Article Content This post was prepared with contributions from Asheer Malhotra, Charles Crawford, and Jessica Saavedra-Morales.  On February 28, the McAfee Advanced Threat Research team discovered that the cybercrime group Hidden Cobra continues to target cryptocurrency and financial organizations In this analysis, we observed the return of Hidden Cobra’s Bankshot malware implant surfacing in the Turkish financial system Based on the code similarity, the victim’s business sector, and the presence of control server strings, this attack resembles previous attacks by Hidden Cobra conducted against the global financial network SWIFT In this new, aggressive campaign we see a return of the Bankshot implant, which last appeared in 2017 Bankshot is designed to persist on a victim’s network for further exploitation; thus the Advanced Threat Research team believes this operation is intended to gain access to specific financial organizations The document contains an embedded Adobe Flash exploit, which was recently announced by the Korean Internet Security agency The exploit, which takes advantage of CVE-2018-4878, allows an attacker to execute arbitrary code such as an implant the Further investigation into this campaign and analysis of McAfee product telemetry shows that the infection occurred on March 2 and 3 The implant’s first target was a major government-controlled financial organization It next appeared in another Turkish government organization involved in finance and trade A further three large financial institutions in Turkey were victims of this attack The implant has so far not surfaced in any other sector or country This campaign suggests the attackers may plan a future heist against these targets by using Bankshot to gather information The malicious domain falcancoin.io was created December 27, 2017, and was updated on February 19, only a few days before the implants began to appear These implants are variations of earlier forms of Bankshot, a remote access tool that gives an attacker full capability on a victim’s system This implant also contains functionality to wipe files and content from the targeted system to erase evidence or perform other destructive actions Bankshot was first reported by the Department of Homeland Security on December 13, 2017, and has only recently resurfaced in newly compiled variants The sample we analyzed is 99% similar to the documented Bankshot variants from 2017 Bankshot implants hosted on falcancoin.io The Bankshot implant is attached to a malicious Word document with the filename Agreement.docx The document appears to be an agreement template for Bitcoin distribution between an unknown individual in Paris and a to-be-determined cryptocurrency exchange The author of this document is test-pc It was created February 26 and was submitted from the Netherlands The document contains an embedded Flash script that exploits CVE-2018-4878 and downloads and executes the DLL implant from falcancoin.io We discovered two more documents, written in Korean, that exploit the same vulnerability as Agreement.docx These documents appear to be part of the same campaign and may have been used on different targets These documents also communicated with falcancoin.io to install Bankshot and also contain themes around cryptocurrency security Two Flash files exploit CVE-2018-4878 843c17b06a3aee22447f021307909890b68828b9 (February 25) 343ebca579bb888eb8ccb811f9b52280c72e484c (February 25  Malicious documents in the attack Malicious document exploiting CVE-2018-4878 The implants are downloaded via a Flash file embedded in the malicious document They are executed when the victim views the document The malicious site falcancoin.io embedded in the Flash file The implants (DLLs) are disguised as ZIP files and communicate with three control servers, two of them Chinese-language online gambling sites These URLs can be found hardcoded in the implants’ code Hardcoded control server URLs Analyzing Bankshot The sample (a2e966edee45b30bb6bb5c978e55833eec169098) is a Windows DLL that serves as a backdoor and contains a variety of capabilities To mask itself, it can run as a regular library loaded into a legitimate process The malware begins by creating a new thread from the DllMain() function to carry out its malicious activities: New thread created in the malware’s DllMain() function Based on analysis of previous samples, this is a unique identifier user_id is a hardcoded value in the malware binary that is sent to the control server filename is based on static analysis This looks like a specific beacon to indicate that the malware is ready to receive commands The command index calculator and jump to the appropriate command The process is identified by the control server sending the PID to the malware The capability to terminate a process Spawning arbitrary processes A process created as logged-in user This may be used to load additional downloaded components of the attack Loading an arbitrary library into its own process space.  After every action is performed the malware sends a response to the control server indicating whether the action was successful Connections  The US government reports that Bankshot is used by Hidden Cobra to target multiple industries including financial organizations This implant has been connected to a major Korean bank attack and is also known as Trojan Manuscript That variant contained the capability to search for hosts related to the SWIFT network and the same control server strings as the variant we found targeting the Turkish financial sector The implant does not conduct financial transactions; rather it is a channel into the victim’s environment, in which further stages of implants can be deployed for financial reconnaissance The Bankshot implant was also observed in 2017 in documents appearing to come from Latin American banks Malicious document delivering the Bankshot implant in 2017 These connections, combined with the implant’s nearly identical appearance to known variants, are a strong indication that we have uncovered a Hidden Cobra attack Further, previous implants from 2017 contained bogus documents with financially themed content In this campaign, we see the adoption of a recent zero-day Adobe Flash vulnerability to get the implant onto the victim’s systems The campaign has a high chance of success against victims who have an unpatched version of Flash Indicators of Compromise MITRE ATT&CK techniques  Exfiltration over command and control channel Commonly used port Command-line interface Service execution Automated collection Data from local system Process discovery System time discovery Credential dumping Exploitation of vulnerability Process injection File deletion  Hashes  650b7d25f4ed87490f8467eb48e0443fb244a8c4 65e7d2338735ec04fd9692d020298e5a7953fd8d 166e8c643a4db0df6ffd6e3ab536b3de9edc9fb7 a2e966edee45b30bb6bb5c978e55833eec169098  Domains  530hr[dot]com/data/common.php 028xmz[dot]com/include/common.php 168wangpi[dot]com/include/charset.php Falcancoin[dot]io
Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Article Content This post was prepared with contributions from Asheer Malhotra, Charles Crawford, and Jessica Saavedra-Morales.  On February 28, the McAfee Advanced Threat Research team discovered that the cybercrime group Hidden Cobra continues to target cryptocurrency and financial organizations In this analysis, we observed the return of Hidden Cobra’s Bankshot malware implant surfacing in the Turkish financial system Based on the code similarity, the victim’s business sector, and the presence of control server strings, this attack resembles previous attacks by Hidden Cobra conducted against the global financial network SWIFT In this new, aggressive campaign we see a return of the Bankshot implant, which last appeared in 2017 Bankshot is designed to persist on a victim’s network for further exploitation; thus the Advanced Threat Research team believes this operation is intended to gain access to specific financial organizations The document contains an embedded Adobe Flash exploit, which was recently announced by the Korean Internet Security agency The exploit, which takes advantage of CVE-2018-4878, allows an attacker to execute arbitrary code such as an implant the Further investigation into this campaign and analysis of McAfee product telemetry shows that the infection occurred on March 2 and 3 The implant’s first target was a major government-controlled financial organization It next appeared in another Turkish government organization involved in finance and trade A further three large financial institutions in Turkey were victims of this attack The implant has so far not surfaced in any other sector or country This campaign suggests the attackers may plan a future heist against these targets by using Bankshot to gather information The malicious domain falcancoin.io was created December 27, 2017, and was updated on February 19, only a few days before the implants began to appear These implants are variations of earlier forms of Bankshot, a remote access tool that gives an attacker full capability on a victim’s system This implant also contains functionality to wipe files and content from the targeted system to erase evidence or perform other destructive actions Bankshot was first reported by the Department of Homeland Security on December 13, 2017, and has only recently resurfaced in newly compiled variants The sample we analyzed is 99% similar to the documented Bankshot variants from 2017 Bankshot implants hosted on falcancoin.io The Bankshot implant is attached to a malicious Word document with the filename Agreement.docx The document appears to be an agreement template for Bitcoin distribution between an unknown individual in Paris and a to-be-determined cryptocurrency exchange The author of this document is test-pc It was created February 26 and was submitted from the Netherlands The document contains an embedded Flash script that exploits CVE-2018-4878 and downloads and executes the DLL implant from falcancoin.io We discovered two more documents, written in Korean, that exploit the same vulnerability as Agreement.docx These documents appear to be part of the same campaign and may have been used on different targets These documents also communicated with falcancoin.io to install Bankshot and also contain themes around cryptocurrency security Two Flash files exploit CVE-2018-4878 843c17b06a3aee22447f021307909890b68828b9 (February 25) 343ebca579bb888eb8ccb811f9b52280c72e484c (February 25  Malicious documents in the attack Malicious document exploiting CVE-2018-4878 The implants are downloaded via a Flash file embedded in the malicious document They are executed when the victim views the document The malicious site falcancoin.io embedded in the Flash file The implants (DLLs) are disguised as ZIP files and communicate with three control servers, two of them Chinese-language online gambling sites These URLs can be found hardcoded in the implants’ code Hardcoded control server URLs Analyzing Bankshot The sample (a2e966edee45b30bb6bb5c978e55833eec169098) is a Windows DLL that serves as a backdoor and contains a variety of capabilities To mask itself, it can run as a regular library loaded into a legitimate process The malware begins by creating a new thread from the DllMain() function to carry out its malicious activities: New thread created in the malware’s DllMain() function Based on analysis of previous samples, this is a unique identifier user_id is a hardcoded value in the malware binary that is sent to the control server filename is based on static analysis This looks like a specific beacon to indicate that the malware is ready to receive commands The command index calculator and jump to the appropriate command The process is identified by the control server sending the PID to the malware The capability to terminate a process Spawning arbitrary processes A process created as logged-in user This may be used to load additional downloaded components of the attack Loading an arbitrary library into its own process space.  After every action is performed the malware sends a response to the control server indicating whether the action was successful Connections  The US government reports that Bankshot is used by Hidden Cobra to target multiple industries including financial organizations This implant has been connected to a major Korean bank attack and is also known as Trojan Manuscript That variant contained the capability to search for hosts related to the SWIFT network and the same control server strings as the variant we found targeting the Turkish financial sector The implant does not conduct financial transactions; rather it is a channel into the victim’s environment, in which further stages of implants can be deployed for financial reconnaissance The Bankshot implant was also observed in 2017 in documents appearing to come from Latin American banks Malicious document delivering the Bankshot implant in 2017 These connections, combined with the implant’s nearly identical appearance to known variants, are a strong indication that we have uncovered a Hidden Cobra attack Further, previous implants from 2017 contained bogus documents with financially themed content In this campaign, we see the adoption of a recent zero-day Adobe Flash vulnerability to get the implant onto the victim’s systems The campaign has a high chance of success against victims who have an unpatched version of Flash Indicators of Compromise MITRE ATT&CK techniques  Exfiltration over command and control channel Commonly used port Command-line interface Service execution Automated collection Data from local system Process discovery System time discovery Credential dumping Exploitation of vulnerability Process injection File deletion  Hashes  650b7d25f4ed87490f8467eb48e0443fb244a8c4 65e7d2338735ec04fd9692d020298e5a7953fd8d 166e8c643a4db0df6ffd6e3ab536b3de9edc9fb7 a2e966edee45b30bb6bb5c978e55833eec169098  Domains  530hr[dot]com/data/common.php 028xmz[dot]com/include/common.php 168wangpi[dot]com/include/charset.php Falcancoin[dot]io ### Response: .