Antlion, a Chinese APT, deployed a custom .NET loader called xPack to compromise Taiwanese targets, focusing on financial and manufacturing organizations and conducting extended credential dumping and data staging. The operation used a mix of custom loaders and living-off-the-land techniques, including Kerberos-related abuse and remote access tools, to maintain access and exfiltrate sensitive information.
Hashtags: #Antlion #xPack #EHAGBPSL #JpgRun #CheckID #NetSessionEnum #Mimikatz #GoldenTicket #Taiwan #FinancialInstitution
Hashtags: #Antlion #xPack #EHAGBPSL #JpgRun #CheckID #NetSessionEnum #Mimikatz #GoldenTicket #Taiwan #FinancialInstitution
Keypoints
- Antlion used a custom backdoor (xPack) as the main loader to decrypt, load, and execute payloads, including additional loaders and a keylogger.
- The operations targeted Taiwan, impacting a financial organization and a manufacturing company, with long dwell times (about 9 months on one victim).
- The likely initial access vector was exploitation of a web application or service, though phishing emails were also noted historically for access.
- Attackers relied on living-off-the-land tools (PowerShell, WMIC, PsExec, LSASS, ProcDump) and custom tools (NetSessionEnum, ENCODE MMC) to enumerate, dump credentials, and move laterally.
- Credential dumping was a major focus (registry hives, LSASS dumps, and Mimikatz-based activity), enabling lateral movement and data exfiltration.
- Exfiltration used WinRAR for data leakage and the BitsTransfer PowerShell module for uploads to attacker infrastructure; some data was staged but not fully exfiltrated.
- Indicators include several custom loaders (EHAGBPSL, JpgRun, CheckID) and a Kerberos golden ticket tool based on Mimikatz for privilege escalation.
MITRE Techniques
- [T1190] Exploit Public-Facing Application – The infection vector was likely exploitation of a web application or service. “The most likely infection vector was exploitation of a web application or service.”
- [T1059.001] PowerShell – Living-off-the-land usage for various commands and data collection. “living-off-the-land tools such as PowerShell, WMIC, ProcDump, LSASS, and PsExec.”
- [T1047] Windows Management Instrumentation – WMIC was used to execute commands and collect information. “WMIC was used to execute two commands.”
- [T1059.003] Command Shell – Command prompt usage to execute commands (e.g., ” “;cmd”; /K CHCP 950″).
- [T1003] Credential Dumping – Dumping credentials via registry and LSASS, enabling lateral movement. “Five minutes after those commands were issued, WMIC was used to dump credentials” and “reg save HKLMSAM …”
- [T1550.003] Kerberos Golden Ticket – Kerberos-based privilege escalation using Mimikatz. “Kerberos golden ticket tool based on Mimikatz.”
- [T1021.002] Remote Services – Use of SMB/shares to transfer/download malicious files and move laterally. “download malicious files via SMB shares” and “SMB session enumeration.”
- [T1041] Exfiltration – Data exfiltration via BitsTransfer and WinRAR-based archives. “BitsTransfer module to initiate an upload” and “Legitimate WinRAR appear to have been exploited.”
- [T1560] Data Staged – Data staged for exfiltration before actual transfer. “data was likely staged for further exfiltration.”
- [T1053.005] Scheduled Task – Remote scheduled tasks to execute the backdoor. “remote scheduled tasks to execute their backdoor.”
- [T1068] Privilege Escalation – Elevation-of-privilege exploitation (CVE-2019-1458). “CVE-2019-1458 is an elevation-of-privilege vulnerability.”
Indicators of Compromise
- [SHA2] Hash – 12425edb2c50eac79f06bf228cb2dd77bb1e847c4c4a2049c91e0c5b345df5f2 – Description: xPack
- [SHA2] Hash – 85867a8b4de856a943dd5efaaf3b48aecd2082aa0ceba799df53ba479e4e81c5 – Description: xPack
- [SHA2] Hash – e4a15537f767332a7ed08009f4e0c5a7b65e8cbd468eb81e3e20dc8dfc36aeed – Description: xPack
- [SHA2] Hash – 9456d9a03f5084e44f8b3ad936b706a819ad1dd89e06ace612351b19685fef92 – Description: xPack
- [SHA2] Hash – 730552898b4e99c7f8732a50ae7897fb5f83932d532a0b8151f3b9b13db7d73c – Description: xPack
- [File name] htable.xsl – Suspicious output file from WMIC commands
- [File name] update.vbs – Unknown VBScript executed via PsExec
- [File name] 16.dmp – Dump of LSASS-related data (renamed Procdump)
- [File name] publicsam.hive / security.hiv / sam.hiv – Registry hive dumps used in credential extraction
- [Tool] Mimikatz – Kerberos golden ticket tool used for credential access
- [Process] NetSessionEnum – Custom SMB session enumeration tool