299. That's How Adversaries Abuse the BCP Utility
Hello everyone! Today we'll look at a curious example of Deobfuscate/Decode Files or Information (T1140) , and learn how ransomware affiliates abuse Bulk Copy Program (BCP). The example is Trigona ransomware gang, which also uses Mimic ransomware in their campaigns. So, the adversary often targets MS-SQL Server instances and leverages bcp.exe to export the toolset to the compromised server, for example: bcp “select binaryTable from uGnzBdZbsi” queryout “C:\ProgramData\spd.exe” -T -f “C:\ProgramData\FODsOZKgAU.txt” bcp “select binaryTable from uGnzBdZbsi” queryout “C:\ProgramData\AD.exe” -T -f “C:\ProgramData\FODsOZKgAU.txt” bcp “select binaryTable from uGnzBdZbsi” queryout “C:\users\[username]\music\L.bat” -T -f “C:\users\[username]\music\FODsOZKgAU.txt” bcp “select binaryTable from uGnzBdZbsi” queryout “C:\users\[username]\music\pci2.exe” -T -f “C:\users\[users name]\music\FODsOZKgAU.txt” For example, we can hunt for bcp.exe exporting files to suspicious folders: event_ty...