QCRI/TechniqueRAG-Datasets huggingface dataset:
Threat description: Config.json" is a mining config file for XMRig, an open-source Monero miner. The file sets the mining pool as xmr[.]pool[.]MinerGate[.]com:45700 and the actor's wallet as rocke@live.cn. If the shell scripts do not download a miner from 118[.]24[.]150[.]172, they attempt to download a file called "XbashY" from 3g2upl4pq6kufc4m[.]tk. TermsHost.exe" is a PE32 Monero miner. Based on the config file it uses, it appears to be the Monero Silent Miner. This miner can be purchased online for $14 and targets malicious actors. Advertising for the miner promotes it as offering startup registry key persistence, mining only while idle, and the ability to inject the miner into "Windows processes to bypass firewalls. The sample grabs the config file "xmr.txt," which contains the same configuration information as the previous files, from Rocke's command and control (C2) server hosted on sydwzl[.]cn. The sample also creates the UPX-packed file "dDNLQrsBUE.url" in the Windows Start Menu Folder. Intriguingly, this file appears to share some similarities with Cobalt Strike, the popular penetration testing software, which would allow the attacker to have greater control over the infected system
MITRE ATT&CK techniques:
- T1027.002: Obfuscated Files or Information - Software Packing
Threat description: In this version, a shortcut is created in order to launch winnit.exe in the following path %USERPROFILE%\Start Menu\Programs\Startup\Anti virus service.lnk. As in the previous version, the ID of the infected system is generated with exactly the same method. The C2 is different and the analysed version this time only contains a single domain
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: Hardcore Nationalist group SideWinder is a threat group active since 2012 according to Kaspersky. This group mainly targets Pakistanis and Chinese military &amp; government entities’ windows machines. They also target mobile phone devices. This is the second time this group is using COVID-19 theme to lure victims, thereby capitalizing on the fear of global pandemic. Sidewinder aka HN2 is believed to be an Indian state sponsored group. A detailed analysis of SideWinder attacks on Pakistani military officials was also published in April
MITRE ATT&CK techniques:
- T1204.002: User Execution - Malicious File
- T1204.001: User Execution - Malicious Link
Threat description: WastedLocker will attempt to encrypt files on local as well as remote (network adjacent and accessible) and removable drives
MITRE ATT&CK techniques:
- T1135: Network Share Discovery
Threat description: The infection chain starts with an email in which the victim receives a download link that fetches the first-stage downloader. As we found in our analysis, this first-stage downloader is responsible for fetching a malicious MSI file hosted on an attacker-controlled GitHub page. This MSI file is downloaded and executed on the endpoint. As a result, a malicious Python-compiled binary is dropped on the file system, which uses the Dropbox API for command-and-control (C&amp;C) communication
MITRE ATT&CK techniques:
- T1102.002: Web Service - Bidirectional Communication
- T1204.001: User Execution - Malicious Link
- T1566.002: Phishing - Spearphishing Link
- T1105: Ingress Tool Transfer
Threat description: At the second stage, the attackers remotely connected to the device and scanned the local network seeking to gain access to public shared folders, web servers, and any other open resources. The aim was to harvest information about the network, above all, servers and workstations used for making payments. At the same time, the attackers tried to brute-force or sniff login data for such machines. If the firewall blocked access from one segment of the network to another, but allowed a reverse connection, the attackers used a different payload to build tunnels
MITRE ATT&CK techniques:
- T1040: Network Sniffing
Threat description: As a result of all of the above actions, when attempting to surf the web, the user’s web browser will first ask the attacker web page on TOR for proxy settings. The user traffic is then redirected through a proxy controlled by the attacker, who carries out a Man-In-the-Middle attack and impersonates the various sites the user attempts to surf. The attacker is free to read the victim’s traffic and tamper with it in any way they please
MITRE ATT&CK techniques:
- T1557: Adversary-in-the-Middle
Threat description: Controlled by Micropsia operators, the malware is able to register to an event of USB volume insertion to detect new connected USB flash drives. Once an event is triggered, Micropsia executes an RAR tool to recursively archive files based on a predefined list of file extensions (*.xls, *.xlsx, *.csv, *.odt, *.doc, *.docx, *.ppt, *.pptx, *.pdf, *.mdb, *.accdb, *.accde, *.txt
MITRE ATT&CK techniques:
- T1119: Automated Collection
- T1560.001: Archive Collected Data - Archive via Utility
Threat description: Creates a new registry key HKCU\Software\Classes\Folder\shell\open\command - Sets the “Default” value to “path of the malware” - Creates a value “DelegateExecute” and sets the value to “0” - Executes %systemDirectory%sdclt.exe to bypass the UAC as shown below (figure 7
MITRE ATT&CK techniques:
- T1112: Modify Registry
Threat description: These two files, keyword_parm.txt and parm.txt contain instructions for MESSAGETAP to target and save contents of SMS messages
MITRE ATT&CK techniques:
- T1560.003: Archive Collected Data - Archive via Custom Method
Threat description: 1) Send initial proxy module request. The initial request contains the bot ID, external IP address of the infected machine, reverse DNS lookup of the external IP address, internet speed (measured earlier) and seconds since the proxy module started. 2) Establish a connection (proxy commands sequence 1-&gt;10-&gt;11) with the PROXY-C2. 3) Initialize sessions, perform socks5 authorization with login/password (received from PROXY-C2 with command 10). 4) Begin SOCKS5-like communication wrapped into the QakBot proxy module protocol
