls CreateToolhelp32Snapshot to enumerate all running processes. If a process is found that is not named csrss.exe, explorer.exe, lsaas.exe, or is running under NT AUTHORITY system account, Ryuk will inject itself into this single process. By ensuring that the process is not running under NT AUTHORITY, the developers are assuming the process is not running under another account and therefore can be written to. Ryuk uses a combination of VirtualAlloc, WriteProcessMemory and CreateRemoteThread to inject itself into the remote process
MITRE ATT&CK techniques:
- T1055: Process Injection
Threat description: Next, the third-stage DLL will load the "Waqybg" resource into memory. As the resource is stored in reverse byte order, the third-stage DLL will restore it by reversing the bytes and then proceed to decompress it. The decompressed data is the fourth stage wiper payload. After decompressing the data, the third-stage DLL copies a legitimate Windows utility "InstallUtil.exe" into the %TEMP% directory, creates a suspended process with it and injects the fourth-stage wiper into the process. Finally, it resumes the process and transfers the execution flow to the fourth-stage wiper. Creates InstallUtil.exe process
MITRE ATT&CK techniques:
- T1055: Process Injection
Threat description: Whitefly has consistently used a technique known as search order hijacking to run Vcrodat. This technique takes advantage of the fact that Windows does not require an application to provide a specific path for a DLL that it wishes to load. If no path is provided, Windows searches for the DLL in specific locations on the computer in a pre-defined order. Attackers can therefore give a malicious DLL the same name as a legitimate DLL but place it ahead of the legitimate version in the search order so that it will be loaded when Windows searches for it. Whitefly frequently delivers Vcrodat as a malicious DLL that has the same name as DLLs belonging to legitimate software from various security vendors. The group leverages search order hijacking to assure that its malicious DLLs will be executed. Targeting security applications could allow the attackers to gain higher privileges for the malware, since the vendor’s component may be run with elevated privileges
MITRE ATT&CK techniques:
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: The malware’s next action is to check if the execute privilege is SYSTEM. When the execute privilege is SYSTEM, the malware will get the process “Explorer.exe”, get the token of the user that launched the process and impersonate it. It is a downgrade from SYSTEM to another user with less privileges to avoid affecting the desktop of the SYSTEM user later
MITRE ATT&CK techniques:
- T1134.001: Access Token Manipulation - Token Impersonation/Theft
Threat description: Currently LockerGoga does not support any worm-like capabilities that would allow it to self-propagate by infecting additional hosts on a target network. We have observed LockerGoga moving around a network via the server message block (SMB) protocol, which indicates the actors simply manually copy files from computer to computer
MITRE ATT&CK techniques:
- T1570: Lateral Tool Transfer
Threat description: Finally, command line tried to execute (iex is an alias for Invoke-Expression) the code downloaded from the IP address 104[.]168[.]237[.]21. Threat actors abused sslip.io for connection to C&amp;C - a service that provides free IP to domain mapping to make SSL certificate generation easier for traffic encryption. While this service is legitimate and widely used, the malware abused it in an attempt at evading detection when connecting to C&amp;C servers
MITRE ATT&CK techniques:
- T1102: Web Service
Threat description: If the payload determines it is not running in a sandbox, it will attempt to install itself to the system to persistently execute
MITRE ATT&CK techniques:
- T1547.009: Boot or Logon Autostart Execution - Shortcut Modification
Threat description: Numbered Panda has a long list of high-profile victims and is known by a number of names including: DYNCALC, IXESHE, JOY RAT, APT-12, etc. Numbered Panda has targeted a variety of victims including but not limited to media outlets, high-tech companies, and multiple governments. Numbered Panda has targeted organizations in time-sensitive operations such as the Fukushima Reactor Incident of 2011, likely filling intelligence gaps in the ground cleanup/mitigation operations. One of the most interesting techniques that Numbered Panda likes to use is to dynamically calculate the Command and Control (C2) port by resolving a DNS. The malware will typically use two DNS names for communication: one is used for command and control; the other is used with an algorithm to calculate the port to communicate to. There are several variations of the algorithm used to calculate the C2 port, but one of the most common is to multiply the first two octets of the IP address and add the third octet to that value. This is typically represented as: (A * B) + C – common values might be 200.2.43.X, which would result in communication on port 443. Numbered Panda will frequently use blogs or WordPress in the c2 infrastructure, which helps to make the network traffic look more legitimate. CrowdStrike has observed Numbered Panda targeting high-tech, defense contractors, media organizations, and western governments
