$100k in Crypto Drained by the Underground Operation

MITRE Techniques

• [T1055 ] Process Injection – The loader injects a self-decrypting payload into a suspended process and later injects scripts into browser sessions (‘uses section-based injection to place a self-decrypting payload into a suspended dllhost.exe process’; ‘injects its scripts into those sessions’)
• [T1204 ] User Execution – The infection begins when the victim opens a lure archive that contains the setup binary (‘The infection starts from a versioned lure archive, unencrypted 7z or zip files containing setup.exe’)
• [T1105 ] Ingress Tool Transfer – The setup binary launches the loader and stages the malware components from the archive (‘The setup binary launches the Underground loader’; ‘contains setup.exe, a trojanized msys-crypto-3.dll, and an encrypted data.bin’)
• [T1562.001 ] Impair Defenses: Disable or Modify Tools – The stealer disables withdrawal allow lists before draining the account (‘it disables the withdrawal allow list’)
• [T1082 ] System Information Discovery – The loader checks running processes to detect analysis and monitoring environments (‘compares it against the running processes to detect an analysis or monitoring environment’)
• [T1057 ] Process Discovery – The loader enumerates running processes and matches them against a hard-coded list (‘compares it against the running processes’)
• [T1497.001 ] Virtualization/Sandbox Evasion: System Checks – The anti-analysis list includes VM and sandbox tools to avoid execution in analysis environments (‘virtual-machine and sandbox agents (VMware, VirtualBox, QEMU guest tools)’)
• [T1518.001 ] Software Discovery: Security Software Discovery – The loader checks for debugging, monitoring, and network-analysis tools such as IDA, Wireshark, and Process Explorer (‘covers debuggers and disassemblers … network sniffers … process monitors’)
• [T1056.001 ] Input Capture: Keylogging – The clipper and webmail injection intercept user-entered or displayed sensitive payment and confirmation data in-browser (‘rewrites its subject and body’; ‘when the victim copies a wallet address, the clipper replaces it’)
• [T1119 ] Automated Collection – The stealer automatically collects browser cookies, passwords, wallets, and screenshots (‘collecting Chromium and Gecko cookies and passwords … desktop and extension wallets, and screenshots’)
• [T1021 ] Remote Services – The payload operates within authenticated browser sessions on the victim’s machine to interact with online services (‘launches Chrome or Edge … under the victim’s own browser profile’)