MITRE ATT&CK techniques:
- T1090.002: Proxy - External Proxy
Threat description: A technical relevant fact about this campaign is the use of Python embedded into Windows executables of the malware. There is no multi-platform support as the code is heavily Windows-oriented (use of libraries). However, we discovered several clues that the attackers prepared the infrastructure for Mac OS X and Unix victims as well. In addition to Windows components, we also found a mobile (Android) component
MITRE ATT&CK techniques:
- T1059.006: Command and Scripting Interpreter - Python
- T1053.005: Scheduled Task/Job - Scheduled Task
Threat description: Guloader is a downloader that has been active since 2019. It is known to deliver various malware, more notably: Agent-Tesla, Netwire, FormBook, Nanocore, and Parallax RAT
MITRE ATT&CK techniques:
- T1102: Web Service
Threat description: All of the backdoors identified – excluding RoyalDNS – required APT15 to create batch scripts in order to install its persistence mechanism. This was achieved through the use of a simple Windows run key
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: Once communication with the C2 server has been established, QakBot is known to download and use additional modules in order to perform its malicious operations
MITRE ATT&CK techniques:
- T1095: Non-Application Layer Protocol
- T1105: Ingress Tool Transfer
Threat description: When generating the URLs within the HTTP POST and GET requests, XAgent sets one HTTP parameter using a specific data structure that contains this agent_id value. This parameter transmits the agent_id to the C2 server to obtain commands the actor wishes to execute on the compromised system. The data structure used to transmit the agent_id to the C2 is as follows
MITRE ATT&CK techniques:
- T1106: Native API
Threat description: Inception’s malware is modular and the attackers will load plugins based on requirements for each attack. The group has used a range of plugins in recent attacks, some of which are improved versions of plugins used in 2014, while others were previously unseen
MITRE ATT&CK techniques:
- T1057: Process Discovery
Threat description: Following the initial compromise, in many instances the BackdoorDiplomacy group employed open-source reconnaissance and red-team tools to evaluate the environment for additional targets of opportunity and lateral movement. Among the tools documented are
MITRE ATT&CK techniques:
- T1588.002: Obtain Capabilities - Tool
- T1105: Ingress Tool Transfer
Threat description: Once the library is called by one of the triggering events implemented in its code, it reads a configuration file from a shared Google Document. If it is not able to connect to the address, it uses a hardcoded one
MITRE ATT&CK techniques:
- T1565.002: Data Manipulation - Transmitted Data Manipulation
Threat description: The threat actor connected via Remote Desktop from a Domain Controller to a vCenter server and opened a PowerShell console, then used the PowerShell command -ep bypass to circumvent the execution policy. Using the Windows Azure Active Directory PowerShell Module, the threat actor connected to the victim’s O365 tenant and began performing enumeration queries
MITRE ATT&CK techniques:
- T1087.002: Account Discovery - Domain Account
- T1482: Domain Trust Discovery
Threat description: After the payload execution it reaches out to the C2 via POST request as shown below
MITRE ATT&CK techniques:
- T1071.001: Application Layer Protocol - Web Protocols
Threat description: All RDAT samples have malicious verdicts in WildFire and have protections in place through Cortex XDR. DNS tunneling protocols used for C2 communications are blocked via DNS Security. All C2 domains are classified as Command-and-Control for URL Filtering. AutoFocus customers can monitor activity via the rdat_backdoor tag
MITRE ATT&CK techniques:
- T1132.001: Data Encoding - Standard Encoding
- T1132.002: Data Encoding - Non-Standard Encoding
Threat description: Endpoint Protection . The Trojan.Hydraq Incident . It has been about a week since news of the mysterious Hydraq Trojan (also known as Aurora) attack broke with the unveiling of a threat by Google to pull its operations out of China. In addition the blog also mentioned that a host of other large corporations were also targets of this same attack. In this attack a PDF file was used to exploit the Adobe Acrobat, Reader, and Flash Player Remote Code Execution Vulnerability (CVE-2009-1862/BID35759). This PDF installed a Trojan horse which was an earlier version of the current Trojan.Hydraq. Considering the efforts that the attackers put into staging the attack as a whole, the end malware is not so sophisticated. Download a remote file, save it as %Temp%\mdm.exe, and then execute it. This means the remote attacker has the ability to see in real time any user interface activity as if they were sitting right next to the user. As described in the previously posted blog (Hydraq - An Attack of Mythical Proportions), an unpatched Internet Explorer vulnerability (BID 37815) was used as one of the propagation vectors for this particular Trojan.Hydraq attack. This security hole allows remote exploitation, which means that attackers can run any malicious code of their liking on a victim’s machine by taking advantage of the vulnerability. Prevention &amp; Mitigation Trojan.Hydraq has been known to be spread through specially crafted PDF files and also through malicious Web sites. The attacker can exploit this issue by supplying a malicious Flash ('.swf') file or by embedding a malicious Flash application in a PDF file
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: FireEye has dubbed the cybercrime gang FIN5. One of the most unique things about FIN5 is that in every intrusion we responded to where FIN5 has been active, legitimate access was identified. They had valid user credentials to remotely log into the network," said Barry Vengerik, principal threat analyst at FireEye. No sexy zero-days, no remote exploits -- not even spearphishing
