Dtrack

The variant of Dtrack that attacked this power planet included hardcoded credentials for KNPP’s internal network, suggesting that it was a targeted attack.

WASSONITE targets manufacturing, electric generation, nuclear energy, and research entities in India, and likely South Korea and Japan. The group’s operations rely on DTrack malware, credential capture tools, and system tools for lateral movement.

The content repeatedly describes threat actors and malware using cmd.exe, the Windows command shell, to execute commands, launch payloads, run batch files, and automate actions on compromised hosts.

This sample uses the same technique that BackSwap used for hiding its code... this file is patched in the initialization phase of the program.

The variant of Dtrack that attacked this power planet included hardcoded credentials for KNPP’s internal network, suggesting that it was a targeted attack.

napstat.exe now contains the RAT, which adds persistence to the dropper by adding it as a service called ‘WBService’.

The dropper creates a suspended Microsoft process from a predefined list, in this case napstat.exe... It injects code into it by allocating memory, writing into it, modifying the thread context structure and then resuming the thread execution.

Agent Tesla has used process hollowing to create and manipulate processes through sections of unmapped memory by reallocating that space with its malicious code. APT-C-36 has used process hollowing to execute malware in the memory of legitimate processes. Astaroth can create a new process in a suspended state from a targeted legitimate process in order to unmap its memory and replace it with malicious code.

The variant of Dtrack that attacked this power planet included hardcoded credentials for KNPP’s internal network, suggesting that it was a targeted attack.

napstat.exe now contains the RAT, which adds persistence to the dropper by adding it as a service called ‘WBService’.

The second stage payload consists of heavily obfuscated shellcode... The encryption method used by the second layer differs for each sample. So far, we have spotted modified versions of RC4, RC5 and RC6 algorithms.

actors used the following command to rename one of their tools to a benign file name: ren "%temp%\upload" audiodg.exe ... APT1 ... used ... AcroRD32.exe ... as a name for malware ... APT28 ... changed extensions on files containing exfiltrated data to make them appear benign ... APT32 has renamed a NetCat binary to kb-10233.exe to masquerade as a Windows update.

The dropper creates a suspended Microsoft process from a predefined list, in this case napstat.exe... It injects code into it by allocating memory, writing into it, modifying the thread context structure and then resuming the thread execution.

Agent Tesla has used process hollowing to create and manipulate processes through sections of unmapped memory by reallocating that space with its malicious code. APT-C-36 has used process hollowing to execute malware in the memory of legitimate processes. Astaroth can create a new process in a suspended state from a targeted legitimate process in order to unmap its memory and replace it with malicious code.

The content repeatedly describes malware and threat actors deleting files, directories, droppers, logs, scripts, temporary files, exfiltrated archives, and uninstalling themselves to cover tracks or reduce forensic artifacts.

The variant of Dtrack that attacked this power planet included hardcoded credentials for KNPP’s internal network, suggesting that it was a targeted attack.

The content is a long ATT&CK-style listing of malware and threat groups that 'decrypt', 'decode', 'deobfuscate', 'unpack', or 'decompress' payloads, strings, configuration data, shellcode, and files prior to execution or use.

This sample uses the same technique that BackSwap used for hiding its code... this file is patched in the initialization phase of the program.

The reflective loading behaviour alerts us that a malicious PE module was loaded reflectively into napstat.exe. It is a file-less technique to load a PE into a process without placing a file on the disk

ATMDtruck also appeared in the fall of 2018... It collects enough information from the credit cards inputted into the infected ATM that it can actually clone them.

Among those downloaded and executed files already spotted in the standard DTrack toolset there is a keylogger

AdFind can extract subnet information from Active Directory; actors used ipconfig /all, netsh.exe, ifconfig, arp, route, nbtstat, and related APIs/commands to gather IP, MAC, DNS, DHCP, gateway, proxy, routing, ARP, and adapter information.

The information used for creating the identifier includes registry values (RegisteredOwner, RegisteredOrganization, InstallDate), computer name and adapter information (MAC addresses).

ATMDtruck also appeared in the fall of 2018... It collects enough information from the credit cards inputted into the infected ATM that it can actually clone them.

“C:\Windows\system32\cmd.exe” /c netstat -naop tcp > ...\netstat.res

Tasklist can be used to discover processes running on a system. Numerous malware families and threat groups are described as listing running processes, collecting PIDs, checking for specific process names, or enumerating loaded modules.

The content repeatedly describes malware and threat actors collecting OS version, computer name, architecture, CPU, memory, disk, language, and other host details; examples include use of commands such as ver, systeminfo, hostname, uname -m, sw_vers -productVersion, and fsutil.

The content is a long ATT&CK-style listing of groups and malware that can 'list files and directories,' 'search for files,' 'enumerate drives,' 'gather file metadata,' or 'browse file systems' on compromised hosts.

It is probably a second phase of an attack since the APT already had a foothold in the network, including a compromised file share and stolen credentials.

The sample that was found on KNPP steals user data such as browser history... collect_browser_history : gets FireFox & Chrome history

$ str_reg_move = / move \/ y %s \\ [ 0 - 9 ] { 1,3 } \. [ 0 - 9 ] { 1,3 } \. [ 0 - 9 ] { 1,3 } \. [ 0 - 9 ] { 1,3 } \\ C \$\\ Windows \\ Temp \\ MpLogs \\ / | $ str_reg_use = / net use \\ [ 0 - 9 ] { 1,3 } \. [ 0 - 9 ] { 1,3 } \. [ 0 - 9 ] { 1,3 } \. [ 0 - 9 ] { 1,3 } \\ C \$ \/ delete /

“C:\Windows\system32\cmd.exe” /c move /y C:\Users\ADMINI~1\AppData\Local\Temp\\~A7BBB42AMT.tmp \\10.38.1.35\C$\Windows\Temp\MpLogs\

Andariel has collected large numbers of files from compromised network systems for later extraction... APT28 has retrieved internal documents from machines inside victim environments... BADNEWS crawls the victim's local drives and collects documents... many listed groups and malware collect files, documents, credentials, payment card data, or other information from compromised hosts.

Among those downloaded and executed files already spotted in the standard DTrack toolset there is a keylogger

This file is then copied to a network share at \\10.38.1.35\C$\Windows\Temp\MpLogs\

Among those downloaded and executed files already spotted in the standard DTrack toolset there is a keylogger, a screenshot maker

After the malware finishes collecting the information, it creates a zip file with a tmp file extension... protected with the hard-coded password: abcd@123.

Another small change is that three C2 servers are used instead of six.

The content repeatedly describes malware and threat actors that can "download files from C2," "download additional payloads," "upload and download files," "retrieve payloads from the C2 server," and "copy files to remote machines."

As a RAT, Dtrack contains a variety of functions to execute on the victim’s machine: downloading and uploading files, dumping disk volume data, executing processes, etc.