Derusbi

In the supply chain attack, altered files on legitimate update servers or DNAT configuration changes in iptables resulted in software update requests being redirected to an illegitimate server.

Execution of arbitrary files or shell commands on infected system ... The library is run by executing the following command line: rundll32.exe %Systemroot%\Help\perfc009.dat R32 <random_number> ... cmd.exe /c net stop sharedaccess

FireEye reported that APT19 was active in 2017 when they used 3 different methods to compromise targets: CVE-2017-0199 vulnerability, macro-enabled Microsoft Excel (XLSM) documents and an application whitelisting bypass to the XLSM documents.

FireEye reported that APT19 was active in 2017 when they used 3 different methods to compromise targets: CVE-2017-0199 vulnerability, macro-enabled Microsoft Excel (XLSM) documents and an application whitelisting bypass to the XLSM documents.

Services management: list of services, creating, starting, stopping, deleting services

altered files on legitimate update servers or DNAT configuration changes in iptables resulted in software update requests being redirected to an illegitimate server

It puts a string with its own path to the “ServiceDll” value in the registry that associates with the “iphlpsvc” or “wuauserv” system service depending on Windows version, and saves the original value of “ServiceDll” in encrypted form to the “Security” parameter of the same registry key.

The malware stores its configuration data in encrypted form in the “Security” value of the HKLM\SOFTWARE\Microsoft\Rpc registry key.

The malware registers itself as a service if it has run with administrator privileges... There is another service called WinHelpSrv that is added to this list... The file creates a new service named WinHelpSrv (Windows Helper Service)... The malicious DLL is registered as a service by adding the “ServiceDll” value that points to its location.

Hi-Zor executes using regsvr32.exe called from the Registry Run Keys / Startup Folder persistence mechanism. Inception has ensured persistence at system boot by setting the value regsvr32 %path%\ctfmonrn.dll /s.

Aria-body has the ability to inject itself into another process such as rundll32.exe and dllhost.exe... BlackEnergy injects its DLL component into svchost.exe... ComRAT has injected its orchestrator DLL into explorer.exe... Stuxnet injects an entire DLL into an existing, newly created, or preselected trusted process.

Uroburos/Turla exploited a VBox driver; Derusbi exploited a Novell driver; Slingshot exploited a Sandra driver. Duqu 2.0 used CVE-2015-2360 in win32k.sys for kernel execution.

The malware registers itself as a service if it has run with administrator privileges... There is another service called WinHelpSrv that is added to this list... The file creates a new service named WinHelpSrv (Windows Helper Service)... The malicious DLL is registered as a service by adding the “ServiceDll” value that points to its location.

Hi-Zor executes using regsvr32.exe called from the Registry Run Keys / Startup Folder persistence mechanism. Inception has ensured persistence at system boot by setting the value regsvr32 %path%\ctfmonrn.dll /s.

FireEye reported that APT19 was active in 2017 when they used 3 different methods to compromise targets: CVE-2017-0199 vulnerability, macro-enabled Microsoft Excel (XLSM) documents and an application whitelisting bypass to the XLSM documents.

It copies itself to the folder “%System32%\wbem“, with a name consisting of “ntfs” + three random letters, and a “.mof” extension... Property Value FileDescription ProfSvc ... CompanyName Microsoft Corporation

Aria-body has the ability to inject itself into another process such as rundll32.exe and dllhost.exe... BlackEnergy injects its DLL component into svchost.exe... ComRAT has injected its orchestrator DLL into explorer.exe... Stuxnet injects an entire DLL into an existing, newly created, or preselected trusted process.

The content repeatedly describes malware and threat actors deleting files, directories, droppers, logs, scripts, temporary files, exfiltrated archives, and uninstalling themselves to cover tracks or reduce forensic artifacts.

AppleSeed can call regsvr32.exe for execution. APT19 used Regsvr32 to bypass application control techniques. APT32 created a Scheduled Task/Job that used regsvr32.exe to execute a COM scriptlet that dynamically downloaded a backdoor and injected it into memory.

