From 1d043f7b55291bed640dd48f64ae1130f97b32db Mon Sep 17 00:00:00 2001
From: StrangerealIntel <54320855+StrangerealIntel@users.noreply.github.com>
Date: Fri, 13 Sep 2019 00:58:35 +0200
Subject: [PATCH] Update Malware analysis 09-09-19.md
---
.../09-09-19/Malware analysis 09-09-19.md | 28 +++++++++++++------
1 file changed, 19 insertions(+), 9 deletions(-)
diff --git a/Pakistan/APT/Gorgon/09-09-19/Malware analysis 09-09-19.md b/Pakistan/APT/Gorgon/09-09-19/Malware analysis 09-09-19.md
index 6c94302..2685635 100644
--- a/Pakistan/APT/Gorgon/09-09-19/Malware analysis 09-09-19.md
+++ b/Pakistan/APT/Gorgon/09-09-19/Malware analysis 09-09-19.md
@@ -1,7 +1,6 @@
# [Update] New samples, same TTPs and accounts
## Table of Contents
* [Malware analysis](#Malware-analysis)
- + [Initial vector](#Initial-vector)
* [Cyber Threat Intel](#Cyber-Threat-Intel)
* [Indicators Of Compromise (IOC)](#IOC)
* [References MITRE ATT&CK Matrix](#Ref-MITRE-ATTACK)
@@ -11,10 +10,9 @@
+ [Documents](#Documents)
## Malware analysis
-### Initial vector
-###### The initial vector is an VBA macro from an Maldoc, this use two functions for obfuscated the main command.
+###### The initial vector is an VBA macro from a Maldoc. This use two functions for obfuscated the main command.
-###### Once this removed, we can see that use the only command is mshta for invoke the loader.
+###### Once this removed, we can see that use the only command is mshta for invoke the loader.
###### This web page use unescape (4 times) for use again mshta and redirect on the first pastebin.
@@ -22,25 +20,37 @@
###### The first pastebin use again the escape function (and like all at pastebin shares).The first command of the Visual Basic script is to kill the following process (Word, Excel, Publisher and Powerpoint).
-###### The second command create a persistence using another mshta for initate to to close the hidden window.
+###### The second command create a persistence using another mshta for initiate to close the hidden window.
###### The third command execute a loader with two new pastebins.
###### The first share is a script using an array and the getbytes function for obfuscate the payload on two layers.
-###### This execute a dll for load the second PE. This dll is the same than the last analysis and is use as protector ConfuserEx.
+###### This executes a dll for load the second PE. This dll is the same than the last analysis and is used as protector ConfuserEx.
###### The second Pastebin content the data to split for the second PE.
-###### The second PE load the old Delphi Azorult Stealer. We can confirm it in seeing quickly some features, here read the ihformations about the keyboard :
+###### The second PE load the old Delphi AZORult Stealer. We can confirm it in seeing quickly some features, here read the informations about the keyboard :
-
-
+###### We can observe too that malware can research the current wallets.
+
+###### This uses an XOR operation with a 3-byte key for encrypting data to sent to the C&C server.
+
+###### This can get a screenshot of the computer too.
+
## Cyber kill chain
###### The process graph resume the cyber kill chain used by the attacker.
## Cyber Threat Intel
+###### The TTPs are the same that the last analysis of the group, this time, this uses the old version of the AZORult (Delphi instead of C++).
+###### The fact to have a pastebin at each step of the operation is interesting for see the rate of the success and see if the operation is probably discovered.
+###### The two accounts used for the operation are the same that the last sample spotted and are linked as accounts of the APT group.
+
+
+###### The last interesting thing is that the sample is spotted the 10 September 2019, we can see that the pastebins are the last time edited on the 9 September and in going on the opendir of the panel, we can see multiple panels for theirs operations was implemented at the last moments and show that not prepared for a special event.
+
+
## References MITRE ATT&CK Matrix
###### List of all the references with MITRE ATT&CK Matrix