80 lines
4.6 KiB
Markdown
80 lines
4.6 KiB
Markdown
# [Update] Malware analysis on Gamaredon APT campaign (06-08-19)
|
|
## Table of Contents
|
|
* [Malware analysis](#Malware-analysis)
|
|
+ [Analysis of the TTPs](#Initial-vector)
|
|
* [Cyber Threat Intel](#Cyber-Threat-Intel)
|
|
* [IOC](#IOC)
|
|
* [References MITRE ATT&CK Matrix](#Ref-MITRE-ATTACK)
|
|
* [Links](#Links)
|
|
+ [Original Tweet](#Original-Tweet)
|
|
+ [Ref previous analysis](#Documents)
|
|
+ [Link Anyrun](#Links-Anyrun)
|
|
|
|
## Malware-analysis
|
|
### Analysis of the TTPs
|
|
###### Like the last sample analysed, the new samples uses an SFX archive for extract the files and execute the fake document and the payload.
|
|
|
|
###### We can see again the cmd file extracted by the SFX archive. The randomization of the obfuscated strings has been by the algorithm in the archive.
|
|
|
|
###### Also this use the function GetCommandLineA for getting a pointer to the command-line string for the current process.
|
|
|
|
|
|
### Cyber kill chain
|
|
|
|
###### The process graph resume the cyber kill chain used by the attacker. We can observe that the TTPs are the same.
|
|
|
|
## Cyber Threat Intel
|
|
|
|
###### Both latest spotted samples have the same C2 hosted in a Russia provider.
|
|
|
|
###### The domain seems don't be registered on list of the domain added.
|
|
|
|
###### Like the last sample, this comes at a crisis period between Russia and Ukraine, Ukraine rest the main target of Gamaredon group.
|
|
## References MITRE ATT&CK Matrix <a name="Ref-MITRE-ATTACK"></a>
|
|
###### List of all the references with MITRE ATT&CK Matrix
|
|
|
|
|Enterprise tactics|Technics used|Ref URL|
|
|
| :---------------: |:-------------| :------------- |
|
|
|Execution|T1059 - Starts CMD.EXE for commands execution<br>T1106 - Execution through API<br>T1053 - Scheduled Task<br>T1064 - Scripting|https://attack.mitre.org/techniques/T1059<br>https://attack.mitre.org/techniques/T1106<br>https://attack.mitre.org/techniques/T1053<br>https://attack.mitre.org/techniques/T1064|
|
|
|Persistence|T1060 - Registry Run Keys / Startup Folder<br>T1053 - Scheduled Task|https://attack.mitre.org/techniques/T1060<br>https://attack.mitre.org/techniques/T1053|
|
|
|Privilege Escalation|T1053 - Scheduled Task|https://attack.mitre.org/techniques/T1053|
|
|
|Defense Evasion|T1112 - Modify Registry<br> T1064 - Scripting|https://attack.mitre.org/techniques/T1112<br>https://attack.mitre.org/techniques/T1064|
|
|
|Discovery|T1012 - Query Registry|https://attack.mitre.org/techniques/T1012|
|
|
|
|
## Indicators Of Compromise (IOC) <a name="IOC"></a>
|
|
|
|
###### List of all the Indicators Of Compromise (IOC)
|
|
| Indicator | Description|
|
|
| ------------- |:-------------|
|
|
|02013f0c6767eb7f0538510ba6ede0103e797fa7b9bc2733d00e3710702fdf1c.scr|02013f0c6767eb7f0538510ba6ede0103e797fa7b9bc2733d00e3710702fdf1c|
|
|
|FDGSKGN.vbs|630c0c86faf828bc4645526ca58b855d1a2db57cca0e406c1d5b7e2de88a1322|
|
|
|PowerShellCertificates_C4BA3647.ps1|8f33ce796ee08525d32f5794ebd355914140e43e4b63e09b384dabda93a8b22c|
|
|
|9856.txt|a48ad33695a44de887bba8f2f3174fd8fb01a46a19e3ec9078b0118647ccf599|
|
|
|176.57.215.22|IP C2|
|
|
|http[:]//shell-create.ddns.net/|URL request|
|
|
|shell-create.ddns.net|Domain C2|
|
|
|
|
###### This can be exported as JSON format [Export in JSON](https://raw.githubusercontent.com/StrangerealIntel/CyberThreatIntel/master/Russia/APT/Gamaredon/06-08-19/IOC_Gamaredon_16-08-19.json)
|
|
|
|
## Links <a name="Links"></a>
|
|
|
|
* Original tweet: https://twitter.com/RedDrip7/status/1161900271477252101 <a name="Original-Tweet"></a>
|
|
* Ref previous analysiss: [Gamaradon sample analysis 06-08-19](https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Russia/APT/Gamaredon/06-08-19/Malware%20analysis%2006-08-19.md)<a name="Documents"></a>
|
|
* Anyrun Links: <a name="Links-Anyrun"></a>
|
|
+ [1426f88edaf207d2c62422f343209fae](https://app.any.run/tasks/8b718d6a-04c4-44fc-9afd-e0cffd1b626a)
|
|
+ [a.exe](https://app.any.run/tasks/58d83fbe-36c9-4fad-9e21-9140207b6152)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|