MITRE ATT&CK techniques:
- T1110: Brute Force
Threat description: It looks like GrowlHelper creates an executable named Software Update Check when it thinks it’s online. I was pretty excited when I first found this, but quickly realized it just drops a copy of itself with a different name
MITRE ATT&CK techniques:
- T1036.004: Masquerading - Masquerade Task or Service
Threat description: FireEye assesses APT33 may be behind a series of intrusions and attempted intrusions within the engineering industry. FireEye's Managed Defense has responded to and contained numerous intrusions that we assess are related. The actor is leveraging publicly available tools in early phases of the intrusion; however, we have observed them transition to custom implants in later stage activity in an attempt to circumvent our detection
MITRE ATT&CK techniques:
- T1552.006: Unsecured Credentials - Group Policy Preferences
- T1003.001: OS Credential Dumping - LSASS Memory
- T1555.003: Credentials from Password Stores - Credentials from Web Browsers
- T1003.004: OS Credential Dumping - LSA Secrets
- T1588.002: Obtain Capabilities - Tool
- T1555: Credentials from Password Stores
- T1552.001: Unsecured Credentials - Credentials In Files
- T1003.005: OS Credential Dumping - Cached Domain Credentials
Threat description: PowerPunch also provides an excellent example of this. The key is applied to an executable payload downloaded directly from adversary infrastructure, allowing for an encryption key unique to the target host (highlighted variables names were changed for clarity
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: The attackers manually send a command to the JS or C# component to drop and execute a batch file from one of their servers. That batch file writes a malicious INF file and supplies it as a parameter to the Microsoft utility cmstp.exe, which executes a remote scriptlet specified in the INF file. This technique has been documented in the MITRE ATT&amp;CK knowledge base as CMSTP; an example of how this technique is used may be found here. This technique has been used in the past by Cobalt, another financially motivated group. The remote scriptlet contains obfuscated JS code that drops an OCX file and executes it via regsvr32.exe
MITRE ATT&CK techniques:
- T1059.007: Command and Scripting Interpreter - JavaScript
Threat description: cmd.exe /C choice /C Y /N /D Y /T 2 &amp; Del After sleeping, the Trojan will create a GUID and write it to %APPDATA%\Windows\GDI.bin. It then moves itself to %APPDATA%\Windows\WindowsImplantment.exe and sets both of these files to have the hidden and system flags to hide them from the user. With the Trojan moved its final location, it will then create a scheduled task to run a VBScript to make sure it runs persistently. This differs from the previous OopsIE variant that used a hardcoded task name for the scheduled task. This process ultimately attempts to run the Trojan every three minutes, which is important as OopsIE relies on this scheduled task as it does not include a main loop to continue its execution. After creating this scheduled task for persistence, the Trojan will begin communicating with its C2 server. The process in which the Trojan communicates with its C2 server is very similar to the previous OopsIE Trojan that we discussed in our previous blog. Also, the oops string used to signify and erroneous transmission from the C2, which gave OopsIE its name is reversed to spoo. hex(STDOUT of whoami command)&gt; If the C2 server wishes to send a command, it will respond to the beacon above by echoing the whoami command results sent by the Trojan to the C2 in the URL. The command handler in this OopsIE variant is very similar to the previous version, as it contains the same three (1, 2 and 3) commands seen in Table 2
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: In october 2016 Group-IB published the report about the Cobalt group. Network penetration In all cases investigated by Group-IB, the Cobalt group used a set of spear phishing emails to gain initial access to the corporate infrastructure. However, some of the email addresses belong to employees that no longer work at the organization, which means that the Cobalt group likely uses out-of-date mailing lists. However, when there is use of a security policy that prohibits the transfer of encrypted archives, such an email message may be blocked, so the attackers would send .doc files that contain exploits for Microsoft Office (fig. For organizations that perform timely updates of their systems and adhere to strict security policies, the Cobalt group employs another method to deliver malicious code through emails with Word documents containing a malicious macro. Therefore, the Cobalt group registered domains are similar to real ones (for example, diebold.pw), and configured their email server to distribute acting as these legitimate domains (fig. Provision of the malware survivability The Cobalt group uses different methods to ensure malware survivability on corporate networks. From our experience, the Cobalt group uses a new method to provide its survivability in every attack. Additional means of circumventing anti-virus tools include the use of exploits to increase the level of rights and privileges, bypassing UAC, and injecting code into trusted processes. Conclusion After infecting one computer on an organization's network, the Cobalt group analyzes the programs used on it and search for critical servers and the computers from which they are accessed
MITRE ATT&CK techniques:
- T1068: Exploitation for Privilege Escalation
Threat description: The dropped payload is a DLL file that has been packed using the UPX packer. The unpacked sample is highly obfuscated and important API calls and strings have been encrypted using a custom encryption algorithm. Whenever in the code the malware needs to use a string, it takes the encrypted string and passes it into two functions to decrypt it
