PivNoxy

the APT group changed tactics and somehow compromised the update chain of NoxPlayer. A fake update package was sent to Southeast Asian gamers.

The attack started with a simple email that included a bare document as an attachment... a suspicious RTF attachment... disguised as having come from a Pakistan government division.

Our analysis revealed that the file behaves similarly... It creates a folder (c:\windows\tasks) and drops config and PE files into it.

Opening the email attachment... opens a decoy Word document. And at the same time, it exploits CVE-2018-0798 in the background.

Opening the email attachment, “Please help to CHECK.doc,” opens a decoy Word document.

“Cannondriver.exe” is vulnerable to a DLL Search Order Hijacking attack that LBTServ.dll takes advantage of.

Our analysis revealed that the file behaves similarly... It creates a folder (c:\windows\tasks) and drops config and PE files into it.

MITRE ... Defense Evasion T1112 Modify Registry

MITRE ... Persistence T1543.003 Create or Modify System Process: Windows Service

MITRE ... T1547.001 Boot or Logon Autostart Execution: Registry Run Keys/Startup Folder

MITRE ... T1547.014 Boot or Logon Autostart Execution: Active Setup

Our analysis revealed that the file behaves similarly... It creates a folder (c:\windows\tasks) and drops config and PE files into it.

Instead of LBTServ.dll containing the final payload, it loads a shellcode from a separate file and injects itself into svchost.exe.

MITRE ... Persistence T1543.003 Create or Modify System Process: Windows Service

MITRE ... T1547.001 Boot or Logon Autostart Execution: Registry Run Keys/Startup Folder

MITRE ... T1547.014 Boot or Logon Autostart Execution: Active Setup

MITRE ... Defense Evasion T1027 Obfuscated Files or Information

Instead of LBTServ.dll containing the final payload, it loads a shellcode from a separate file and injects itself into svchost.exe.

the malicious function loads the other dropped file, Microsoft.BT , into memory and proceeds to decrypt it.

“Cannondriver.exe” is vulnerable to a DLL Search Order Hijacking attack that LBTServ.dll takes advantage of.

MITRE ... Defense Evasion T1112 Modify Registry

MITRE ... Credential Access T1056.001 Input Capture: Keylogging

MITRE ... Discovery T1010 Application Window Discovery

Chinoxy operated as a backdoor and collected data from the infected computers.

MITRE ... Credential Access T1056.001 Input Capture: Keylogging

MITRE ... Collection T1074.001 Data Staged: Local Data Staging

It then contacts instructor[.]giize[.]com... where the payload is hosted.

MITRE ... Command and Control T1573.001 Encrypted Channel: Symmetric Cryptography

MITRE ... Exfiltration T1041 Exfiltration Over C2 Channel