Article Content UPDATE (Feb 12, 2018): A new variant of the original file-less implant appeared on Feb 5, 2018, indicating the attack has resumed The new variant has the same author and metadata as the original documents discovered in December, as well as a nearly identical implant A key difference, however, is the attackers leveraged hacked servers is Santiago, Chile See indicators of compromise for this update at the bottom of this post ORIGINAL POST (Feb 2, 2018): McAfee Advanced Threat Research (ATR) recently released a report describing a fileless attack targeting organizations involved with the Pyeongchang Olympics The attack used a PowerShell implant that established a channel to the attacker’s server to gather basic system-level data What was not determined at that time was what occurred after the attacker gained access to the victim’s system We have named these implants, which appeared in December 2017, Gold Dragon, Brave Prince, Ghost419, and Running Rat, based on phrases in their code On December 24, 2017, our analysts observed the Korean-language implant Gold Dragon We now believe this implant is the second-stage payload in the Olympics attack that ATR discovered January 6, 2018 However, this implant required additional modules to be executed to be a fully capable backdoor Gold Dragon has a much more robust persistence mechanism than the initial PowerShell implant and enables the attacker to do much more to the target system Gold Dragon reappeared the same day that the Olympics campaign began The Gold Dragon malware appears to have expanded capabilities for profiling a target’s system and sending the results to a control server The PowerShell implant had only basic data-gathering capabilities—such as username, domain, machine name, and network configuration—which are useful only for identifying interesting victims and launching more complex malware against them Gold Dragon Gold Dragon is a data-gathering implant observed in the wild since December 24 Gold Dragon gets its name from the hardcoded domain www.golddragon.com, which we found throughout the samples This sample acts as a reconnaissance tool and downloader for subsequent payloads of the malware infection and payload chain Apart from downloading and executing binaries from the control server, Gold Dragon generates a key to encrypt data that the implant obtains from the system This URL is not used for control; the encrypted data is sent to the server ink.inkboom.co.kr, which was used by previous implants as early as May 2017 Gold Dragon contains elements, code, and similar behavior to implants Ghost419 and Brave Prince, which we have tracked since May 2017 A DLL-based implant created on December 21 (the same day the first malicious Olympics document appeared) was downloaded by a Gold Dragon variant created December 24 This variant was created three days before the targeted spear phishing email with the second document that was sent to 333 victim organizations The December 24 variant of Gold Dragon used the control server nid-help-pchange.atwebpages.com, which was also used by a Brave Prince variant from December 21 The first variants of Gold Dragon appeared in the wild in South Korea in July 2017 The original Gold Dragon had the file name 한글추출.exe, which translates as Hangul Extraction and was seen exclusively in South Korea Five variants of Gold Dragon compiled December 24 appeared heavily during the targeting of the Olympics organizations (HWP is a Korean word processor similar to Microsoft Word.)   Checking for HWP.exe in the process list If found, these processes are terminated by sending a WM_CLOSE message to their windowing threads Terminating an antimalware/cleaner process Brave Prince Brave Prince is a Korean-language implant that contains similar code and behavior to the Gold Dragon variants, specifically the system profiling and control server communication mechanism The malware gathers detailed logs about the victim’s configuration, contents of the hard drive, registry, scheduled tasks, running processes, and more Brave Prince was first observed in the wild December 13, 2017, sending logs to the attacker via South Korea’s Daum email service Later variants posted the data to a web server via an HTTP post command, in the same way that Gold Dragon does The embedded domain braveprince.com The Daum variants of Brave Prince gather information from the system and save it to the file PI_00.dat This file is sent as an attachment to the attacker’s email address The type of data this implant gathers from the victim’s system:  Directories and files Network configuration Address resolution protocol cache Systemconfig to gather tasks  Both variants of Brave Prince can kill a process associated with a tool created by Daum that can block malicious code This tool is exclusive to South Korea taskkill /f /im daumcleaner.exe  The later variants of Brave Prince include the following hardcoded strings:  c:\utils\c2ae_uiproxy.exe c:\users\sales\appdata\local\temp\dwrrypm.dl    Ghost419 Ghost419 is a Korean-language