MITRE ATT&CK techniques:
- T1027.002: Obfuscated Files or Information - Software Packing
Threat description: This document likely marks the first observed use of this technique by APT28. The use of DDE with PowerShell allows an attacker to execute arbitrary code on a victim’s system regardless whether macros are enabled
MITRE ATT&CK techniques:
- T1559.002: Inter-Process Communication - Dynamic Data Exchange
Threat description: POWERTON is a backdoor written in PowerShell; FireEye has not yet identified any publicly available toolset with a similar code base, indicating that it is likely custom-built. POWERTON is designed to support multiple persistence mechanisms, including WMI and auto-run registry key. POWERTON typically gets deployed as a later stage backdoor and is obfuscated several layers
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: A batch file that is used to run Bitsadmin and Rundll to download and execute the Egregor payload. A Zip file contains a binary file that is an RClone client, renamed svchost, and RClone config files (webdav, ftp and dropbox) used later for exfiltration
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: The screenshot above shows an abbreviated view of the in-memory PowerShell backdoor. The PowerShell backdoor has the following capabilities
MITRE ATT&CK techniques:
- T1049: System Network Connections Discovery
- T1027: Obfuscated Files or Information
- T1518: Software Discovery
Threat description: The reason for this is that most of the file comprises meaningless overlay data, since the file is an automatically generated AutoIT executable with an AutoIT3 script embedded inside. Once started, it downloads additional malware from the C2 and also uploads some basic system information, stealing, among other things, the user’s Google Chrome credentials. The backdoor also pings the C2 server at regular intervals. A good security analyst can spot this while analyzing firewall log files and thereby find out that something suspicious might be going on in the network
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: Daserf — This backdoor has the functionality of a remote shell and can be used to execute commands, upload and download data, capture screenshots, and log keystrokes. xxmm (also known as Minzen) — This RAT and likely successor to Daserf AES-encrypts HTTP communications using a one-time encryption key. As of this publication, BRONZE BUTLER demonstrates a preference for concurrently using Datper and xxmm in its operations. T-SMB Scan — This SMB scanning tool was originally published on a Chinese program-sharing website (pudn.com). BRONZE BUTLER removed its help message functionality. Use the ‘at' or ‘schtask' commands to register a scheduled task to be executed in a few minutes. Use malware to upload the large list of enumerated files to the C2 server. Use downloaders or other malware to send the new list to a compromised host. Use an uploader or other malware to send the archived files to an attacker-controlled server. Search proxy log files for evidence of web server scanning using the URL patterns associated with BRONZE BUTLER activity. In particular, review network access for use of mobile USB modems on corporate systems
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: This structure parses out executable scripts from data provided via a remote operator. In this case, the REGEX value indicates this implant will receive scripts compressed (tar files). The malware will then decompress them before executing the embedded script. Analysis indicates the WellMail implant is similar in design and structure to the WellMess implant -- and both accept and execute shell scripts from a remote operator
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: Narrow attacks targeted the Automotive industry among others, while the large malicious spam campaigns appear to be associated with threat actor TA505, an actor responsible for many large-scale attacks since at least 2014
MITRE ATT&CK techniques:
- T1204.002: User Execution - Malicious File
Threat description: We have discovered that malware dubbed WinDealer, spread by Chinese-speaking APT actor LuoYu, has an ability to perform intrusions through a man-on-the-side attack
MITRE ATT&CK techniques:
- T1204.001: User Execution - Malicious Link
- T1566.002: Phishing - Spearphishing Link
- T1566.001: Phishing - Spearphishing Attachment
- T1120: Peripheral Device Discovery
Threat description: The configuration file for Torisma is encrypted using the algorithm VEST[1] in addition to the communication sent over the C2 channel. From our research this encryption method is not commonly used anywhere, in fact it was a proposed cipher that did not become a standard to be implemented in general technologies[2
MITRE ATT&CK techniques:
- T1573.001: Encrypted Channel - Symmetric Cryptography
- T1041: Exfiltration Over C2 Channel
Threat description: In response to historical disclosures detailing TA416 PlugX malware infection and encoding methods, the group appears to have adopted a rapid rate of development for their PlugX payloads. The group uses different legitimate PE files to initiate sideloading, as well as a variety of PlugX DLL loaders including the PotPlayer and DocCon versions noted in this publication. TA416 also uses different variants of the final PlugX payload in which the communication routines are observed to be different when closely analyzed. Additionally, the payload DAT file decryption method has evolved regularly since the beginning of 2022. Several observed decryption schemas and a sample configuration are included below with date ranges detailing the evolution of observed PlugX payloads
