Egregor

– T1078 : Valid Accounts - Utilisation d’identifiants légitimes obtenus préalablement [11].

Download a special TOR browser ... Open our website with LIVE CHAT in the TOR browser: http://egregor[redacted].onion/[redacted] ... Open our website with LIVE CHAT: https://[redacted].top/[redacted]

In most cases, the initial vector of attack is exploiting some already known vulnerabilities in commercial VPN software.

il semblerait qu’ils utilisent des courriels d’hameçonnage avec une pièce-jointe contenant une macro malveillante [6] ... ; ... le détournement d’échanges par courriel (email thread hijacking) afin de distribuer Qakbot [2].

The information currently available suggests that the infection chain typically starts with a phishing email, which contains a malicious macro embedded in an attached document.

– T1047 : Windows Management Instrumentation - Utilisation du Windows Management Instrumentation [16].

– T1053.005 : Scheduled Task - Exécution via des tâches planifiées [16].

Later in the attack chain, operators use Cobalt Strike to gather information, escalate privileges, move laterally across the network and prepare the system for encryption.

AppleSeed has the ability to execute its payload via PowerShell... APT19 used PowerShell commands to execute payloads... APT28 downloads and executes PowerShell scripts and performs PowerShell commands... Start-Process / Invoke-Command / System.Management.Automation

Many entries mention .bat, .cmd, or batch scripting, such as APT1 using batch scripting to automate execution, APT41 using a batch file for persistence, and numerous malware families executing or downloading batch files. | The content repeatedly describes threat actors and malware using cmd.exe, the Windows command shell, to execute commands, launch payloads, run batch files, and automate actions on compromised hosts.

The content is a MITRE ATT&CK-style listing of many malware families and threat groups using Windows/native OS APIs for execution, injection, discovery, anti-debugging, and other actions, ending with 'NtCreateProcess' and 'fork()'.

Some sources also report the possible exploitation of CVE-2018-8174 (VBScript Engine), CVE-2018-4878 (Adobe Flash Player) & CVE-2018-15982 (Adobe Flash Player).

– T1569 : System Services: Service Execution - Exécution à l’aide des services système [11] [16].

– T1053.005 : Scheduled Task - Exécution via des tâches planifiées [16].

– T1078 : Valid Accounts - Utilisation d’identifiants légitimes obtenus préalablement [11].

– T1098 : Account Manipulation - Manipulation de compte [11].

MITRE ATT&CK Modify Registry T1112

Download a special TOR browser ... Open our website with LIVE CHAT in the TOR browser: http://egregor[redacted].onion/[redacted] ... Open our website with LIVE CHAT: https://[redacted].top/[redacted]

– T1543.003 : Create or Modify System Process, Windows Service - Création ou modification de processus système, notamment de Windows Service [16] [11].

– T1053.005 : Scheduled Task - Exécution via des tâches planifiées [16].

The below courses of action mitigate the following techniques: ... Process Injection [T1055] ...

The Windows Background Intelligent Transfer Service (BITS) is vulnerable to a privilege elevation vulnerability... An actor can exploit this vulnerability to execute arbitrary code with system-level privileges.

– T1078 : Valid Accounts - Utilisation d’identifiants légitimes obtenus préalablement [11].

– T1098 : Account Manipulation - Manipulation de compte [11].

– T1543.003 : Create or Modify System Process, Windows Service - Création ou modification de processus système, notamment de Windows Service [16] [11].

– T1548 : Abuse Elevation Control Mechanism - Abus du mécanisme de contrôle de l’élévation, contournement du contrôle d’accès utilisateur [11].

Frankenstein has used PowerShell to run a series of base64-encoded commands, that acted as a stager and enumerated hosts.

"Sandworm Team used UPX to pack a copy of Mimikatz"; "APT38 has used several code packing methods such as Themida, Enigma, VMProtect, and Obsidium"; "Lazarus Group packed malicious .db files with Themida to evade detection."

– T1027.004 : Compile After Delivery - Compilation après la distribution, utilisation d’un mot de passe pour déchiffrer et exécuter la dll d’Egregor [11].

