2019-10-29 15:21:13 +00:00
|
|
|
# A Look into the Lazarus Group's Operations in October 2019
|
2019-10-23 09:35:54 +00:00
|
|
|
## Table of Contents
|
|
|
|
|
* [Malware analysis](#Malware-analysis)
|
|
|
|
|
* [Cyber kill chain](#Cyber-kill-chain)
|
|
|
|
|
* [Indicators Of Compromise (IOC)](#IOC)
|
|
|
|
|
* [References MITRE ATT&CK Matrix](#Ref-MITRE-ATTACK)
|
|
|
|
|
* [Links](#Links)
|
|
|
|
|
+ [Original Tweet](#Original-Tweet)
|
|
|
|
|
+ [Link Anyrun](#Links-Anyrun)
|
|
|
|
|
+ [External analysis](#Analysis)
|
|
|
|
|
|
|
|
|
|
## Malware analysis <a name="Malware-analysis"></a>
|
|
|
|
|
## Cyber kill chain <a name="Cyber-kill-chain"></a>
|
|
|
|
|
###### The process graphs resume all the cyber kill chains used by the attacker.
|
|
|
|
|
![alt text]()
|
|
|
|
|
## References MITRE ATT&CK Matrix <a name="Ref-MITRE-ATTACK"></a>
|
|
|
|
|
###### List of all the references with MITRE ATT&CK Matrix
|
|
|
|
|
|
|
|
|
|
|Enterprise tactics|Technics used|Ref URL|
|
|
|
|
|
| :---------------: |:-------------| :------------- |
|
|
|
|
|
|
|
|
|
|
## Indicators Of Compromise (IOC) <a name="IOC"></a>
|
|
|
|
|
###### List of all the Indicators Of Compromise (IOC)
|
|
|
|
|
|Indicator|Description|
|
|
|
|
|
| ------------- |:-------------:|
|
|
|
|
|
|
|
|
|
|
###### This can be exported as JSON format [Export in JSON]()
|
|
|
|
|
## Links <a name="Links"></a>
|
|
|
|
|
###### Original tweet:
|
|
|
|
|
* [https://twitter.com/RedDrip7/status/1186562944311517184](https://twitter.com/RedDrip7/status/1186562944311517184) <a name="Original-Tweet"></a>
|
2019-10-29 15:21:13 +00:00
|
|
|
* [https://twitter.com/Rmy_Reserve/status/1188235835956551680](https://twitter.com/Rmy_Reserve/status/1188235835956551680)
|
|
|
|
|
* [https://twitter.com/a_tweeter_user/status/1188811977851887616](https://twitter.com/a_tweeter_user/status/1188811977851887616)
|
|
|
|
|
* [https://twitter.com/spider_girl22/status/1187288313285079040](https://twitter.com/spider_girl22/status/1187288313285079040)
|
|
|
|
|
* [https://twitter.com/objective_see/status/1187094701729443840](https://twitter.com/objective_see/status/1187094701729443840)
|
2019-10-23 09:35:54 +00:00
|
|
|
###### Links Anyrun: <a name="Links-Anyrun"></a>
|
|
|
|
|
* [6850189bbf5191a76761ab20f7c630ef.xls](https://app.any.run/tasks/27ea35e6-6211-468d-9b8a-8c4cf22764ce)
|
2019-10-29 15:21:13 +00:00
|
|
|
* [JD-HAL-Manager.doc](https://app.any.run/tasks/42c972b1-ec38-4637-9354-9de930ff50b2)
|
|
|
|
|
* [public.dll](https://app.any.run/tasks/9eb78213-df55-44c3-9465-e58eb0869e58)
|
|
|
|
|
* [CES2020 참관단.hwp](https://app.any.run/tasks/31be34b3-4d72-4831-8b76-6dfebe729b84)
|
|
|
|
|
* [6850189bbf5191a76761ab20f7c630ef.xls](https://app.any.run/tasks/a766e70e-b07f-4a59-80fb-b18597d85b08)
|
|
|
|
|
|
2019-10-23 09:35:54 +00:00
|
|
|
###### External analysis: <a name="Analysis"></a>
|
2019-10-29 15:21:13 +00:00
|
|
|
|
2019-10-23 09:35:54 +00:00
|
|
|
* [Analysis of Powershell malware of Lazarus group](https://blog.alyac.co.kr/2388 )
|
2019-10-29 15:21:13 +00:00
|
|
|
* [Cryptocurrency businesses still being targeted by Lazarus](https://securelist.com/cryptocurrency-businesses-still-being-targeted-by-lazarus/90019/)
|
|
|
|
|
|
