SmallTiger Malware Targets South Korean Businesses: Kimsuky and Andariel Attacks

MITRE Techniques

• [T1059.001] PowerShell – “Execute PowerShell commands” used during operation.
  Quoted: ‘Execute PowerShell commands’
• [T1218.005] Mshta – “The downloaded JavaScript creates a payload that is included internally at the … path—and runs it using rundll32”.
  Quoted: ‘download a malicious JavaScript from the C&C server using the mshta command and runs it.’
• [T1218.011] Rundll32 – “runs it using rundll32” to execute payloads from ADS areas.
  Quoted: ‘…and runs it using rundll32.’
• [T1055] Process Injection – “DurianBeacon loads a DLL created in the…dll path and calls the RyXmqIUMXViyw6Uvkf() function”.
  Quoted: ‘loads a DLL created in the ‘%SystemDirectory%OGPWm4uRZ0CAkHZ9oc0FcEpj86LSNmZ5.dll’ path and calls the RyXmqIUMXViyw6Uvkf() function.’
• [T1027] Obfuscated/Compressed Files and Information – “decrypts three files that exist in the resource and installs them … decrypts the files to execute them inside the memory.”
  Quoted: ‘decrypts three files that exist in the resource and decrypts the files to execute them inside the memory.’
• [T1082] System Information Discovery – “The DurianBeacon … sends the infected system’s IP information, user name, desktop name, architecture, and file names”.
  Quoted: ‘sends the infected system’s IP information, user name, desktop name, architecture, and file names before awaiting commands.’
• [T1083] File and Directory Discovery – “Look up directory”.
  Quoted: ‘Look up directory’
• [T1105] Ingress Tool Transfer – “download a payload” and “downloads a payload to execute in memory”.
  Quoted: ‘download a payload and executes it inside the memory.’
• [T1041] Exfiltration Over C2 Channel – “Upload files” during operation.
  Quoted: ‘Upload files’
• [T1090] Proxy – “Socks Proxy” capability used for relaying traffic.
  Quoted: ‘Socks Proxy’
• [T1573.001] TLS – “uses the SSL protocol to communicate with the C&C server”.
  Quoted: ‘uses the SSL protocol to communicate with the C&C server.’
• [T1003.001] Credential Dumping – “Mimikatz and ProcDump … dumped memory of the LSASS process”.
  Quoted: ‘dumped the memory of the LSASS process using the ProcDump tool to hijack the infected system’s credentials.’
• [T1555.003] Credentials in Web Browsers – “NirSoft’s WebBrowserPassView and browser credential theft”.
  Quoted: ‘the memory of NirSoft’s WebBrowserPassView and web browser was also discovered…’
• [T1021.001] Remote Desktop Protocol – “MultiRDP patches the memory of the currently running remote desktop service … with RDP”.
  Quoted: ‘patches the memory of the currently running remote desktop service so that multiple users can connect with remote desktop protocol (RDP).’