KONNI

The KONNI sample we discovered appears to have been distributed via a backdoored installer for a Russian-language tool named “Statistika KZU”... Both installers came in the form of an MSI file with the malware integrated into the benign installation process.

Microsoft disclosed a March 2023 case in which an account linked to Konni Group targeted Russian “diplomatic government entities” with phishing e-mails... The late 2021 campaign... leveraged tools such as spoofed MID login portals for credential harvesting, a fake malicious installer... and trojanized screensaver attachments to target MID personnel.

KONNI’s recent command set has remained largely unchanged and only permits operators to execute commands and receive their output...

The content repeatedly describes threat actors and malware using PowerShell scripts/commands for execution, download, staging, reconnaissance, persistence, credential access, lateral movement, and defense evasion; e.g., "Sandworm Team used PowerShell scripts to run a credential harvesting tool in memory to evade defenses."

In both cases, another batch file is eventually executed, which is responsible for copying the files and setting up the Windows service for persistence and execution simultaneously, as well as copying the included configuration alongside the payload file.

When a user runs the backdoored installer, a CustomAction triggers execution of the first stage... we have observed a VBScript and a small executable performing the same tasks.

AppleSeed has the ability to use JavaScript to execute PowerShell. APT32 has used JavaScript for drive-by downloads and C2 communications. Astaroth uses JavaScript to perform its core functionalities.

Sandworm Team leveraged Microsoft Office attachments which contained malicious macros that were automatically executed once the user permitted them... APT29 has used various forms of spearphishing attempting to get a user to open attachments... DarkGate is distributed through phishing links to VBS or MSI objects requiring user interaction for execution.

During the 2015 Ukraine Electric Power Attack, Sandworm Team modified in-registry Internet settings to lower internet security before launching rundll32.exe ... AADInternals can modify registry keys ... ADVSTORESHELL is capable of setting and deleting Registry values ... [many additional examples].

another batch file is eventually executed, which is responsible for copying the files and setting up the Windows service for persistence and execution simultaneously... The service name is chosen to be inconspicuous, with “Windows image Acquisition Service” being very similar to an existing, legitimate Windows service.

Numerous malware families and threat groups are described as achieving persistence by adding values under Run/RunOnce/Policies\Explorer\Run Registry keys or by placing shortcuts/files in the Windows Startup folder.

another batch file is eventually executed, which is responsible for copying the files and setting up the Windows service for persistence and execution simultaneously... The service name is chosen to be inconspicuous, with “Windows image Acquisition Service” being very similar to an existing, legitimate Windows service.

Numerous malware families and threat groups are described as achieving persistence by adding values under Run/RunOnce/Policies\Explorer\Run Registry keys or by placing shortcuts/files in the Windows Startup folder.

The configuration file copied during the malware installation process contains the C2 servers and is encrypted using AES-CTR, with the service name used as key.

Examples throughout the content include 'encrypted payloads decrypted and executed in memory,' 'encrypts its configuration file,' 'AES-encrypted resource,' 'RC4 encrypted embedded scripts,' and 'payload includes an encrypted main component.'

The service name is chosen to be inconspicuous, with “Windows image Acquisition Service” being very similar to an existing, legitimate Windows service.

Akira has used legitimate names and locations for files to evade defenses.

The content repeatedly describes threat actors and malware deleting files, tools, scripts, logs, droppers, staged data, and artifacts from compromised systems to cover tracks, remove evidence, or self-delete.

The content repeatedly describes malware and threat actors decoding, decrypting, deobfuscating, or unpacking payloads, strings, configuration data, commands, and C2 responses prior to execution or use.

When a user runs the backdoored installer, a CustomAction triggers execution of the first stage, which detects the environment (32/64 bit) and selects the appropriate payload.

During the 2015 Ukraine Electric Power Attack, Sandworm Team modified in-registry Internet settings to lower internet security before launching rundll32.exe ... AADInternals can modify registry keys ... ADVSTORESHELL is capable of setting and deleting Registry values ... [many additional examples].

The campaign occurred in multiple stages, leveraging tools such as spoofed MID login portals for credential harvesting...

The content repeatedly describes malware and threat actors using commands and APIs such as ipconfig /all, ifconfig, arp -a, route print, nbtstat, netsh, GetAdaptersInfo, and GetIpNetTable to gather IP addresses, MAC addresses, DNS, DHCP, gateways, routing tables, ARP cache, proxy settings, domains, and network adapter/interface details.

The content repeatedly describes malware and threat actors collecting usernames, identifying logged-in users, running whoami/query user/quser, checking whether the current user is an administrator, enumerating user sessions, and gathering account details from compromised hosts.

For a check-in, KONNI runs the following commands and sends the output to the C2: systeminfo tasklist

The content is a long ATT&CK-style listing of malware and threat actors that collect host details such as OS version, hostname, architecture, CPU, memory, BIOS, language, and other basic system characteristics; examples include use of commands like systeminfo, ver, uname, sw_vers, and WMI queries.

Multiple entries describe enumerating local, logical, or physical drives and disk/volume information, e.g., 'can enumerate local drives,' 'GetLogicalDrives,' 'fsutil fsinfo drives,' 'list drives,' and 'discover logical drive information including the drive type, free space, and volume information.'

When a user runs the backdoored installer, a CustomAction triggers execution of the first stage, which detects the environment (32/64 bit) and selects the appropriate payload.

The content repeatedly describes threat actors and malware collecting, stealing, identifying, copying, or staging files, documents, credentials, logs, databases, and other information from compromised hosts or local systems.

The campaign occurred in multiple stages, leveraging tools such as spoofed MID login portals for credential harvesting...

Agent Tesla can steal data from the victim’s clipboard. APT38 used a Trojan called KEYLIME to collect data from the clipboard. APT39 has used tools capable of stealing contents of the clipboard.

For file transfers, KONNI checks the extensions against a list of file types it transfers as is. Other file extensions are compressed into a .CAB archive and then sent.

Communication is done via HTTP.

KONNI’s recent command set has remained largely unchanged and only permits operators to execute commands and receive their output, upload and download files...

C2 traffic from ADVSTORESHELL is encrypted, then encoded with Base64 encoding... APT19 HTTP malware variant used Base64 to encode communications to the C2 server... APT33 has used base64 to encode command and control traffic.

Elise exfiltrates data using cookie values that are Base64-encoded... KONNI has used a custom base64 key to encode stolen data before exfiltration... Kevin can Base32 encode chunks of output files during exfiltration.