implant that first appeared in the wild December 18, 2017, with the most recent sample appearing two days before the Olympics spear phishing email The malware can be identified by the hardcoded string and URL parameter passed to the control server Ghost419 can be traced to a sample created July 29, 2017, that appears to be a much earlier version (without the hardcoded identifier) The July version shares 46% of its code with samples created in late December This early version implant creates a unique mutex value (kjie23948_34238958_KJ238742) that also appears in a sample from December, with the exception that one digit has changed Ghost419 is based on Gold Dragon and Brave Prince implants and contains shared elements and code, especially for system reconnaissance functions Hardcoded “Ghost419” in the malware binary The string “WebKitFormBoundarywhpFxMBe19cSjFnG,” part of the upload mechanism, also appears in the Gold Dragon variants of late December 2017 Gold Dragon sample Ghost419 sample Numerous other similarities are present in addition to system reconnaissance methods; the communication mechanism uses the same user agent string as Gold Dragon Gold Dragon user agent string Ghost419 user agent string RunningRat RunningRat is a remote access Trojan (RAT) that operates with two DLLs It gets its name from a hardcoded string embedded in the malware Upon being dropped onto a system, the first DLL executes The batch file then attempts to remove itself The first DLL unpacks a resource file attached to the DLL using a zlib decompression algorithm The authors of the malware left the debugging strings in the binary, making the algorithm easy to identify The second DLL is decompressed in memory and never touches the user’s file system; this file is the main RAT that executes This address is hardcoded in the second DLL as 200.200.200.13 and is modified by the first DLL to 223.194.70.136 This type of behavior may indicate this code is being reused or is part of a malware kit The first DLL uses one common antidebugging technique by checking for SeDebugPrivilege However, our current analysis shows no way for such code to be executed McAfee ATR analysts will continue to research RunningRat to determine if this extra code is used or is possibly left over from a larger RAT toolkit The second DLL employs a few additional antidebugging techniques One is the use of a custom exception handler and code paths that are designed to generate exceptions There are also a few random empty-nested threads to slow down researchers during static analysis Conclusion The PowerShell script first discovered by McAfee ATR was delivered via a spear phishing campaign that used image stenography techniques to hide the first-stage implant The implants are delivered as a second stage once the attacker gains an initial foothold using fileless malware Some of the implants will maintain their persistence only if Hangul Word, which is specific to South Korea, is running With the discovery of these implants, we now have a better understanding of the scope of this operation Gold Dragon, Brave Prince, Ghost419, and RunningRat demonstrate a much wider campaign than previously known The persistent data exfiltration we see from these implants could give the attacker a potential advantage during the Olympics We thank Charles Crawford and Asheer Malhotra for their support of this analysis Indicators of Compromise  IPs  223.194.70.136  Domains  trydai.000webhostapp.com follow_dai.000webhostapp.com eodo1.000webhostapp.com nid-help-pchange.atwebpages.com ink.inkboom.co.kr followgho.byethost7.com  Hashes  fef671c13039df24e1606d5fdc65c92fbc1578d9 06948ab527ae415f32ed4b0f0d70be4a86b364a5 96a2fda8f26018724c86b275fe9396e24b26ec9e ad08a60dc511d9b69e584c1310dbd6039acffa0d c2f01355880cd9dfeef75cff189f4a8af421e0d3 615447f458463dc77f7ae3b0a4ad20ca2303027a bf21667e4b48b8857020ba455531c9c4f2560740 bc6cb78e20cb20285149d55563f6fdcf4aaafa58 465d48ae849bbd6505263f3323e818ccb501ba88 a9eb9a1734bb84bbc60df38d4a1e02a870962857 539acd9145befd7e670fe826c248766f46f0d041 d63c7d7305a8b2184fff3b0941e596f09287aa66 35e5310b6183469f4995b7cd4f795da8459087a4 11a38a9d23193d9582d02ab0eae767c3933066ec e68f43ecb03330ff0420047b61933583b4144585 83706ddaa5ea5ee2cfff54b7c809458a39163a7a 3a0c617d17e7f819775e48f7edefe9af84a1446b 761b0690cd86fb472738b6dc32661ace5cf18893 7e74f034d8aa4570bd1b7dcfcdfaa52c9a139361 5e1326dd7122e2e2aed04ca4de180d16686853a7 6e13875449beb00884e07a38d0dd2a73afe38283 4f58e6a7a04be2b2ecbcdcbae6f281778fdbd9f9 389db34c3a37fd288e92463302629aa48be06e35 71f337dc65459027f4ab26198270368f68d7ae77 5a7fdfa88addb88680c2f0d5f7095220b4bbffc1  Indicators of Compromise for Feb 12 update: Hashes   Sha1: 7ae731d666e547b4f3442fe5675c8e8719d8d862  URLs  hxxps://minibodegaslock.cl:443/components/com_tags/controllers/default_tags.php hxxps://minibodegaslock.cl/components/com_tags/controllers/access_log  The post Gold Dragon Widens Olympics Malware Attacks, Gains Permanent Presence on Victims’ Systems appeared first on McAfee Blogs.
Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Article Content UPDATE (Feb 12, 2018): A new variant of the original file-less implant appeared on Feb 5, 2018, indicating the attack has resumed The new variant has the same author and metadata as the original documents discovered in December, as well as a nearly identical implant A key difference, however, is the attackers leveraged hacked servers is Santiago, Chile See indicators of compromise for this update at the bottom of this post ORIGINAL POST (Feb 2, 2018): McAfee Advanced Threat Research (ATR) recently released a report describing a fileless attack targeting organizations involved with the Pyeongchang Olympics The attack used a PowerShell implant that established a channel to the attacker’s server to gather basic system-level data What was not determined at that time was what occurred after the attacker gained access to the victim’s system We have named these implants, which appeared in December 2017, Gold Dragon, Brave Prince, Ghost419, and Running Rat, based on phrases in their code On December 24, 2017, our analysts observed the Korean-language implant Gold Dragon We now believe this implant is the second-stage payload in the Olympics attack that ATR discovered January 6, 2018 However, this implant required additional modules to be executed to be a fully capable backdoor Gold Dragon has a much more robust persistence mechanism than the initial PowerShell implant and enables the attacker to do much more to the target system Gold Dragon reappeared the same day that the Olympics campaign began The Gold Dragon malware appears to have expanded capabilities for profiling a target’s system and sending the results to a control server The PowerShell implant had only basic data-gathering capabilities—such as username, domain, machine name, and network configuration—which are useful only for identifying interesting victims and launching more complex malware against them Gold Dragon Gold Dragon is a data-gathering implant observed in the wild since December 24 Gold Dragon gets its name from the hardcoded domain www.golddragon.com, which we found throughout the samples This sample acts as a reconnaissance tool and downloader for subsequent payloads of the malware infection and payload chain Apart from downloading and executing binaries from the control server, Gold Dragon generates a key to encrypt data that the implant obtains from the system This URL is not used for control; the encrypted data is sent to the server ink.inkboom.co.kr, which was used by previous implants as early as May 2017 Gold Dragon contains elements, code, and similar behavior to implants Ghost419 and Brave Prince, which we have tracked since May 2017 A DLL-based implant created on December 21 (the same day the first malicious Olympics document appeared) was downloaded by a Gold Dragon variant created December 24 This variant was created three days before the targeted spear phishing email with the second document that was sent to 333 victim organizations The December 24 variant of Gold Dragon used the control server nid-help-pchange.atwebpages.com, which was also used by a Brave Prince variant from December 21 The first variants of Gold Dragon appeared in the wild in South Korea in July 2017 The original Gold Dragon had the file name 한글추출.exe, which translates as Hangul Extraction and was seen exclusively in South Korea Five variants of Gold Dragon compiled December 24 appeared heavily during the targeting of the Olympics organizations (HWP is a Korean word processor similar to Microsoft Word.)   Checking for HWP.exe in the process list If found, these processes are terminated by sending a WM_CLOSE message to their windowing threads Terminating an antimalware/cleaner process Brave Prince Brave Prince is a Korean-language implant that contains similar code and behavior to the Gold Dragon variants, specifically the system profiling and control server communication mechanism The malware gathers detailed logs about the victim’s configuration, contents of the hard drive, registry, scheduled tasks, running processes, and more Brave Prince was first observed in the wild December 13, 2017, sending logs to the attacker via South Korea’s Daum email service Later variants posted the data to a web server via an HTTP post command, in the same way that Gold Dragon does The embedded domain braveprince.com The Daum variants of Brave Prince gather information from the system and save it to the file PI_00.dat This file is sent as an attachment to the attacker’s email address The type of data this implant gathers from the victim’s system:  Directories and files Network configuration Address resolution protocol cache Systemconfig to gather tasks  Both variants of Brave Prince can kill a process associated with a tool created by Daum that can block malicious code This tool is exclusive to South Korea taskkill /f /im daumcleaner.exe  The later variants of Brave Prince include the following hardcoded strings:  c:\utils\c2ae_uiproxy.exe c:\users\sales\appdata\local\temp\dwrrypm.dl    Ghost419 Ghost419 