56 lines
4.0 KiB
Markdown
56 lines
4.0 KiB
Markdown
# Malware analysis on Gamaredon APT campaign (06-08-19)
|
|
## Table of Contents
|
|
* [Malware analysis](#Malware-analysis)
|
|
+ [Initial vector](#Initial-vector)
|
|
+ [Bat and powershell script](#Bat)
|
|
+ [Final PE](#PE)
|
|
+ [Cyber kill chain](#Cyber-kill-chain)
|
|
* [Cyber Threat Intel](#Cyber-Threat-Intel)
|
|
* [IOC](#IOC)
|
|
* [References MITRE ATT&CK Matrix](#Ref-MITRE-ATTACK)
|
|
* [Links](#Links)
|
|
+ [Original Tweet](#Original-Tweet)
|
|
+ [Link Anyrun](#Links-Anyrun)
|
|
+ [Ref previous analysis](#Documents)
|
|
## Malware-analysis <a name="Malware-analysis"></a>
|
|
### Initial vector <a name="Malware-analysis"></a>
|
|
###### The SFX archive executes a runas for get a bypass of UAC elevation, once this done, this show a fake window of Word with riche020.dll method. Define the language of thread in Russian.
|
|
This drops the cmd file and the both PE as txt file, a trace of a capacity to extract a Ink file can observed, a similar sample which has used this.
|
|
Its create the vbs and ps1 file by redirection of the console output, a schedule task as persistence and execute the files.
|
|
We can see on the obfuscated strings, that some patterns have been generated and randomized by a DOS obfuscate tool. The vbs file check the version of Word and disable some security features. The powershell file send the reconnaissance informations on the C2.
|
|
Like observed with muddywater, this repeats until the group edit a URL with the next payload if the target is interesting. This check the connectivity to internet by requesting the DNS of Google and use the shellscript.exe for try to download by the edited URL.
|
|
This PE file uses the OpenSSL, SMTP, FTP and various algorithms libraries in C, this a compiled version of Wget. The C2 is host by a provider in Russia.This seems be a sample of the campaign of Gamaredon group in June 2018 by the very similar TTPs.
|
|
This version of Wget is used on many campaigns of this group since 2017.
|
|
|
|
### Cyber kill chain <a name="Cyber-kill-chain"></a>
|
|
###### The process graph resume the cyber kill chain used by the attacker.
|
|
|
|
|
|
## References MITRE ATT&CK Matrix <a name="Ref-MITRE-ATTACK"></a>
|
|
###### List of all the references with MITRE ATT&CK Matrix
|
|
|
|
|Enterprise tactics|Technics used|Ref URL|
|
|
| :---------------: |:-------------| :------------- |
|
|
|Execution|T1059 - Starts CMD.EXE for commands execution<br>T1106 - Execution through API<br>T1053 - Scheduled Task<br>T1064 - Scripting|https://attack.mitre.org/techniques/T1059<br>https://attack.mitre.org/techniques/T1106<br>https://attack.mitre.org/techniques/T1053<br>https://attack.mitre.org/techniques/T1064|
|
|
|Persistence|T1053 - Scheduled Task|https://attack.mitre.org/techniques/T1053|
|
|
|Privilege Escalation|T1053 - Scheduled Task|https://attack.mitre.org/techniques/T1053|
|
|
|Defense Evasion|T1112 - Modify Registry<br> T1064 - Scripting|https://attack.mitre.org/techniques/T1112<br>https://attack.mitre.org/techniques/T1064|
|
|
|Discovery|T1012 - Query Registry|https://attack.mitre.org/techniques/T1012|
|
|
|
|
## Indicators Of Compromise (IOC) <a name="IOC"></a>
|
|
|
|
###### List of all the Indicators Of Compromise (IOC)
|
|
| Indicator | Description|
|
|
| ------------- |:-------------:|
|
|
|02013f0c6767eb7f0538510ba6ede0103e797fa7b9bc2733d00e3710702fdf1c.scr|02013f0c6767eb7f0538510ba6ede0103e797fa7b9bc2733d00e3710702fdf1c|
|
|
|9856.txt|a48ad33695a44de887bba8f2f3174fd8fb01a46a19e3ec9078b0118647ccf599|
|
|
|176.57.215.22|IP C2|
|
|
|http[:]//shell-create.ddns.net/|URL request|
|
|
|shell-create.ddns.net|Domain C2|
|
|
|
|
## Links <a name="Links"></a>
|
|
|
|
* Original tweet: https://twitter.com/Timele9527/status/1157458188792262656 <a name="Original-Tweet"></a>
|
|
* Anyrun Link: [02013f0c6767eb7f0538510ba6ede0103e797fa7b9bc2733d00e3710702fdf1c.scr](https://app.any.run/tasks/b5a3d531-d95a-4971-a57b-eb881ca3a790)<a name="Links-Anyrun"></a>
|
|
* Ref previous analysis : [gamaredon eastern europe attacks](https://securityaffairs.co/wordpress/86561/apt/gamaredon-eastern-europe-attacks.html) <a name="Documents"></a>
|