Duqu

The discoveries of the Stuxnet virus – and then the Duqu and Flame viruses – herald a new era of highly complex weaponised software made by powerful states to attack weaker states.

"used a valid account to maintain persistence via scheduled task"; "schedule a task on remote machines that executes the malware"

The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.

Instead, the code, delivered via exploitation, installs drivers and encrypted DLLs that function very similarly to the original Stuxnet code.

"used a valid account to maintain persistence via scheduled task"; "schedule a task on remote machines that executes the malware"

The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.

During the 2016 Ukraine Electric Power Attack, Sandworm Team used an arbitrary system service to load at system boot for persistence for Industroyer. They also replaced the ImagePath registry value of a Windows service with a new backdoor binary.

"used a valid account to maintain persistence via scheduled task"; "schedule a task on remote machines that executes the malware"

The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.

Aria-body has the ability to inject itself into another process such as rundll32.exe and dllhost.exe... BlackEnergy injects its DLL component into svchost.exe... ComRAT has injected its orchestrator DLL into explorer.exe... Stuxnet injects an entire DLL into an existing, newly created, or preselected trusted process.

Duqu and Stuxnet both use a kernel driver to decrypt and load encrypted DLL (Dynamic Load Library) files. The kernel drivers serve as an “injection” engine to load these DLLs into a specific process.

Agent Tesla has used process hollowing to create and manipulate processes through sections of unmapped memory by reallocating that space with its malicious code. APT-C-36 has used process hollowing to execute malware in the memory of legitimate processes. Astaroth can create a new process in a suspended state from a targeted legitimate process in order to unmap its memory and replace it with malicious code.

During the 2016 Ukraine Electric Power Attack, Sandworm Team used an arbitrary system service to load at system boot for persistence for Industroyer. They also replaced the ImagePath registry value of a Windows service with a new backdoor binary.

SIG4 ... Snake/Uroburos ... fdisk.sys driver ... SIG35 ... most likely related to Duqu ... looks for kernel driver ... SIG8 StuxNet ... mrxcls.sys, mrxnet.sys, s7otbxdxa.sys drivers.

“Duqu… a PROPERTY=VALUE pair containing a 56-bit encryption key has been used to decrypt the main payload from the installer packages.”

hiding payload inside PNGs using LSB steganography... Least Significant Bit (LSB) Steganography, which hides data inside the LSBs of image pixel values. This allows attackers to embed payload within an image file without altering its visual appearance.

installs drivers and encrypted DLLs... The PNF file is an encrypted DLL that is decrypted and injected into arbitrary system processes.

temporary Windows files generated by Wiper begin with a tilde character (~), followed by the letter d (either capital or lower case), followed by other letters or numbers. This “tilded platform,” as researchers have come to call the convention, is also found in both Stuxnet and Duqu.

Aria-body has the ability to inject itself into another process such as rundll32.exe and dllhost.exe... BlackEnergy injects its DLL component into svchost.exe... ComRAT has injected its orchestrator DLL into explorer.exe... Stuxnet injects an entire DLL into an existing, newly created, or preselected trusted process.

Duqu and Stuxnet both use a kernel driver to decrypt and load encrypted DLL (Dynamic Load Library) files. The kernel drivers serve as an “injection” engine to load these DLLs into a specific process.

Agent Tesla has used process hollowing to create and manipulate processes through sections of unmapped memory by reallocating that space with its malicious code. APT-C-36 has used process hollowing to execute malware in the memory of legitimate processes. Astaroth can create a new process in a suspended state from a targeted legitimate process in order to unmap its memory and replace it with malicious code.

Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi).

This file is hidden using the same method as the other modules.

And while Stuxnet and Duqu each “have variants where the kernel driver file is digitally signed using a software signing certificate,” Dell says this commonality is insufficient evidence of a connection “because compromised signing certificates can be obtained from a number of sources.”

The content is a catalog of malware families and threat actors that 'can perform keylogging,' 'log keystrokes,' 'capture keystrokes,' or use 'keylogger' modules/tools.

Multiple malware families are described as identifying/enumerating open windows or capturing foreground window titles (e.g., via EnumWindows, GetForegroundWindow, GetWindowText) to understand user activity and provide context for keylogging/screencapture.

AdFind can extract subnet information from Active Directory; actors used ipconfig /all after exploiting a machine; numerous malware and groups used ipconfig, ifconfig, arp, route, netsh, nbtstat, NBTscan, and related APIs to gather IP, MAC, DNS, DHCP, gateway, proxy, domain, ARP cache, routing, and adapter details.

Tasklist can be used to discover processes running on a system. Numerous malware families and threat groups are described as listing running processes, collecting PIDs, checking for specific process names, or enumerating loaded modules.

They check for the existence of specific files, windows registry entries, and other signs ... For example, this script looks for the existence of an actual file “winver32.exe” in the very specific $docsandsettings\\$subkey\\Application Data\\winver32.exe path.

"spread laterally by copying itself to shares it has enumerated"

"spread laterally by copying itself to shares... for which it has obtained legitimate credentials"; "hard-coded credentials to gain access to a network share"

APT29 used scheduler and schtasks to create new tasks on remote hosts as part of lateral movement... Naikon has used schtasks.exe for lateral movement in compromised networks... RemoteCMD can execute commands remotely by creating a new schedule task on the remote system.

Duqu ... spread laterally by copying itself to shares it has enumerated ... The remote host is then infected by using the compromised credentials to schedule a task on remote machines that executes the malware.

The content is a catalog of malware families and threat actors that 'can perform keylogging,' 'log keystrokes,' 'capture keystrokes,' or use 'keylogger' modules/tools.

The content repeatedly describes adversaries and malware storing collected data, command output, credentials, archives, or files in local temporary folders, working directories, hidden directories, registry locations, recycle bins, or specific files prior to exfiltration.

It communicates with a command server in India... Both groups above also contain another module, sortXXXX.nls... It seems to be responsible for the malware’s malicious activities, such as command and control communications.

The code in question is part of the Payload DLL, a section of the trojan that sends and receives instructions from an outside source once it has infiltrated a system.

Duqu provides attackers with remote access to compromised computers with the ability to run arbitrary programs, and can theoretically be used to target any organization, Dell said.

The content is a catalog of malware and threat groups that encrypt command-and-control communications using algorithms such as DES, AES, RC4, XOR, Blowfish, RSA, Camellia, RC2, RC6, and custom ciphers.

The strings indicate these modules have the capability to disable security tools, targeting some specific antivirus products.