6.4 KiB
6.4 KiB
Analysis of the new TA505 campaign
Table of Contents
- Malware analysis
- Cyber Threat Intel
- Indicators Of Compromise (IOC)
- References MITRE ATT&CK Matrix
- Links
Malware analysis
Current loader used by the group
The inital vector is a malicious excel file who used a XLM macro (macro v4). This use an function for launch the payload when the excel windows is active (selected as primary window). As first action, this execute the module 1.
The function call in Module 1 create a Wscript object for change the current directory, show the fake message and push debug messages.
The userform execute the extract and execute a different PE instead of the architecture of the victim (x86 and x64).
As anti-forensic technique, this delete the files by call of kill functions.
We can note that a function is unused and seem to be a rest of the development of the macro.
The implant executed push all in memory with a call of VirtualAlloc function.
Once this, this check the system informations, the process executed on the computer and try to detect if this run in a sandbox (low size of the disk).
This send the informations to the C2 and wait the next instruction of the group.
We can list the informations send in the following variables :
| Variables | Description |
|---|---|
| &D= | Name of the computer |
| &U= | Name of the user |
| &OS= | Version of the OS |
| &PR= | List of process (separed by %7C) |
And is presented this way (extracted from sandbox):
&D=User-PC&U=admin&OS=6.1&PR=Dwm.exe%7CEXCEL.EXE%7CExplorer.EXE%7Ctaskhost.exe%7Cwindanr.exe%7C
That interesting to note that the group get only the process for see if the victim have security messures (AV, endpoint...) before launch the next step, that can be in the logic of the lastest analysis of the group to used clop ransomware.
The change currently the trust certificate for bypass the security messures, we can observed on the analysis of VK_Intel :
- https://twitter.com/VK_Intel/status/1162810558774747137
- https://twitter.com/VK_Intel/status/1157761784582983685
- https://twitter.com/VK_Intel/status/1157742218549039105
- https://twitter.com/VK_Intel/status/1155381658746589185
- https://twitter.com/VK_Intel/status/1145041163839266823
- https://twitter.com/VK_Intel/status/1136069755222335490
Cyber kill chain
The process graphs resume all the cyber kill chains used by the attacker.
References MITRE ATT&CK Matrix
List of all the references with MITRE ATT&CK Matrix
| Enterprise tactics | Technics used | Ref URL |
|---|---|---|
Indicators Of Compromise (IOC)
List of all the Indicators Of Compromise (IOC)
| Indicator | Description |
|---|---|
| Domain requested | |
| IP requested | |
| HTTP/HTTPS requests | |
| Domain C2 | |
| IP C2 |
This can be exported as JSON format Export in JSON
Links
Original tweet:
- https://twitter.com/James_inthe_box/status/1179077549302829056
- https://twitter.com/KorbenD_Intel/status/1179858006584037377
- https://twitter.com/58_158_177_102/status/1177498806016823296
- https://twitter.com/James_inthe_box/status/1174729932045316096