MITRE ATT&CK techniques:
- T1568.003: Dynamic Resolution - DNS Calculation
Threat description: Some versions of the Orz backdoor have 32- and 64-bit embedded DLLs, stored internally as base64 strings. Their purpose is to simply run another binary. These are used as loaders for future executable payloads, using the well-known process hollowing technique. To use the MockDll, the backdoor creates a configuration .ini file like that shown in Figure 14
MITRE ATT&CK techniques:
- T1055.012: Process Injection - Process Hollowing
- T1218.010: System Binary Proxy Execution - Regsvr32
Threat description: The shellcode loader was observed on one infected device as updater.exe with the Metasploit-style service name APTYnDS1ABEuUHEA, indicating that it was installed as a service
MITRE ATT&CK techniques:
- T1553.002: Subvert Trust Controls - Code Signing
Threat description: From one of the hosts, we discovered that the actor executed a credential harvesting tool named Responder and moved laterally using Windows commands. Lazarus overcame network segmentation, exfiltrating data from a completely isolated network segment cut off from the internet by compromising a router virtual machine, as we explain below under “Overcoming network segmentation
MITRE ATT&CK techniques:
- T1557.001: Adversary-in-the-Middle - LLMNR/NBT-NS Poisoning and SMB Relay
Threat description: 1) If the malware was executed with the "install" command-line argument, which uses .NET Framwork’s InstallHelper method to install the malware as a service. 3) If no arguments are provided and the malware determines it is running in a Windows environment, it saves a DLL to the system that it injects into the explorer.exe process. The injected DLL executable loads the malware’s executable and runs it within memory of the explorer.exe process
MITRE ATT&CK techniques:
- T1055.001: Process Injection - Dynamic-link Library Injection
Threat description: This static set of characteristics, combined with the minimal use of obfuscation in their phishing attacks, may benefit organizations that are potential targets for IRON TILDEN.ToolsTaegis™ XDR Adversary Software Coverage Tool
MITRE ATT&CK techniques:
- T1221: Template Injection
Threat description: Interestingly, there is an option in the RC2CL module to turn off its backdoor functionality and act as a proxy. In this case, the malware turns off the Windows firewall and creates a server that relays communication between a client and C&amp;C server, or between two clients
MITRE ATT&CK techniques:
- T1090.001: Proxy - Internal Proxy
Threat description: In this attack, spear phishing was used as the initial infection vector. Before launching the attack, the group studied publicly available information about the targeted organization and identified email addresses belonging to various departments of the company
MITRE ATT&CK techniques:
- T1589.002: Gather Victim Identity Information - Email Addresses
Threat description: If the ransomware is not executed with administrator rights or if the infected host runs Windows Vista or later, it will attempt to elevate its privileges. In short, WastedLocker uses a well-documented UAC bypass method [1] [2]. It chooses a random file (EXE/DLL) from the Windows system32 folder and copies it to the %APPDATA% location under a different hidden filename. Next, it creates an alternate data stream (ADS) into the file named bin and copies the ransomware into it. WastedLocker then copies winsat.exe and winmm.dll into a newly created folder located in the Windows temporary folder
MITRE ATT&CK techniques:
- T1564.001: Hide Artifacts - Hidden Files and Directories
Threat description: After patching, the threat actor can use the Skeleton Key password configured at the time of deployment to log in as any domain user. Legitimate users can still log in using their own passwords
MITRE ATT&CK techniques:
- T1556.001: Modify Authentication Process - Domain Controller Authentication
Threat description: In the first path, obtaining the SAML signing certificate normally entails first querying the private encryption key that resides on the AD FS container and then using that key to decrypt the signing certificate. The certificate can then be used to create illicit but valid SAML tokens that allow the actor to impersonate users, enabling them to access enterprise cloud applications and services
MITRE ATT&CK techniques:
- T1552.004: Unsecured Credentials - Private Keys
- T1550: Use Alternate Authentication Material
