mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Rico Valdez
57 lines
4.2 KiB
JSON
57 lines
4.2 KiB
JSON
{
|
|
"category": "Adversary Tactics",
|
|
"channel": "ESCU channel",
|
|
"creation_date": "2018-07-24",
|
|
"description": "Monitor your environment for suspicious behaviors that resemble the techniques employed by the MUDCARP threat group.",
|
|
"id": "988C59C5-0A1C-45B6-A555-0C62276E327E",
|
|
"maintainers": [
|
|
{
|
|
"company": "iDefense",
|
|
"email": "iDefense.IntelOps@accenture.com",
|
|
"name": "iDefense Cyber Espionage Team"
|
|
}
|
|
],
|
|
"modification_date": "2018-07-24",
|
|
"name": "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns",
|
|
"narrative": "This story was created as a joint effort between iDefense and Splunk.<br></br>iDefense analysts have recently discovered a Windows executable file that, upon execution, spoofs a decryption tool and then drops a file that appears to be the custom-built javascript backdoor, \"Orz,\" which is associated with the threat actors known as MUDCARP (as well as \"temp.Periscope\" and \"Leviathan\"). The file is executed using Wscript.<br></br>The MUDCARP techniques include the use of the compressed-folders module from Microsoft, zipfldr.dll, with RouteTheCall export to run the malicious process or command. After a successful reboot, the malware is made persistent by a manipulating <code>[HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run]'help'='c:\\\\windows\\\\system32\\\\rundll32.exe c:\\\\windows\\\\system32\\\\zipfldr.dll,RouteTheCall c:\\\\programdata\\\\winapp.exe'</code>. Though this technique is not exclusive to MUDCARP, it has been spotted in the group's arsenal of advanced techniques seen in the wild.<br></br>This Analytic Story searches for evidence of tactics, techniques, and procedures (TTPs) that allow for the use of a endpoint detection-and-response (EDR) bypass technique to mask the true parent of a malicious process. It can also be set as a registry key for further sandbox evasion and to allow the malware to launch only after reboot.<br></br>If behavioral searches included in this story yield positive hits, iDefense recommends conducting IOC searches for the following:<br></br><ul><li>www.chemscalere[.]com</li><li>chemscalere[.]com</li><li>about.chemscalere[.]com</li><li>autoconfig.chemscalere[.]com</li><li>autodiscover.chemscalere[.]com</li><li>catalog.chemscalere[.]com</li><li>cpanel.chemscalere[.]com</li><li>db.chemscalere[.]com</li><li>ftp.chemscalere[.]com</li><li>mail.chemscalere[.]com</li><li>news.chemscalere[.]com</li><li>update.chemscalere[.]com</li><li>webmail.chemscalere[.]com</li><li>www.candlelightparty[.]org</li><li>candlelightparty[.]org</li><li>newapp.freshasianews[.]com</li></ul>In addition, iDefense also recommends that organizations review their environments for activity related to the following hashes:<br></br><ul><li>cd195ee448a3657b5c2c2d13e9c7a2e2</li><li>b43ad826fe6928245d3c02b648296b43</li><li>889a9b52566448231f112a5ce9b5dfaf</li><li>b8ec65dab97cdef3cd256cc4753f0c54</li><li>04d83cd3813698de28cfbba326d7647c</li></ul>",
|
|
"original_authors": [
|
|
{
|
|
"company": "iDefense",
|
|
"email": "iDefense.IntelOps@accenture.com",
|
|
"name": "iDefense Cyber Espionage Team"
|
|
}
|
|
],
|
|
"references": [
|
|
"https://intelgraph.idefense.com/#/node/threat_group/view/29fbec10-8cc8-4662-8362-2c24c1eeb74c",
|
|
"https://intelgraph.idefense.com/#/node/intelligence_alert/view/62bb3669-9386-4264-b51a-59876cf50ffe",
|
|
"http://blog.amossys.fr/badflick-is-not-so-bad.html"
|
|
],
|
|
"searches": {
|
|
"contextual_searches": [
|
|
"Get Notable Info",
|
|
"Get Notable History",
|
|
"Get User Information from Identity Table",
|
|
"Get Authentication Logs For Endpoint",
|
|
"Get Risk Modifiers For User",
|
|
"Get Risk Modifiers For Endpoint"
|
|
],
|
|
"detection_searches": [
|
|
"First time seen command line argument",
|
|
"Registry Keys Used For Persistence",
|
|
"Malicious PowerShell Process - Connect To Internet With Hidden Window",
|
|
"Unusually Long Command Line",
|
|
"Unusually Long Command Line - MLTK"
|
|
],
|
|
"investigative_searches": [
|
|
"Get Process Info",
|
|
"Get Parent Process Info"
|
|
],
|
|
"support_searches": [
|
|
"Previously seen command line arguments",
|
|
"Baseline of Command Line Length - MLTK"
|
|
]
|
|
},
|
|
"spec_version": 1,
|
|
"version": "1.0"
|
|
}
|