Update Malware analysis 09-09-19.md
This commit is contained in:
StrangerealIntel
GitHub
parent
7a5e948d0e
commit
1d043f7b55
@ -1,7 +1,6 @@
|
|||||||
# [Update] New samples, same TTPs and accounts
|
# [Update] New samples, same TTPs and accounts
|
||||||
## Table of Contents
|
## Table of Contents
|
||||||
* [Malware analysis](#Malware-analysis)
|
* [Malware analysis](#Malware-analysis)
|
||||||
+ [Initial vector](#Initial-vector)
|
|
||||||
* [Cyber Threat Intel](#Cyber-Threat-Intel)
|
* [Cyber Threat Intel](#Cyber-Threat-Intel)
|
||||||
* [Indicators Of Compromise (IOC)](#IOC)
|
* [Indicators Of Compromise (IOC)](#IOC)
|
||||||
* [References MITRE ATT&CK Matrix](#Ref-MITRE-ATTACK)
|
* [References MITRE ATT&CK Matrix](#Ref-MITRE-ATTACK)
|
||||||
@ -11,10 +10,9 @@
|
|||||||
+ [Documents](#Documents)
|
+ [Documents](#Documents)
|
||||||
|
|
||||||
## Malware analysis <a name="Malware-analysis"></a>
|
## Malware analysis <a name="Malware-analysis"></a>
|
||||||
### Initial vector <a name="Initial-vector"></a>
|
###### The initial vector is an VBA macro from a Maldoc. This use two functions for obfuscated the main command.
|
||||||
###### The initial vector is an VBA macro from an Maldoc, this use two functions for obfuscated the main command.
|
|
||||||
|
|
||||||
###### Once this removed, we can see that use the only command is mshta for invoke the loader.
|
###### Once this removed, we can see that use the only command is mshta for invoke the loader.
|
||||||
|
|
||||||
###### This web page use unescape (4 times) for use again mshta and redirect on the first pastebin.
|
###### This web page use unescape (4 times) for use again mshta and redirect on the first pastebin.
|
||||||
|
|
||||||
@ -22,25 +20,37 @@
|
|||||||
|
|
||||||
###### The first pastebin use again the escape function (and like all at pastebin shares).The first command of the Visual Basic script is to kill the following process (Word, Excel, Publisher and Powerpoint).
|
###### The first pastebin use again the escape function (and like all at pastebin shares).The first command of the Visual Basic script is to kill the following process (Word, Excel, Publisher and Powerpoint).
|
||||||
|
|
||||||
###### The second command create a persistence using another mshta for initate to to close the hidden window.
|
###### The second command create a persistence using another mshta for initiate to close the hidden window.
|
||||||
|
|
||||||
###### The third command execute a loader with two new pastebins.
|
###### The third command execute a loader with two new pastebins.
|
||||||
|
|
||||||
###### The first share is a script using an array and the getbytes function for obfuscate the payload on two layers.
|
###### The first share is a script using an array and the getbytes function for obfuscate the payload on two layers.
|
||||||
|
|
||||||
|
|
||||||
###### This execute a dll for load the second PE. This dll is the same than the last analysis and is use as protector ConfuserEx.
|
###### This executes a dll for load the second PE. This dll is the same than the last analysis and is used as protector ConfuserEx.
|
||||||
|
|
||||||
###### The second Pastebin content the data to split for the second PE.
|
###### The second Pastebin content the data to split for the second PE.
|
||||||
|
|
||||||
###### The second PE load the old Delphi Azorult Stealer. We can confirm it in seeing quickly some features, here read the ihformations about the keyboard :
|
###### The second PE load the old Delphi AZORult Stealer. We can confirm it in seeing quickly some features, here read the informations about the keyboard :
|
||||||
|
|
||||||
|
###### We can observe too that malware can research the current wallets.
|
||||||
|
|
||||||
|
###### This uses an XOR operation with a 3-byte key for encrypting data to sent to the C&C server.
|
||||||
|
|
||||||
|
###### This can get a screenshot of the computer too.
|
||||||
|
|
||||||
## Cyber kill chain <a name="Cyber-kill-chain"></a>
|
## Cyber kill chain <a name="Cyber-kill-chain"></a>
|
||||||
###### The process graph resume the cyber kill chain used by the attacker.
|
###### The process graph resume the cyber kill chain used by the attacker.
|
||||||
|
|
||||||
## Cyber Threat Intel <a name="Cyber-Threat-Intel"></a>
|
## Cyber Threat Intel <a name="Cyber-Threat-Intel"></a>
|
||||||
|
###### The TTPs are the same that the last analysis of the group, this time, this uses the old version of the AZORult (Delphi instead of C++).
|
||||||
|
###### The fact to have a pastebin at each step of the operation is interesting for see the rate of the success and see if the operation is probably discovered.
|
||||||
|
###### The two accounts used for the operation are the same that the last sample spotted and are linked as accounts of the APT group.
|
||||||
|
|
||||||
|
|
||||||
|
###### The last interesting thing is that the sample is spotted the 10 September 2019, we can see that the pastebins are the last time edited on the 9 September and in going on the opendir of the panel, we can see multiple panels for theirs operations was implemented at the last moments and show that not prepared for a special event.
|
||||||
|
|
||||||
|
|
||||||
## References MITRE ATT&CK Matrix <a name="Ref-MITRE-ATTACK"></a>
|
## References MITRE ATT&CK Matrix <a name="Ref-MITRE-ATTACK"></a>
|
||||||
###### List of all the references with MITRE ATT&CK Matrix
|
###### List of all the references with MITRE ATT&CK Matrix
|
||||||
|
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user