Threat description: The websites contain numerous articles and content to make them seem legitimate; in some cases the websites have over 10,000 individual news articles. Volexity has found the content is largely scraped and reposted in full from various other legitimate online news outlets. This appears to be done in an automated fashion and most likely through WordPress plugins. Numerous posted articles and images can be directly tracked back to other online blogs and newspapers; sometimes the byline or even watermark in images show directly where the article was sourced. In some cases, only a small number of pages on the site contains malicious code; in other cases, the profiling code is pervasive
MITRE ATT&CK techniques:
- T1608.004: Stage Capabilities - Drive-by Target
Threat description: If the bot is running with a regular user privilege, persistence is established using the registry “Run” method. The loader DLL component is written to “%APPDATA%\mswinload[.]dll” and a “mswinload” value is added to the “Run” key to execute ordinal #1 of the DLL with rundll32[.]exe
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: The Trojan does not encrypt the data sent via DNS beacons, rather it converts the ASCII characters into their hexadecimal values and includes these values in cleartext. The DNS beacons sent from the Helminth executable have the following structure, which is very similar to the script version
MITRE ATT&CK techniques:
- T1132.001: Data Encoding - Standard Encoding
Threat description: Wrote indicators based on observed attacker activity • Identified lateral movement, unique backdoors, credential theft, data theft, recon, persistence creation, etc
MITRE ATT&CK techniques:
- T1053.005: Scheduled Task/Job - Scheduled Task
Threat description: Over a few days' span, the threat actors install remote access tools on additional systems based upon the results of the network reconnaissance. They use At.exe to schedule tasks to run self-extracting RAR archives, which install either HttpBrowser or PlugX. CTU researchers observed the threat actors collecting Cisco VPN profiles to use when accessing the victim's network via VPN (see Figure 13
MITRE ATT&CK techniques:
- T1133: External Remote Services
- T1053.002: Scheduled Task/Job - At
Threat description: This thread searches for for files with the following extensions on fixed drives and sends them to C2 every 60 minutes
MITRE ATT&CK techniques:
- T1020: Automated Exfiltration
Threat description: To deploy the file injector, the instrumentor downloads additional payloads to be injected into a benign process
MITRE ATT&CK techniques:
- T1055.012: Process Injection - Process Hollowing
Threat description: The program copies itself as &lt;Hangul full path&gt;HncReporter.exe and changes the default program association in the registry to open HWP documents. To do so, it alters following registry values
MITRE ATT&CK techniques:
- T1546.001: Event Triggered Execution - Change Default File Association
Threat description: Another tool written in Go, GoldFinder was most likely used as a custom HTTP tracer tool that logs the route or hops that a packet takes to reach a hardcoded C2 server. When launched, the malware issues an HTTP request for a hardcoded IP address (e.g. hxxps://185[.]225[.]69[.]69/) and logs the HTTP response to a plaintext log file (e.g. loglog.txt created in the present working directory). GoldFinder uses the following hardcoded labels to store the request and response information in the log file
MITRE ATT&CK techniques:
- T1119: Automated Collection
Threat description: Another interesting technique this malware uses is Visual Studio’s Resource Manager. This is a feature built into Visual Studio that allows one to attach basically any file to the original binary and get a pointer to its data with a few simple API calls. Siloscape uses this method to write the Tor archive to the disk, as well as the unzip binary used to open the archive. It also uses Tor to securely connect to its C2
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: The source code of SUNBURST was likely sanitized before being included in SUNSPOT. The use of generic variable names, pre-obfuscated strings, and the lack of developer comments or disabled code is similar to what could be obtained after decompiling a backdoored Orion binary, as illustrated in Figure 2, which provides a comparison between the injected source code (top) and a decompilation output (bottom
MITRE ATT&CK techniques:
- T1027.005: Obfuscated Files or Information - Indicator Removal from Tools
Threat description: The first backdoor that the TeleBots group relied heavily on was Python/TeleBot.A, which was rewritten from Python in the Rust programming language. The functionality remains the same: it is a standard backdoor that uses the Telegram Bot API in order to receive commands from, and send responses to, the malware operator
MITRE ATT&CK techniques:
- T1102.002: Web Service - Bidirectional Communication