Egregor imitates the svchost.exe process to execute the RClone client

The below courses of action mitigate the following techniques: ... Process Injection [T1055] ...

MITRE ATT&CK Indicator Removal on Host: File Deletion T1070.004

– T1078 : Valid Accounts - Utilisation d’identifiants légitimes obtenus préalablement [11].

The content is a long ATT&CK-style listing of malware and threat groups that 'decrypt', 'decode', 'deobfuscate', 'unpack', or 'decompress' payloads, strings, configuration data, shellcode, and files prior to execution or use.

AppleSeed can call regsvr32.exe for execution. APT19 used Regsvr32 to bypass application control techniques. APT32 created a Scheduled Task/Job that used regsvr32.exe to execute a COM scriptlet that dynamically downloaded a backdoor and injected it into memory.

It then uses BITS to download the Egregor DLL from a malicious server and execute the payload using Rundll32.

MITRE ATT&CK Virtualization/Sandbox Evasion T1497

The content includes environment-aware checks such as "Bazar can also check if the Russian language is installed on the infected machine and terminate if it is found," "CaddyWiper can also halt execution if the compromised host is identified as a domain controller," and "OopsIE checks for information on the CPU fan, temperature, mouse, hard disk, and motherboard as part of its anti-VM checks."

Egregor imitates the svchost.exe process to execute the RClone client and uses the injection of code into the memory to increase its stealth via a reflective dynamic-link library injection

The LockBit 3.0 ransomware uses a variety of anti-analysis techniques to hinder static and dynamic analysis... Several techniques are implemented for detecting the presence of a debugger and hindering dynamic analysis.

MITRE ATT&CK Modify Registry T1112

– T1222 : File and Directory Permissions Modification - Modification des droits sur les fichiers [11].

Les opérateurs tenteraient également de créer un objet de stratégie de groupe (Group Policy Object) afin de désactiver Windows Defender [12].

– T1110 : Brute Force - Utilisation de la force brute [11].

– T1552 : Unsecured Credentials - Récupération des informations d’identification via le registre [11].

MITRE ATT&CK Query Registry T1012

The content repeatedly describes malware and threat actors collecting the username, identifying the current user, enumerating logged-on users, or running commands such as whoami, query user, and quser to determine user context on compromised systems.

In all cases, the original entry point is to start network reconnaissance, then lateral movement, then data exfiltration.

– T1057 : Process Discovery - Reconnaissance de processus [11].

– T1069.001 : Permission Group Discovery - Reconnaissance des permissions de groupe [16].

Multiple tools/actors are described using Active Directory/domain group enumeration, e.g., “AdFind can enumerate domain groups”, “net group "domain admins" /domain to enumerate domain groups”, “BloodHound can collect information about domain groups and members”, and “AD Explorer tool to enumerate groups on a victim's network.”

The content repeatedly describes malware and threat actors collecting host details such as hostname, OS version, architecture, CPU, memory, BIOS, language, and other machine characteristics; e.g., "Action RAT has the ability to collect the hostname, OS version, and OS architecture of an infected host."

The below courses of action mitigate the following techniques: Account Discovery [T1087], Domain Trust Discovery [T1482], File and Directory Discovery [T1083]

Les attaquants utilisent notamment les outils Adfind et Sharphound afin de cartographier le réseau. – T1087 : Account Discovery - Reconnaissance de comptes admin [16], [11].

MITRE ATT&CK Peripheral Device Discovery T1120

The content repeatedly describes malware and threat actors collecting the current date, time, or time zone from victim systems, including examples such as "The net time command can be used... to determine the local or remote system time" and commands like "net time \\hostname" and "w32tm /tz".

– T1482 : Domain Trust Discovery - Reconnaissance des permissions de domaine [16].

MITRE ATT&CK Virtualization/Sandbox Evasion T1497

The content includes environment-aware checks such as "Bazar can also check if the Russian language is installed on the infected machine and terminate if it is found," "CaddyWiper can also halt execution if the compromised host is identified as a domain controller," and "OopsIE checks for information on the CPU fan, temperature, mouse, hard disk, and motherboard as part of its anti-VM checks."