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: Usually, after infection the bot sends a ‘PING’ message, ‘SYSTEM INFO’ message and ‘ASK for COMMAND’ message, and the C2 replies with ‘ACK’ and ‘COMMAND’ messages. If additional modules were pushed by the C2, the bot sends a ‘STOLEN INFO’ message containing data stolen by the modules
MITRE ATT&CK techniques:
- T1041: Exfiltration Over C2 Channel
Threat description: 1) An application is bundled with virtualization software, a Linux image and additional files used to achieve persistence. 2) User downloads the application and follows attached instructions on how to install it. 3) LoudMiner is installed first, the actual VST software after. 4) LoudMiner hides itself and becomes persistent on reboot. 5) The Linux virtual machine is launched and the mining starts. 6) Scripts inside the virtual machine can contact the C&amp;C server to update the miner (configuration and binaries
MITRE ATT&CK techniques:
- T1218.007: System Binary Proxy Execution - Msiexec
- T1569.002: System Services - Service Execution
Threat description: Once on the network, the attackers engaged in network reconnaissance and retrieved a list of trusted domains and a list of domain controllers with the following commands
MITRE ATT&CK techniques:
- T1482: Domain Trust Discovery
Threat description: ZxShell.dll is injected in a shared SVCHOST process. The Svchost group registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost is opened and the netsvc group value data is queried to generate a name for the service
MITRE ATT&CK techniques:
- T1055.001: Process Injection - Dynamic-link Library Injection
Threat description: MSTIC has observed NICKEL actors using exploits against unpatched systems to compromise remote access services and appliances. Upon successful intrusion, they have used credential dumpers or stealers to obtain legitimate credentials, which they used to gain access to victim accounts. MSTIC has also observed NICKEL perform frequent and scheduled data collection and exfiltration from victim networks
MITRE ATT&CK techniques:
- T1082: System Information Discovery
- T1614.001: System Location Discovery - System Language Discovery
Threat description: Like any other typical PoS malware, Pillowmint iterates a list of processes and process them two at a time. it uses the API OpenProcess() using the PROCESS_VM_READ and PROCESS_QUERY_INFORMATION flags to obtain a handle then reads the memory’s content via ReadProcessMemory() API two chunks at a time. Depending on the Pillowmint version, it may encrypt the stolen CC data with AES encryption algorithm + Base64. This is then written to a file named "ldb_e.log" in Windows System directory
MITRE ATT&CK techniques:
- T1106: Native API
Threat description: Along with the EDRPOU numbers, the backdoor collects proxy and email settings, including usernames and passwords, from the M.E.Doc application
MITRE ATT&CK techniques:
- T1087.003: Account Discovery - Email Account
Threat description: Kimsuky is a highly motivated threat actor targeting a number of entities in South Korea. This group has been relentlessly creating new infection chains to deliver different types of malware to their victims. Such targeted attacks can result in the leak of restricted research, unauthorized access for espionage and even destructive attacks against target organizations
MITRE ATT&CK techniques:
- T1588.002: Obtain Capabilities - Tool
Threat description: Once the Bazar loader downloads its payload, the Bazar backdoor, it is decrypted using the same method as the aforementioned Team9 variant
MITRE ATT&CK techniques:
- T1104: Multi-Stage Channels
Threat description: For the investigators at NCC Group and Fox-IT these pieces of evidence supported the hypothesis of the adversary achieving credentials access by brute force, and more specifically by credential stuffing or password spraying
MITRE ATT&CK techniques:
- T1589.001: Gather Victim Identity Information - Credentials
Threat description: After loading its configuration data, GoldMax checks the current date-time value of the compromised system against the activation date from the configuration data
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
- T1124: System Time Discovery
- T1497.003: Virtualization/Sandbox Evasion - Time Based Evasion
Threat description: Once the VBScript in XSL has been run, console commands launched by the JS code continue to be executed. Three files are copied into the folder OFFICE12 that was created in the user profile. Those files are
MITRE ATT&CK techniques:
- T1220: XSL Script Processing
Threat description: POSHSPY makes the most of using built-in Windows features – so-called “living off the land” – to make an especially stealthy backdoor. POSHSPY's use of WMI to both store and persist the backdoor code makes it nearly invisible to anyone not familiar with the intricacies of WMI. Its use of a PowerShell payload means that only legitimate system processes are utilized and that the malicious code execution can only be identified through enhanced logging or in memory. The backdoor's infrequent beaconing, traffic obfuscation, extensive encryption and use of geographically local, legitimate websites for command and control (C2) make identification of its network traffic difficult. Every aspect of POSHSPY is efficient and covert
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
Threat description: The attack typically begins with an attempt – most probably via a spearphishing email – to lure the intended victim into running the malicious dropper, which is attached to the email. In order to increase the likelihood that the unsuspecting victim will actually click on it, the malicious executable masquerades as a document or spreadsheet by displaying a fake icon
MITRE ATT&CK techniques:
- T1204.002: User Execution - Malicious File
- T1566.001: Phishing - Spearphishing Attachment
