190. Does Renaming Legitimate Binaries Really Mask Them?
Hello everyone! Today I want to look at another stealer - NordDragonScan . Once again, the adversary uses a malicious LNK file to download an HTA - a very common behavior. But it's not the thing that caught my attention, it's the following: "The malicious HTA file copies the legitimate PowerShell.exe binary to the path “C:\Users\Public\Documents\install.exe” to mask itself" So, here we have a renamed PowerShell.exe binary, and also quite suspicious staging folder - looks like the adversary made things even noisier! We already talked about renamed system binaries, and here's another example: event_type: "processcreatewin" AND proc_file_originalfilename: "powershell.exe" AND NOT proc_file_name: "powershell.exe" And also another suspicious staging folder: event_type: "processcreatewin" AND proc_file_path: "Public\\Documents" See you tomorrow!