MITRE ATT&CK Software Discovery: Security Software Discovery T1518.001

Examples include: “Bazar … check if the Russian language is installed … and terminate if it is found.”; “DropBook … checked for the presence of Arabic language …”; “Maze … checked the language … GetUserDefaultUILanguage”; “SynAck … checks installed keyboard layouts to estimate … countries.”

Examples include 'Bazar can also check if the Russian language is installed,' 'DropBook has checked for the presence of Arabic language,' 'Maze has checked the language of the infected system,' and 'SynAck ... checks installed keyboard layouts to estimate if it has been launched from a certain list of countries.'

The LockBit 3.0 ransomware uses a variety of anti-analysis techniques to hinder static and dynamic analysis... Several techniques are implemented for detecting the presence of a debugger and hindering dynamic analysis.

There have also been instances of operators using Cobalt Strike to create an RDP connection with other endpoints on the network and copying Egregor to them.

Pour se déplacer au sein du réseau, les opérateurs d’Egregor utiliseraient des balises SMB via l’outil Cobalt Strike ou des accès administrateurs. ... – T1021.002 : SMB/Windows Admin Shares - Utilisation des Remote Services, notamment SMB/Windows Admin Shares [16].

Targeted environments are previously compromised through various means (RDP exploit, Phishing) and once the Cobalt Strike beacon payload is established and persistent, it is then utilized to deliver and launch the Egregor payloads.

Cuba has been dropped onto systems and used for lateral movement via obfuscated PowerShell scripts.

“APT28 has collected files from network shared drives… BADNEWS crawls the victim's mapped drives and collects documents… BRONZE BUTLER has exfiltrated files stolen from file shares… menuPass has collected data from remote systems by mounting network shares with net use and using Robocopy to transfer data… Ramsay can collect data from network drives and stage it for exfiltration… Sowbug extracted Word documents from a file server on a victim network.”

We have also downloaded a lot of private data from your network, so in case of not contacting us as soon as possible this data will be released.

The Egregor “Hall of Shame” is a listing of victims who failed to pay the demanded ransom for data , with links to .zip compressed folders of data stolen from them.

A ce jour, l’utilisation de techniques d’assombrissement du code (obfuscation), de techniques anti-débogage et l’utilisation des API natives de Windows sont avérées.

Les connexions avec le serveur de commande et de contrôle se font via le protocole HTTPS. ... – T1071 : Application Layer Protocol - Utilisation de Beacon SMB via Cobalt Strike [16].

The content is a long ATT&CK-style listing showing numerous malware families and threat groups that 'use HTTP,' 'use HTTPS,' 'HTTP POST requests,' 'HTTP GET requests,' or 'HTTP/S' for command and control communications.

Qbot and TrickBot, in particular, were Emotet’s main customers and used their access to deploy ransomware (e.g. Ryuk, Conti, ProLock, Egregor, DoppelPaymer, and others).

This ransomware is often distributed as a payload along with remote access trojans (RATs) such as QAKBOT.

To contact us and purchase the key you have to visit our website in a hidden TOR network.

nowadays ransomware is not just about encrypting data – it’s primarily about data exfiltration.

Other ransomware gangs spotted attacking Japanese entities are well-known Maze, Sodinokibi and Ekans (Snake), and two ransomware operations that have recently adopted a tactic of public shaming – Egregor and LockBit.

After the payment the data will be removed from our disks and decryptor will be given to you

To exfiltrate data, operators typically use Rclone, an open-source command line program used to manage cloud storage.

All four also use the “double extortion” strategy of not just withholding victims’ data, but also publishing pieces of it online as an extra incentive for victims to pay the ransom. | All four use the RaaS model, meaning that affiliates carry out the ransomware attacks themselves and pay a percentage of each victim payment back to the strain’s creators and administrators.

Egregor tente également de supprimer les copies fantômes. ... – T1490 : Inhibit System Recovery - Les copies cachées Windows sont supprimées [11].

Encryption malware may also leverage Internal Defacement, such as changing victim wallpapers or ESXi server login messages, or otherwise intimidate victims by sending ransom notes or other messages to connected printers (known as "print bombing").

Maze was the first ransomware gang involved in double-extortion attacks where stolen data was used as leverage to pressure victims.