MBCProject-mbc-markdown/collection/input-capture.md

ID	E1056
Objective(s)	Collection, Credential Access
Related ATT&CK Techniques	Input Capture (T1056, T1417)
Version	2.3
Created	1 August 2019
Last Modified	27 April 2024

Input Capture

Malware may record user inputs, typically without the user's knowledge. This is often used to capture sensitive information such as usernames, passwords, credit card numbers, and other personal data. The most common form of input capture is keylogging, where the malware records every keystroke made on a device. However, it can also involve capturing mouse clicks, touch screen interactions, or even voice inputs. The captured data is then usually transmitted to the attacker for use in further malicious activities like identity theft or unauthorized access.

See ATT&CK: Input Capture (T1056, T1417).

Methods

Name	ID	Description
Mouse Events	E1056.m01	Mouse events are captured.

Use in Malware

Name	Date	Method	Description
Rombertik	2015	--	The malware injects itself into a browser and captures user input data. [1]
Ursnif	2016	--	The malware injects HTML into a browser session to collect sensitive online banking information when the victim performs their online banking. [2]
Poison Ivy	2005	--	Poison Ivy can capture audio and video. [4]
Clipminer	2011	--	Clipminer monitors keyboard and mouse activity to determine if the machine is in use. [5]
ElectroRAT	2020	--	ElectroRat monitors keyboard and mouse activity to determine whether the machine is in use. [6]

Detection

Tool: capa	Mapping	APIs
use .NET library SharpClipboard	Input Capture (E1056)	--

Tool: CAPE	Mapping	APIs
antisandbox_mouse_hook	Input Capture (E1056)	SetWindowsHookExA, SetWindowsHookExW
antisandbox_mouse_hook	Input Capture::Mouse Events (E1056.m01)	SetWindowsHookExA, SetWindowsHookExW
browser_scanbox	Input Capture (E1056)	JsEval, COleScript_ParseScriptText, COleScript_Compile

References

[1] https://blogs.cisco.com/security/talos/rombertik

[2] https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/BKDR_URSNIF.SM?_ga=2.129468940.1462021705.1559742358-1202584019.1549394279

[3] https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/clipminer-bitcoin-mining-hijacking

[4] https://www.cyber.nj.gov/threat-center/threat-profiles/trojan-variants/poison-ivy

[5] https://www.mandiant.com/sites/default/files/2021-09/rpt-poison-ivy.pdf

[6] https://www.intezer.com/blog/research/operation-electrorat-attacker-creates-fake-companies-to-drain-your-crypto-wallets/