MalwareUsed by 1 actor

conhost.exe

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Geumseong121

조건이 맞는 컴퓨터의 경우에는 내부에 암호화된 코드를 XOR 0x55 키로 복호화한 후 'conhost.exe' 파일명으로 생성해 실행하게 됩니다. 'conhost.exe' 파일의 경우가 바로 AOL 메신저로 통신을 하는 기능을 수행하게 됩니다.

via alyac blogblog.alyac.co.kr

MITRE ATT&CK

Techniques & procedures

4 distinct techniques documented for this family, organized by ATT&CK tactic.

Persistence

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence1

The module also establishes persistence by writing to the current user’s Run key. Persistence install command: reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Deno_AutoRun

Privilege Escalation

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence1

The module also establishes persistence by writing to the current user’s Run key. Persistence install command: reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Deno_AutoRun

Stealth

1 technique

T1564Hide ArtifactsEvidence1

The malware utilizes conhost.exe --headless to launch and wrap its child processes, suppressing visible console windows from the user.

Credential Access

1 technique

T1003OS Credential DumpingEvidence1

OSアカウントのパスワード窃取ツール…conhost.exeという攻撃者がダウンロードしたツールでOSアカウントの窃取が試行された。

Command and Control

1 technique

T1105Ingress Tool TransferEvidence1

④2次バックドアをダウンロード…⑥3次バックドアをダウンロード

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

alyac blogNews

Aug 22, 2018

복호화 후 생성되는 페이로드로, AOL/AIM 메신저를 이용한 명령제어 통신 기능을 수행하는 백도어성 악성코드다.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping4

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 1 actor

conhost.exe

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Geumseong121

via alyac blogblog.alyac.co.kr

MITRE ATT&CK

Techniques & procedures

4 distinct techniques documented for this family, organized by ATT&CK tactic.

Persistence

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence1

The module also establishes persistence by writing to the current user’s Run key. Persistence install command: reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Deno_AutoRun

Privilege Escalation

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence1

The module also establishes persistence by writing to the current user’s Run key. Persistence install command: reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Deno_AutoRun

Stealth

1 technique

T1564Hide ArtifactsEvidence1

The malware utilizes conhost.exe --headless to launch and wrap its child processes, suppressing visible console windows from the user.

Credential Access

1 technique

T1003OS Credential DumpingEvidence1

OSアカウントのパスワード窃取ツール…conhost.exeという攻撃者がダウンロードしたツールでOSアカウントの窃取が試行された。

Command and Control

1 technique

T1105Ingress Tool TransferEvidence1

④2次バックドアをダウンロード…⑥3次バックドアをダウンロード

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

alyac blogNews

Aug 22, 2018

복호화 후 생성되는 페이로드로, AOL/AIM 메신저를 이용한 명령제어 통신 기능을 수행하는 백도어성 악성코드다.

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping4

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.