is a Korean-language implant that first appeared in the wild December 18, 2017, with the most recent sample appearing two days before the Olympics spear phishing email The malware can be identified by the hardcoded string and URL parameter passed to the control server Ghost419 can be traced to a sample created July 29, 2017, that appears to be a much earlier version (without the hardcoded identifier) The July version shares 46% of its code with samples created in late December This early version implant creates a unique mutex value (kjie23948_34238958_KJ238742) that also appears in a sample from December, with the exception that one digit has changed Ghost419 is based on Gold Dragon and Brave Prince implants and contains shared elements and code, especially for system reconnaissance functions Hardcoded “Ghost419” in the malware binary The string “WebKitFormBoundarywhpFxMBe19cSjFnG,” part of the upload mechanism, also appears in the Gold Dragon variants of late December 2017 Gold Dragon sample Ghost419 sample Numerous other similarities are present in addition to system reconnaissance methods; the communication mechanism uses the same user agent string as Gold Dragon Gold Dragon user agent string Ghost419 user agent string RunningRat RunningRat is a remote access Trojan (RAT) that operates with two DLLs It gets its name from a hardcoded string embedded in the malware Upon being dropped onto a system, the first DLL executes The batch file then attempts to remove itself The first DLL unpacks a resource file attached to the DLL using a zlib decompression algorithm The authors of the malware left the debugging strings in the binary, making the algorithm easy to identify The second DLL is decompressed in memory and never touches the user’s file system; this file is the main RAT that executes This address is hardcoded in the second DLL as 200.200.200.13 and is modified by the first DLL to 223.194.70.136 This type of behavior may indicate this code is being reused or is part of a malware kit The first DLL uses one common antidebugging technique by checking for SeDebugPrivilege However, our current analysis shows no way for such code to be executed McAfee ATR analysts will continue to research RunningRat to determine if this extra code is used or is possibly left over from a larger RAT toolkit The second DLL employs a few additional antidebugging techniques One is the use of a custom exception handler and code paths that are designed to generate exceptions There are also a few random empty-nested threads to slow down researchers during static analysis Conclusion The PowerShell script first discovered by McAfee ATR was delivered via a spear phishing campaign that used image stenography techniques to hide the first-stage implant The implants are delivered as a second stage once the attacker gains an initial foothold using fileless malware Some of the implants will maintain their persistence only if Hangul Word, which is specific to South Korea, is running With the discovery of these implants, we now have a better understanding of the scope of this operation Gold Dragon, Brave Prince, Ghost419, and RunningRat demonstrate a much wider campaign than previously known The persistent data exfiltration we see from these implants could give the attacker a potential advantage during the Olympics We thank Charles Crawford and Asheer Malhotra for their support of this analysis Indicators of Compromise  IPs  223.194.70.136  Domains  trydai.000webhostapp.com follow_dai.000webhostapp.com eodo1.000webhostapp.com nid-help-pchange.atwebpages.com ink.inkboom.co.kr followgho.byethost7.com  Hashes  fef671c13039df24e1606d5fdc65c92fbc1578d9 06948ab527ae415f32ed4b0f0d70be4a86b364a5 96a2fda8f26018724c86b275fe9396e24b26ec9e ad08a60dc511d9b69e584c1310dbd6039acffa0d c2f01355880cd9dfeef75cff189f4a8af421e0d3 615447f458463dc77f7ae3b0a4ad20ca2303027a bf21667e4b48b8857020ba455531c9c4f2560740 bc6cb78e20cb20285149d55563f6fdcf4aaafa58 465d48ae849bbd6505263f3323e818ccb501ba88 a9eb9a1734bb84bbc60df38d4a1e02a870962857 539acd9145befd7e670fe826c248766f46f0d041 d63c7d7305a8b2184fff3b0941e596f09287aa66 35e5310b6183469f4995b7cd4f795da8459087a4 11a38a9d23193d9582d02ab0eae767c3933066ec e68f43ecb03330ff0420047b61933583b4144585 83706ddaa5ea5ee2cfff54b7c809458a39163a7a 3a0c617d17e7f819775e48f7edefe9af84a1446b 761b0690cd86fb472738b6dc32661ace5cf18893 7e74f034d8aa4570bd1b7dcfcdfaa52c9a139361 5e1326dd7122e2e2aed04ca4de180d16686853a7 6e13875449beb00884e07a38d0dd2a73afe38283 4f58e6a7a04be2b2ecbcdcbae6f281778fdbd9f9 389db34c3a37fd288e92463302629aa48be06e35 71f337dc65459027f4ab26198270368f68d7ae77 5a7fdfa88addb88680c2f0d5f7095220b4bbffc1  Indicators of Compromise for Feb 12 update: Hashes   Sha1: 7ae731d666e547b4f3442fe5675c8e8719d8d862  URLs  hxxps://minibodegaslock.cl:443/components/com_tags/controllers/default_tags.php hxxps://minibodegaslock.cl/components/com_tags/controllers/access_log  The post Gold Dragon Widens Olympics Malware Attacks, Gains Permanent Presence on Victims’ Systems appeared first on McAfee Blogs. ### Response: .