Threat description: From the main function, the malware invokes a function named eiht_get_update. This function attempts to read a remote file (ret.txt) from andrewka6.pythonanywhere.com that contained the address of the remote command and control server. If that failed, the malware would default to using the hard-coded (albeit encrypted) IP address 167.71.237.219. In order to gather information about the infected host, it invokes a function named: ei_get_host_info …which in turn invokes various macOS APIs such as getlogin and gethostname
MITRE ATT&CK techniques:
- T1620: Reflective Code Loading
Threat description: After analyzing the final payload, we determined the winner was… a Remote Administration Tool, which we have named ROKRAT. The address used in the email was 'kgf2016@yonsei.ac.kr' which is the contact email of the Korea Global Forum where the slogan in 2016 was "Peace and Unification of the Korean Peninsula". This fact gives more credit and legitimacy to the email. This file is decoded and finally an executable is launched: ROKRAT. This RAT has the added complexity that the command and control servers are legitimate websites. The malware uses Twitter and two cloud platforms, Yandex and Mediafire, apparently for both C2 communications and exfiltration platforms. Unfortunately, these platforms are difficult to block globally within organizations as their use can be viewed as legitimate in most cases. Additionally, these 3 platforms all make use of HTTPS connectivity, making it much more difficult to identify specific patterns or the usage of specific tokens
MITRE ATT&CK techniques:
- T1102.002: Web Service - Bidirectional Communication
Threat description: Skip to main content . We use optional cookies to improve your experience on our websites, such as through social media connections, and to display personalized advertising based on your online activity. If you reject optional cookies, only cookies necessary to provide you the services will be used. Using reg to configure the registry of remote computers limits the parameters that you can use in some operations. Check the syntax and parameters for each operation to verify that they can be used on remote computers . In this article
MITRE ATT&CK techniques:
- T1112: Modify Registry
- T1012: Query Registry
Threat description: Daserf — This backdoor has the functionality of a remote shell and can be used to execute commands, upload and download data, capture screenshots, and log keystrokes. It uses RC4 encryption and custom Base64 encoding to obfuscate HTTP traffic. xxmm (also known as Minzen) — This RAT and likely successor to Daserf AES-encrypts HTTP communications using a one-time encryption key. As of this publication, BRONZE BUTLER demonstrates a preference for concurrently using Datper and xxmm in its operations. Source: Secureworks) - xxmm downloader (also known as KVNDM) — This simple downloader's code is similar to the main xxmm payload. MSGet — This persistent downloader uses a dead-drop resolver (DDR) to download and execute another malicious payload. MSGet typically downloads encoded binaries from hard-coded URLs. DGet — This simple downloader (see Figure 4) is similar to the wget web server retrieval tool. T-SMB Scan — This SMB scanning tool was originally published on a Chinese program-sharing website (pudn.com). BRONZE BUTLER removed its help message functionality. Search proxy log files for evidence of web server scanning using the URL patterns associated with BRONZE BUTLER activity
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: The SodomMain module is LookBack malware’s remote access Trojan module that can send and receive numerous commands indicative of its function as a RAT. The malware is delivered within the encoded data that is received by the SodomNormal module as part of its initial beacon response. It then runs within the SodomNormal module and uses its “send_data” function for C&amp;C communications
MITRE ATT&CK techniques:
- T1574.002: Hijack Execution Flow - DLL Side-Loading
Threat description: Daserf — This backdoor has the functionality of a remote shell and can be used to execute commands, upload and download data, capture screenshots, and log keystrokes. xxmm (also known as Minzen) — This RAT and likely successor to Daserf AES-encrypts HTTP communications using a one-time encryption key. As of this publication, BRONZE BUTLER demonstrates a preference for concurrently using Datper and xxmm in its operations. Source: Secureworks) - Screen Capture Tool— This tool can capture the desktop of a victim's system (see Figure 5). Figure 5. Screen Capture Tool usage. Source: Secureworks) - RarStar — This custom tool uploads RAR archives to a specified URL as POST data (see Figure 6). RarStar encodes the POST data using Base64 and a custom XOR algorithm. T-SMB Scan — This SMB scanning tool was originally published on a Chinese program-sharing website (pudn.com). BRONZE BUTLER removed its help message functionality. WinRAR — This tool extracts tools for lateral movement and compresses data for exfiltration. Search proxy log files for evidence of web server scanning using the URL patterns associated with BRONZE BUTLER activity. Install a background monitor tool (e.g
MITRE ATT&CK techniques:
- T1113: Screen Capture
Threat description: The shellcode then creates a string that it uses to create a registry key to automatically run the final payload each time the system starts. It then opens the registry key 'Software\Microsoft\Windows NT\CurrentVersion\Winlogon' and sets the value to the "Shell" subkey to the previously created string. Ultimately, the following registry key is created for persistence
MITRE ATT&CK techniques:
- T1547.014: Boot or Logon Autostart Execution - Active Setup
- T1547.004: Boot or Logon Autostart Execution - Winlogon Helper DLL