The library is run by executing the following command line: rundll32.exe %Systemroot%\Help\perfc009.dat R32 <random_number>

The malware uses an anti-analysis technique by comparing the image path of the executable with rundll32.exe. It is done to ensure that the file is not executed by a sandbox/analyst (it exits if that’s the case).

altered files on legitimate update servers or DNAT configuration changes in iptables resulted in software update requests being redirected to an illegitimate server

It puts a string with its own path to the “ServiceDll” value in the registry that associates with the “iphlpsvc” or “wuauserv” system service depending on Windows version, and saves the original value of “ServiceDll” in encrypted form to the “Security” parameter of the same registry key.

the malicious process allocates a new memory area in order to write the DLL code inside... the malware uses VirtualProtect in order to change the protection of the area... After the malicious code would be written in the new memory location, the process would pass the execution flow to the new DLL file

The malware stores its configuration data in encrypted form in the “Security” value of the HKLM\SOFTWARE\Microsoft\Rpc registry key.

Derusbi “also used stolen certificates”; Duqu 2.0 “used stolen Foxconn certificate.”

It sniffs all incoming network packets and searches them for a specially crafted signature. If found, it redirects these packets to the listening socket opened by the main malware module.

The content is a catalog of malware families and threat actors that 'can perform keylogging,' 'log keystrokes,' 'capture keystrokes,' or use 'keylogger' modules/tools.

The content repeatedly describes malware and threat actors collecting the victim username, identifying logged-in users, running whoami, query user, quser, or similar commands to determine the current user or user sessions.

It sniffs all incoming network packets and searches them for a specially crafted signature. If found, it redirects these packets to the listening socket opened by the main malware module.

GetAdaptersInfo API is utilized to find adapter information for the local machine... The GetNetworkParams function is utilized to obtain network parameters for the local machine.

Tasklist can be used to discover processes running on a system. Numerous malware families and threat groups are described as listing running processes, collecting PIDs, checking for specific process names, or enumerating loaded modules.

Several entries describe identifying whether the current user has admin privileges, determining privilege level, identifying groups the user belongs to, or verifying execution as SYSTEM.

The content repeatedly describes malware and threat actors collecting host details such as hostname, OS version, architecture, CPU, memory, BIOS, language, and other machine characteristics; e.g., "Action RAT has the ability to collect the hostname, OS version, and OS architecture of an infected host."

The content is a long ATT&CK-style listing of groups and malware that can 'list files and directories,' 'search for files,' 'enumerate drives,' 'gather file metadata,' or 'browse file systems' on compromised hosts.

The malware uses an anti-analysis technique by comparing the image path of the executable with rundll32.exe. It is done to ensure that the file is not executed by a sandbox/analyst (it exits if that’s the case).

The Remote Shell library creates two named pipes used to communicate with the main module: pipeusb<random_number>i pipeusb<random_number>o

The content is a catalog of malware families and threat actors that 'can perform keylogging,' 'log keystrokes,' 'capture keystrokes,' or use 'keylogger' modules/tools.

The content is a MITRE ATT&CK-style listing of malware and threat actors that "can capture screenshots," "take screenshots," "perform screen captures," or "watch the victim's screen." It ends with references to "CopyFromScreen" and "xwd."

Many entries describe XOR, XOR/ADD, bitwise NOT and XOR, ROR plus XOR, hexadecimal encoding after encryption, and custom encoding/obfuscation of HTTP traffic or beacons.

APT41 used the Steam community page as a fallback mechanism for C2. Bazar has the ability to use an alternative C2 server if the primary server fails. BISCUIT malware contains a secondary fallback command and control server that is contacted after the primary command and control server.

Machete has sent data over HTTP if FTP failed. Mis-Type first attempts to use a Base64-encoded network protocol over a raw TCP socket for C2, and if that method fails, falls back to a secondary HTTP-based protocol. NETEAGLE will send beacons via an HTTP POST request if the infected host is configured to a proxy.

Traffic redirection via port forwarding: infected host is used as proxy ... starting network proxy

The content is a catalog of malware and threat groups that encrypt command-and-control communications using algorithms such as DES, AES, RC4, XOR, Blowfish, RSA, Camellia, RC2, RC6, and custom ciphers.

The encrypted + encoded buffer is exfiltrated to the C2 server via a WinHttpWriteData function call.

Examples include disabling DSE, disabling PatchGuard, IAT patching, disabling EDR kernel-user communications, and disabling security-focused kernel ETW providers.