MgBot

StormBamboo targets software updates via HTTP that do not validate digital signatures of installers.

StormBamboo controlled DNS responses and redirected HTTP software-update requests to an attacker-controlled server hosting a forged text file and malicious installer.

The advisory maps StormBamboo's compromise of insecure automatic update mechanisms to T1203.

Process Watchdog – ansecprocesskeep.dll Registered as service AnsecProcessKeep. Confirmed to be a watchdog that keeps a process running.

The attacker-controlled server hosted a malicious installer, and the installer eventually downloaded either MGBot malware for Windows or MACMA for macOS.

Process Watchdog – ansecprocesskeep.dll Registered as service AnsecProcessKeep. Confirmed to be a watchdog that keeps a process running.

The attacker-controlled server hosted a malicious installer, and the installer eventually downloaded either MGBot malware for Windows or MACMA for macOS.

The implant functions as a backdoor, embedding itself in key system binaries and services, including crond, sshd and netstat.

Password dumper – cpfwplgx.dll Drops a file to call the MiniDumpWriteDump API to dump a process memory.

MgBot includes modules for dumping and capturing credentials from process memory. Mustang Panda utilized "Hdump" to dump credentials from memory.

MgBOT ... enables ... keylogging and password dumping. MACMA is able to perform device fingerprinting, keylogging, executing commands, screen and audio capture.

"APT42 has used custom malware to steal login and cookie data from common browsers." / "...extracts the web session cookie and sends it to the C2 server." / "...stole Chrome browser cookies by copying the Chrome profile directories of targeted users."

Agent Tesla has the ability to steal credentials from FTP clients and wireless profiles... APT33 has used a variety of publicly available tools like LaZagne to gather credentials... Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from the credential vault and DPAPI.

Agent Tesla can gather credentials from a number of browsers... APT3 has used tools to dump passwords from browsers... APT41 used BrowserGhost, a tool designed to obtain credentials from browsers, to retrieve information from password stores... TrickBot can obtain passwords stored in files from web browsers such as Chrome, Firefox, Internet Explorer, and Microsoft Edge

Evilnum can collect email credentials from victims... Malteiro has obtained credentials from mail clients via NirSoft MailPassView... MgBot includes modules for stealing stored credentials from Outlook and Foxmail email client software... PLEAD has the ability to steal saved passwords from Microsoft Outlook.

Active Directory enumeration – ceeeb.dll Collects the following information from Active directory: Members info Computers Local Admins Remote Desktop Users Dcom Users

The content repeatedly describes malware and threat actors collecting usernames, identifying logged-in users, running whoami/query user/quser, checking whether the current user is an administrator, enumerating user sessions, and gathering account details from compromised hosts.

Network scanner – innocence.dll Capabilities include: arp scan, http scan, determining the type of server (e.g. SQL, WebLogic, Redis, etc.) it is running on.

The content repeatedly describes malware and threat actors obtaining lists of running processes, using utilities such as tasklist, ps, WMI, Get-Process, CreateToolhelp32Snapshot, EnumProcesses, and similar APIs/commands to enumerate active processes on victim systems.

The content notes checks for whether the current user is an administrator or privileged, including 'AsyncRAT can check if the current user of a compromised system is an administrator,' 'Gelsemium has the ability to distinguish between a standard user and an administrator,' and 'Wizard Spider has used whoami to identify the local user and their privileges.'

BADNEWS crawls the victim's local drives and collects documents with selected extensions; Machete searches the file system for files of interest; Rover searches for files on local drives based on a predefined list of file extensions.

Examples include 'Caterpillar WebShell can obtain a list of user accounts from a victim's machine,' 'DRATzarus can obtain a list of users from an infected machine,' 'Woody RAT can retrieve a list of user accounts and usernames from an infected machine,' and 'TrickBot can identify the user and groups the user belongs to on a compromised host.'

Account Discovery: Local Account

AdFind can enumerate domain users. APT41 used built-in net commands to enumerate domain administrator users. BloodHound can collect information about domain users, including identification of domain admin accounts.

Domain Trust Discovery

The content repeatedly describes threat actors and malware collecting, stealing, identifying, copying, or staging files, documents, credentials, logs, databases, and other information from compromised hosts or local systems.

AppleSeed can find and collect data from removable media devices. APT28 backdoor may collect the entire contents of an inserted USB device. Aria-body has the ability to collect data from USB devices. BADNEWS copies files with certain extensions from USB devices to a predefined directory.

MgBOT ... enables ... keylogging and password dumping. MACMA is able to perform device fingerprinting, keylogging, executing commands, screen and audio capture.

Screen and clipboard grabber – cbmrpa.dll

Screen and clipboard grabber – cbmrpa.dll Captures clipboard and drag and drop data and saves it to a file.

Audio capture – prsm.dll Captures audio from the infected system. Uses COM objects IMMDeviceEnumerator, IAudioCaptureClient.

The attacker redirects the HTTP request to a Command and Control (C2) server they control hosting a forged text file and a malicious installer.

StormBamboo controlled DNS responses and redirected HTTP software-update requests to an attacker-controlled server hosting a forged text file and malicious installer.