Threat description: We at Team Nautilus detected and analyzed the Docker Hub account hildeteamtnt, which was used by TeamTNT to store their malicious images. Also, ‘minerescape’ contained a shell script executing a Python file - minedaemon.py. Using a web service (iplogger[.]org) to transmit collected data to the attacker during the discovery process, for instance, the number of cores in the CPU, its speed, system details (using uname -a), and targeted host IP address. Logging the activity and encoding it into files (using Base64). The script sbs.sh: - Downloading 00.jpg (as /usr/bin/dns_ipv4.tar.gz) which is the file /usr/bin/bioset. Creating a child process that listens to the socket and communicates with the father using a method called ‘Named PIPE’ (also known as FIFO). The father is responsible for deciphering messages and writing it back to the child on the PIPE. Creating a child process that listens to the socket and communicates with the father using a method called ‘Named PIPE’ (also known as FIFO). - The father is responsible for deciphering messages and writing it back to the child on the PIPE. Logging the activity and encoding it into files (using Base64). - Defense Evasion: Deleting command history. Logging the activity and encoding it into files (using Base64). Defense Evasion Techniques: Removing system logs (/var/log/syslog). Deleting command history. Logging the activity and encoding it into files (using Base64). - Defense Evasion Techniques: Removing system logs (/var/log/syslog). Deleting command history. Encoding many snippets with base64 (the same snippet may be encoded multiple times). To sum it up . Over four months, TeamTNT uploaded various images, with some being used to perform attacks in the wild
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: In September 2017, Proofpoint researchers detailed the history and ongoing activities of an actor we track as TA505. TA505 was behind many of the Dridex campaigns that plagued organizations in 2015 and introduced Locky ransomware in 2016, bringing unprecedented scale to malicious spam distribution. Since we wrote our original TA505 profile, the actor has continued to explore the use of new malicious attachments and new payloads. In 2018, though, the scale and regularity of their campaigns decreased, while the diversity of payloads has increased. Given the importance of this actor in the email threat landscape we wanted to revisit our profile and update it with the latest activity from TA505
MITRE ATT&CK techniques:
- T1566.001: Phishing - Spearphishing Attachment
Threat description: FIN6 used encoded PowerShell commands to install Cobalt Strike on compromised systems. The attacker made use of Cobalt Strike’s “psexec” lateral movement command to create a Windows service named with a random 16-character string on the target system and execute encoded PowerShell. In some cases, the encoded PowerShell commands were used to download and execute content hosted on the paste site hxxps://pastebin[.]com
MITRE ATT&CK techniques:
- T1102: Web Service
- T1569.002: System Services - Service Execution
Threat description: At this point, the script establishes an HTTP connection to the C2 server. If the server response is comprised only of the same GUID that the malware sent, the script deletes itself. In the case of the second-stage script from Variant A, the script deletes the registry key where it is installed. In the case of Variant C, the script deletes the file from which it is running. If instead the server responds with any data other than the GUID, the second-stage script decrypts the data and saves it as a file
MITRE ATT&CK techniques:
- T1070: Indicator Removal
- T1070.004: Indicator Removal - File Deletion
Threat description: Since the original publication of this approach, Proofpoint researchers have observed a number of actors -- “early adopters” -- abusing this file format by embedding it inside Microsoft Word and PDF documents. While the combination of the technique with the Microsoft Word container was described in the initial research, embedding inside PDFs has not been documented and likely originated with another source
MITRE ATT&CK techniques:
- T1204.002: User Execution - Malicious File
- T1204.001: User Execution - Malicious Link
Threat description: Watering holes - Weaponized documents exploiting the Dynamic Data Exchange (DDE) method - Weaponized documents exploiting the CVE-2018-0798 vulnerability in Equation Editor - Exploitation of the CVE-2019-0604 vulnerability in Sharepoint - Supply chain attack that compromises a chat software installer, Able Desktop - Exploitation of recent vulnerabilities (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065) in Microsoft Exchange Server
MITRE ATT&CK techniques:
- T1195.002: Supply Chain Compromise - Compromise Software Supply Chain
- T1190: Exploit Public-Facing Application
Threat description: This variant has exactly the same features as the previous variant: file listing, OS version getting, process killing, drive listing, execution via ShellExecuteW(), execution via named pipe, cleaning, file removal, file downloading. Here is an example of code similarities on the execution via named pipe function. On the left a sample from Bisonal 2014 and on the right Bisonal 2011
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: Despite the simplicity of most of their tools, the Gamaredon group also is capable of deploying some novelty, such as their Outlook VBA module. However, as it is far from stealthy, in the long run it is no match for a capable organization. The variety of tools Gamaredon has at its disposal can be very effective at fingerprinting a machine and understanding what sensitive data is available, then spreading throughout the network
MITRE ATT&CK techniques:
- T1025: Data from Removable Media
Threat description: Check for blocklisted usernames and computernames: The implant concatenates the username and computer it acquires from the infected endpoint's environment variables. This string is then checked against a list of blocklisted values to determine if the implant should continue execution or exit out. Check for blocklisted process names: The following process names are blocklisted and if found running on the system, the RAT implant will simply exit. The blocklist consists of processes belonging to Virtual Machine software (such as VMWare) and analysis tools (such as ProcessHacker etc