Threat description: After the extensive validation described above, the backdoor enters its main execution stage. At its core, the backdoor is a very standard one that receives instructions from the C2 server, executes those instructions, and sends back information. The type of commands that can be executed range from manipulating of registry keys, to creating processes, and deleting files, etc. effectively providing the attackers with full access to the device, especially since it’s executing from a trusted, signed binary
MITRE ATT&CK techniques:
- T1112: Modify Registry
Threat description: In July 2018, Unit 42 analyzed a targeted attack using a novel file type against at least one government agency in the Middle East. It was carried out by a previously unpublished threat group we track as DarkHydrus. Based on our telemetry, we were able to uncover additional artifacts leading us to believe this adversary group has been in operation with their current playbook since early 2016. Once opened, Excel will retrieve whatever object is at the URL inside the file. These files have most recently been found in use by criminals to deliver commodity RATs such as Flawed Ammyy. In DarkHydrus's case, the preferred payload retrieved in their previous attacks were exclusively open-source legitimate tools which they abuse for malicious purposes, such as Meterpreter and Cobalt Strike. However, in this instance, it appears that this group used a custom PowerShell based payload that we call RogueRobin
MITRE ATT&CK techniques:
- T1566.001: Phishing - Spearphishing Attachment
Threat description: When executed, the malware first establishes a SOCKS5 connection to 192.157.198.103 using TCP port 1913. The malware sends the SOCKS5 connection request "05 01 00" and verifies the server response starts with "05 00". The malware then requests a connection to 192.184.60.229 on TCP port 81 using the command "05 01 00 01 c0 b8 3c e5 00 51" and verifies that the first two bytes from the server are "05 00" (c0 b8 3c e5 is the IP address and 00 51 is the port in network byte order
MITRE ATT&CK techniques:
- T1104: Multi-Stage Channels
Threat description: This is likely to make it appear as if nothing is amiss to the user (as high CPU usage is a red flag of cryptocurrency-mining malware
MITRE ATT&CK techniques:
- T1014: Rootkit
Threat description: The VBScript in turn runs rundll32.exe, activating the Cobalt Strike DLL (step #5) using a clean parent/child process tree completely disconnected from the SolarWinds process. Finally, the VBScript removes the previously created IFEO value to clean up any traces of execution (step #6) and also deletes the following registry keys related to HTTP proxy
MITRE ATT&CK techniques:
- T1112: Modify Registry
- T1070: Indicator Removal
Threat description: Malicious actors commonly maintain persistence on a victim’s system by installing the malware-as-a-service. Volgmer queries the system and randomly selects a service in which to install a copy of itself. The malware then overwrites the ServiceDLL entry in the selected service's registry entry. In some cases, HIDDEN COBRA actors give the created service a pseudo-random name that may be composed of various hardcoded words
MITRE ATT&CK techniques:
- T1543.003: Create or Modify System Process - Windows Service
Threat description: The C2 server address is not embedded directly inside Tomiris: instead, it connects to a signalization server that provides the URL and port to which the backdoor should connect. Then Tomiris sends GET requests to that URL until the C2 server responds with a JSON object of the following structure
MITRE ATT&CK techniques:
- T1568: Dynamic Resolution
Threat description: Daserf — This backdoor has the functionality of a remote shell and can be used to execute commands, upload and download data, capture screenshots, and log keystrokes. It uses RC4 encryption and custom Base64 encoding to obfuscate HTTP traffic. Datper uses an RC4-encrypted configuration to obfuscate HTTP traffic. xxmm (also known as Minzen) — This RAT and likely successor to Daserf AES-encrypts HTTP communications using a one-time encryption key. As of this publication, BRONZE BUTLER demonstrates a preference for concurrently using Datper and xxmm in its operations. Source: Secureworks) - RarStar — This custom tool uploads RAR archives to a specified URL as POST data (see Figure 6). RarStar encodes the POST data using Base64 and a custom XOR algorithm. RarStar HTTP POST request. T-SMB Scan — This SMB scanning tool was originally published on a Chinese program-sharing website (pudn.com). BRONZE BUTLER removed its help message functionality. When exfiltration is complete, the uploader (or Datper or xxmm) immediately uses the del command to delete the RAR archives. Search proxy log files for evidence of web server scanning using the URL patterns associated with BRONZE BUTLER activity
MITRE ATT&CK techniques:
- T1573.001: Encrypted Channel - Symmetric Cryptography
Threat description: messengers. Figures 9 and 10 show FakeM attempting to resemble MSN or Yahoo. Messenger traffic, as the first 32-bytes contain data that resemble legitimate traffic generated by these chat programs
MITRE ATT&CK techniques:
- T1001.003: Data Obfuscation - Protocol Impersonation