KEYMARBLE

we were tracking multiple malicious Office documents that were designed and crafted specifically for Russian victims

The content repeatedly describes threat actors and malware using cmd.exe, the Windows command shell, to execute commands, launch payloads, run batch files, and automate actions on compromised hosts.

The malicious macro downloads a VBS script from a Dropbox URL, followed by the VBS script execution.

the attackers utilized multiple lure images in order to convince the victims to click the “Enable Content” button and trigger the malicious macro code

ADVSTORESHELL is capable of setting and deleting Registry values. Agent Tesla can achieve persistence by modifying Registry key entries. APT41 used a malware variant called GOODLUCK to modify the registry in order to steal credentials.

Receives 2 arguments – an application path and a wShowWindow parameter ... and creates a new process for it.

Receives 2 arguments – an application path and a wShowWindow parameter ... and creates a new process for it.

The content repeatedly describes malware and threat actors deleting files, directories, droppers, logs, scripts, temporary files, exfiltrated archives, and uninstalling themselves to cover tracks or reduce forensic artifacts.

ADVSTORESHELL is capable of setting and deleting Registry values. Agent Tesla can achieve persistence by modifying Registry key entries. APT41 used a malware variant called GOODLUCK to modify the registry in order to steal credentials.

AdFind can extract subnet information from Active Directory; actors used ipconfig /all, netsh.exe, ifconfig, arp, route, nbtstat, and related APIs/commands to gather IP, MAC, DNS, DHCP, gateway, proxy, routing, ARP, and adapter information.

the machine’s UID, which is a result of the operation: MD5( ProductID | MAC ), where the first field is obtained by querying the SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductId registry key

Tasklist can be used to discover processes running on a system. Numerous malware families and threat groups are described as listing running processes, collecting PIDs, checking for specific process names, or enumerating loaded modules.

The content repeatedly describes malware and threat actors collecting host details such as hostname, OS version, architecture, CPU, memory, BIOS, language, and other machine characteristics; e.g., "Action RAT has the ability to collect the hostname, OS version, and OS architecture of an infected host."

The content is a long ATT&CK-style listing of groups and malware that can 'list files and directories,' 'search for files,' 'enumerate drives,' 'gather file metadata,' or 'browse file systems' on compromised hosts.

Examples include 'Bazar can also check if the Russian language is installed,' 'DropBook has checked for the presence of Arabic language,' 'Maze has checked the language of the infected system,' and 'SynAck ... checks installed keyboard layouts to estimate if it has been launched from a certain list of countries.'

Receives a command to execute on Windows and runs it with the following command line: cmd.exe /c

If succeeds, retrieves file size and sends the file content to the server in chunks of 16KB.

The content is a MITRE ATT&CK-style listing of malware and threat actors that "can capture screenshots," "take screenshots," "perform screen captures," or "watch the victim's screen." It ends with references to "CopyFromScreen" and "xwd."

Receives a path to a directory as an argument, iterates over all files in it and zips them using the open source TZip library

Many entries describe XOR, XOR/ADD, bitwise NOT and XOR, ROR plus XOR, hexadecimal encoding after encryption, and custom encoding/obfuscation of HTTP traffic or beacons.

Each message exchanged between the malware and the server will have a predefined structure... resembles a TLS application record.

Receives 2 paths – a source path and a destination path. The malware will move the file from the source to destination path. | The VBS script downloads a CAB file from the dropzone sever, extracts the embedded EXE file (backdoor) using Windows’ “expand.exe” utility, and finally executes it.

The content is a catalog of malware and threat groups that encrypt command-and-control communications using algorithms such as DES, AES, RC4, XOR, Blowfish, RSA, Camellia, RC2, RC6, and custom ciphers.

If succeeds, retrieves file size and sends the file content to the server in chunks of 16KB.

Gets a name of a process as an argument and terminates it.

ComRAT has modified Registry values to store encrypted orchestrator code and payloads ... QakBot can modify the Registry to store its configuration information ... Volgmer modifies the Registry to store an encoded configuration file ...