HemiGate

“We found Earth Estries compromising existing accounts with administrative privileges after it successfully infected one of the organization’s internal servers.”

“Through the Server Message Block (SMB) and WMI command line (WMIC), the threat actors propagated backdoors and hacking tools…”

“Shell: Launches an interactive command shell.” / “CMD: Executes a command via cmd”

“will communicate with the third instance via named pipes… \\[.]\pipe\Key[500] … \\[.]\pipe\<username>\[<session number>]”

“We found Earth Estries compromising existing accounts with administrative privileges after it successfully infected one of the organization’s internal servers.”

“Zingdoor registers the current parent process as a Windows service… ‘MsSecEsSvc’ for persistence” / “A service called ‘Windrive’… is created as another startup mechanism.”

“An entry in the autostart registry named ‘Windrive’ is created.”

“We found Earth Estries compromising existing accounts with administrative privileges after it successfully infected one of the organization’s internal servers.”

“Zingdoor registers the current parent process as a Windows service… ‘MsSecEsSvc’ for persistence” / “A service called ‘Windrive’… is created as another startup mechanism.”

“An entry in the autostart registry named ‘Windrive’ is created.”

“threat actors regularly cleaned their existing backdoor after finishing each round of operation and redeployed a new piece of malware…”

“We found Earth Estries compromising existing accounts with administrative privileges after it successfully infected one of the organization’s internal servers.”

Decrypt by RC4 with hardcoded key / Decrypt by Custom Alg / Decrypt by RC4 with key embedded in encrypted payload

2nd Stage (in-memory PE loader) ... Dracu Loader ... Simple in-memory PE Loader called Dracu Loader

Implementation does not match, but coding-style looks similar / Keylog output path and file name are similar

“Process monitor: Enumerates currently running processes and allows the termination of a target process.”

“Through the Server Message Block (SMB) and WMI command line (WMIC), the threat actors propagated backdoors and hacking tools in other machines…”

Implementation does not match, but coding-style looks similar / Keylog output path and file name are similar

“Screenshot: Takes a screenshot of the active desktop window.”

Several code-level similarities and similarities in the communication implementation part / HTTP request headers are similar

Similarities in code-level and the C&C communication implementation / Code to get proxy information matches

“By installing Cobalt Strike on the system, the actors behind Earth Estries were able to deploy more pieces of malware…”