Klingon RAT

It will then run a WMI command (wmic process get Caption,ParentProcessId,ProcessId) to get all running processes.

The malware can create a scheduled task called 'OneDriveUpdate' to maintain persistence. The task is configured from an XML file, 'elevator.xml' dropped to APPDATA, to trigger upon logon.

The malware is able to: ... Run PowerShell command ('cmd')

It will then run a WMI command (wmic process get Caption,ParentProcessId,ProcessId) ... To start gathering the information on the victim machine, it will get the OS version using the ver command ... the program will check to see if it is a Windows server by running the command 'systeminfo'

The malware can create a scheduled task called 'OneDriveUpdate' to maintain persistence. The task is configured from an XML file, 'elevator.xml' dropped to APPDATA, to trigger upon logon.

In this option the malware utilizes 'WMIC' to create an event subscription for persistence. Three commands are executed to create events in the 'root\subscription' namespace that will start the payload within 60 seconds of Windows booting up.

The Image File Execution Options key has the following entries set ... This causes the binary for Microsoft Screen Magnifier (magnify.exe) accessibility tool to be backdoored and execute the malware.

The following registry entry is created: Key: Computer\HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Name: Windows Updater Value: 'C:\Users\AppData\Local\Windows Update\updater10.exe' -1 -0

The malware can modify the 'Winlogon' key in order to run itself during Windows logon. The path of the executable is appended to the 'Userinit' entry.

The malware can create a scheduled task called 'OneDriveUpdate' to maintain persistence. The task is configured from an XML file, 'elevator.xml' dropped to APPDATA, to trigger upon logon.

In this option the malware utilizes 'WMIC' to create an event subscription for persistence. Three commands are executed to create events in the 'root\subscription' namespace that will start the payload within 60 seconds of Windows booting up.

The Image File Execution Options key has the following entries set ... This causes the binary for Microsoft Screen Magnifier (magnify.exe) accessibility tool to be backdoored and execute the malware.

The following registry entry is created: Key: Computer\HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Name: Windows Updater Value: 'C:\Users\AppData\Local\Windows Update\updater10.exe' -1 -0

The malware can modify the 'Winlogon' key in order to run itself during Windows logon. The path of the executable is appended to the 'Userinit' entry.

The malware has four options for privilege escalation ... UAC Bypass: Computer Defaults ... UAC Bypass: Fodhelper ... UAC Bypass: Disk Cleanup

The file 'elevator.xml' is then removed from the disk.

If running as administrator, it will run the Lsass binary previously dropped into the temp folder. The results are stored in a file called 'Andrew.dmp' inside the temp folder. This information is sent to the C2 server through a HTTP POST request.

A GET request is made to https://api.ipify.org to get the public IP address ... Finally, the malware will periodically get information about the local network and adapters.

It runs the following commands in this order: ... net view /all ... net view /all domain ... nltest /domain_trusts ... nltest /domain_trusts /all_trusts

To start gathering the information on the victim machine, it will get the OS version using the ver command, then grab the username ... Another routine will take a fingerprint of the machine ... It runs the following commands in this order: systeminfo ...

This information is sent to the C2 server through a HTTP POST request.

A TLS handshake is performed with the C2 server 185.188.183[.]144 on the port 1141

The malware will check this process list and match it against a list of targeted Antivirus processes. The taskkill command is used to kill matching processes and child processes.