This report analyzes a multi-stage implant operation targeting industrial organizations in Eastern Europe, focusing on persistent access, data gathering (including from air-gapped systems), and data exfiltration via cloud services. It details a three-layer implant stack and two exfiltration tools that rely on cloud storage (Dropbox and Yandex Disk) and other file-sharing services to stage and move stolen data. Hashtags: #Dropbox #YandexDisk #AuditSvc #transfer.exe
Keypoints
- Identified over 15 implants and their variants deployed in various combinations.
- Three-stack architecture: first-stage (persistence and initial data gathering), second-stage (data/file gathering including from air-gapped systems), and third-stage (uploading data to C2).
- Third-stage implants share traits with first-stage implants, including cloud-storage usage (Dropbox/Yandex Disk), code obfuscation, and DLL hijacking.
- A dedicated “stack” uploads files to Dropbox via a three-implant chain, enabling flow changes by swapping a module.
- Second-stage variants evolved to enumerate Outlook folder names, perform remote commands, and upload .rar files to Dropbox via the third-stage implant.
- Manual exfiltration tools (AuditSvc.exe and transfer.exe) facilitate uploading data to Yandex Disk and multiple temporary file-sharing services.
MITRE Techniques
- [T1566.001] Phishing: Spearphishing Attachment – “Threat actors used lure documents to deploy off-the-shelf spyware.”
- [T1204.002] User Execution: Malicious File – “A system is infected when the user runs the malware believing it to be a legitimate document.”
- [T1059.003] Command and Scripting Interpreter: Windows Command Shell – “Uses cmd.exe to execute multiple commands.”
- [T1106] Native API – “Uses CreateProcessW function to execute Windows Command Line.”
- [T1053.005] Scheduled Task/Job: Scheduled Task – “Malware is executed via a Windows task created by the threat actor.”
- [T1547.001] Registry Run Keys / Startup Folder – “Malware achieves persistence by adding itself to the Registry as a startup program.”
- [T1543.003] Create or Modify System Process: Windows Service – “Installs itself as a service to achieve persistence.”
- [T140] Deobfuscate/Decode Files or Information – “Uses an RC4 key to decrypt the malware configuration as well as communication.”
- [T1055.002] Process Injection: Portable Executable Injection – “Malware injects itself into various legitimate processes upon execution (msiexec.exe, svchost.exe).”
- [T1497.001] System Checks – “Employs various system checks to detect and avoid virtualization and analysis environments.”
- [T1497.003] Time Based Evasion – “Employs various time-based methods to detect virtualization and analysis environments.”
- [T1574.002] Hijack Execution Flow: DLL Side-Loading – “Threat actors abused a legitimate application binary to load a malicious DLL.”
- [T1083] File and Directory Discovery – “The malware attempts to discover files of various types (.doc, .docx, .xls, .xlsx, .ppt, .pptx, .pdf, .rtf, .eml).”
- [T1016] System Network Configuration Discovery – “Threat actors use the netstat and ipconfig utilities to get local network interface configuration and enumerate open ports.”
- [T1033] System Owner/User Discovery – “Threat actors use the systeminfo, whoami, and net utilities to get information about the user and the infected system.”
- [T1057] Process Discovery – “Threat actors use tasklist to enumerate running processes.”
- [T1071.001] Application Layer Protocol: Web Protocols – “Malware uses HTTPS and raw TCP for communication with C2.”
- [T1573.001] Encrypted Channel: Symmetric Cryptography – “Malware uses RC4 and SSL TLS v3 (by libssl.dll) to encrypt communication.”
- [T1003.004] OS Credential Dumping: Cached Domain Credentials – “Threat actors use Mimikatz and Reg to extract cached credentials.”
- [T1041] Exfiltration Over C2 Channel – “Threat actors exfiltrate data using Dropbox, Yandex Disk, Yandex email and temporary file sharing services as a C2 channel.”
Indicators of Compromise
- [MD5] context – 1A1B8EFE8D72984C4744662D2D233C02, 03C74722A8E6E5E7EA0A5ED0C9F23696, and other hashes (e.g., 6 more hashes)
- [URL] context – img[.]onl/api/upload.php, litterbox.catbox[.]moe/resources/internals/api.php, imgbb[.]com, and 2 more URLs
- [Domain] context – dropbox.com, yandex.ru
- [IP] context – local IP address used as C2 endpoint