mirror of
https://github.com/MBCProject/mbc-markdown
synced 2026-06-08 11:36:36 +00:00
Ryan Xu
2.9 KiB
2.9 KiB
| ID | E1113 |
| Objective(s) | Collection, Credential Access |
| Related ATT&CK Techniques | Screen Capture (T1113) |
| Version | 2.0 |
| Created | 1 August 2019 |
| Last Modified | 13 September 2023 |
Screen Capture
Malware takes screen captures of the desktop.
See ATT&CK: Screen Capture (T1113).
Methods
| Name | ID | Description |
|---|---|---|
| WinAPI | E1113.m01 | Screen is captured using WinAPI functions (e.g., user32.GetDesktopWindow). |
Use in Malware
| Name | Date | Method | Description |
|---|---|---|---|
| GoBotKR | 2019 | -- | GoBotKR is capable of capturing screenshots. [1] |
| BlackEnergy | 2007 | -- | BlackEnergy's screenshot plugin allows for collection of screenshots. [2] |
| DarkComet | 2008 | E1113.m01 | DarkComet can take screenshots of the victim's computer. [3] [5] |
| CHOPSTICK | 2015 | -- | CHOPSTICK takes snapshots of deskop and window contents. [4] |
| Hupigon | 2013 | E1113.m01 | Malware captures screenshots. [5] |
| Kovter | 2016 | E1113.m01 | Malware captures screenshots. [5] |
| Rombertik | 2015 | E1113.m01 | Malware captures screenshots. [5] |
Detection
| Tool: capa | Mapping | APIs |
|---|---|---|
| capture screenshot | Screen Capture::WinAPI (E1113.m01) | user32.GetWindowDC, user32.GetDC, gdi32.CreateDC, gdi32.BitBlt, gdi32.GetDIBits, gdi32.CreateCompatibleDC, gdi32.CreateCompatibleBitmap, user32.GetSystemMetrics = fetch screen dimensions, user32.GetDesktopWindow = get entire desktop, BitBlt, System.Drawing.Graphics::CopyFromScreen |
| capture screenshot via keybd event | Screen Capture (E1113) |
References
[1] https://www.welivesecurity.com/2019/07/08/south-korean-users-backdoor-torrents/
[2] https://securelist.com/be2-custom-plugins-router-abuse-and-target-profiles/67353/
[3] https://blog.malwarebytes.com/threat-analysis/2012/06/you-dirty-rat-part-1-darkcomet/
[4] https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf
[5] capa v4.0, analyzed at MITRE on 10/12/2022