MITRE ATT&CK techniques:
- T1497.001: Virtualization/Sandbox Evasion - System Checks
- T1082: System Information Discovery
- T1033: System Owner/User Discovery
- T1057: Process Discovery
Threat description: It also creates a unique system specific identifier that it will use during the C2 communications to send and receive messages. The system specific identifier is a 16 character string that the Trojan creates using the serial number of the C volume and the first 4 hexadecimal bytes from Environment.UserName
MITRE ATT&CK techniques:
- T1071.003: Application Layer Protocol - Mail Protocols
Threat description: This document uses KernelCallbackTable as well to hijack the control flow just like our first module, the injection technique used by the shellcode also resembles the first document. The major difference in this document is that it tries to retrieve a remote HTML page and then executes it using mshta.exe. The remote HTML page is located at https[:]//markettrendingcenter[.]com/member.htm and throws a 404 Not Found which makes it difficult for us to analyze this document any further
MITRE ATT&CK techniques:
- T1218.005: System Binary Proxy Execution - Mshta
Threat description: 2) Download the OpenSSL library. Instead of saving the downloaded file, QakBot measures the download speed and deletes the received file
MITRE ATT&CK techniques:
- T1016.001: System Network Configuration Discovery - Internet Connection Discovery
Threat description: This script is executed and is used to decode a static base64 string within the strEncode variable. Using base64 encoding the decoded binary is stored as HncModuleUpdate.exe and is then executed. This specific resource contains malicious shellcode used by the malware. These execution steps allow the launch of the new ROKRAT variant by decoding the PE binary and injecting into the cmd.exe process
MITRE ATT&CK techniques:
- T1059.005: Command and Scripting Interpreter - Visual Basic
Threat description: In their example, the OilRig group used a malicious macro document to deliver the backdoor, which is a tactic much more commonly used by them. A closer examination revealed the obfuscation used by the OilRig group in these QUADAGENT samples were likely the result of using an open-source toolkit called Invoke-Obfuscation. Invoke-Obfuscation has proven to be highly effective at obfuscating PowerShell scripts and in this case, the adversary was able to take advantage of the tool for increased chances of evasion and as an anti-analysis tactic. Based on our telemetry, we have high confidence the email account used to launch this attack was compromised by the OilRig group, likely via credential theft. The malicious attachment was a simple PE file (SHA256: 5f001f3387ddfc0314446d0c950da2cec4c786e2374d42beb3acce6883bb4e63) with the filename &lt;redacted&gt; Technical Services.exe. Its sole purpose here is to install the QUADAGENT backdoor and execute it. Once the victim downloads and executes the email attachment, it runs silently with no additional decoy documents or decoy dialog boxes. The executable will drop the packaged QUADAGENT PowerShell script using the filename Office365DCOMCheck.ps1 in addition to a VBScript file with the same filename which will assist in the execution of it. Once the QUADAGENT payload has executed, it will use rdppath[.]com as the C2, first via HTTPS, then HTTP, then via DNS tunneling, each being used as a corresponding fallback channel if the former fails
MITRE ATT&CK techniques:
- T1204.001: User Execution - Malicious Link
Threat description: From our analysis, stealing keystrokes is the main function of RunningRat; however, the DLL has code for more extensive functionality. Code is included to copy the clipboard, delete files, compress files, clear event logs, shut down the machine, and much more. However, our current analysis shows no way for such code to be executed
MITRE ATT&CK techniques:
- T1070.001: Indicator Removal - Clear Windows Event Logs
- T1070.004: Indicator Removal - File Deletion
Threat description: BackdoorDiplomacy is a group that primarily targets diplomatic organizations in the Middle East and Africa, and less frequently, telecommunication companies. Their initial attack methodology is focused on exploiting vulnerable internet-exposed applications on webservers, in order to drop and execute a webshell. Post compromise, via the webshell, BackdoorDiplomacy deploys open-source software for reconnaissance and information gathering, and favors the use of DLL search order hijacking to install its backdoor, Turian. Finally, BackdoorDiplomacy employs a separate executable to detect removable media, likely USB flash drives, and copy their contents to the main drive’s recycle bin
MITRE ATT&CK techniques:
- T1574.001: Hijack Execution Flow - DLL Search Order Hijacking
Threat description: It will use an auto-run registry (HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run) named AdobeMX that will execute PowerShell to load the encoded executable via reflective loading (loading an executable from memory rather than from the system’s disks
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
Threat description: Change file owner and group. This utility is used by malware to change the user ID and/or the group ID of the specified files. This can lock other users’ out of access to the file, thus hampering removal or inspection. It may also be required in order to execute a file in certain, elevated context
MITRE ATT&CK techniques:
- T1562.001: Impair Defenses - Disable or Modify Tools
Threat description: The iContact binary appears to be a backdoor that gathers user and locale data and engages in encrypted communications with a C2 server over TCP. Functionality includes sending and receiving files and running custom commands such as scanning a directory and deleting files
MITRE ATT&CK techniques:
- T1005: Data from Local System