A cluster of phishing attacks targeting Pakistan used MSC files with GrimResource to execute obfuscated JavaScript and deliver Mythic-based remote access trojans, with indicators linking the activity to Patchwork using a Dark Samurai/OceanLotus false-flag. Key artifacts include DismCore.dll (Mythic RAT), MSC/HTML lure files, and multiple malicious domains/C2 URLs. #Patchwork #Mythic
Keypoints
- Attackers sent spear-phishing messages delivering .msc files disguised as PDFs; MSC files used GrimResource to run embedded JavaScript and fetch follow-up payloads.
- JavaScript was multi-layer obfuscated; scripts wrote a lure PDF to C:UsersPublic and decoded/wrote a DLL to C:ProgramData then registered a scheduled task for persistence.
- DismCore.dll (MD5 8b0ae47f442a7bf71d8973bc7f3deca7) acts as a Mythic-based RAT, exporting malicious DllRegisterServer and performing C2 communication using AES/HMAC with WinHTTP POSTs.
- C2 infrastructure includes cloudfront-hosted path (d11d6t6zp1jvtm.cloudfront.net/data) and multiple malicious domains hosting lure pages and PHP endpoints.
- Behavior includes copying legitimate Dism.exe, loading malicious DLL, creating scheduled task MicrosoftEdgeUpdateTaskMachineCoreXUI, using hostnames for semaphore creation, and data-stealing modules (browser master keys/password decryption).
- Sample timestamps and network indicators, plus URL patterns and Protego sample associations, led analysts to attribute the campaign to Patchwork and label Dark Samurai as a false-flag of OceanLotus.
- Notable sample artifacts: Drone_Information.pdf.msc (MD5 dd802736eeb826079fa8a0cd08d74c0e), Unit-942-Drone-Info-MAK3.html (MD5 f0c8db7847e5593579d33018f90de8df), and DismCore.dll (MD5 8b0ae47f442a7bf71d8973bc7f3deca7).
MITRE Techniques
- [T1566] Phishing – Attackers sent spear-phishing emails with links to download compressed packages containing MSC files disguised as PDFs to obtain initial access. Quote: ‘发送“xxx”为主题的钓鱼邮件，诱使受害者点击钓鱼链接下载压缩包，内含伪装为PDF的msc文件’
- [T1218] Signed Binary Proxy Execution (mshta, regsvr32, rundll32, etc.) – Abuse of mmc.exe and copying/loading Dism.exe to load a malicious DLL in a white-then-black manner. Quote: ‘mmc.exe 触发 ActiveX 对象… 复制 Dism.exe 到本地并加载释放的恶意 DLL，以白加黑方式加载Mythic远控木马’
- [T1059] Command and Scripting Interpreter – Execution of multiple layers of obfuscated JavaScript (JScript) including XSL transformation to run remote JavaScript payloads. Quote: ‘利用 JScript 执行 XSL 转换… 请求嵌入在 StringTable 字段中url远程执行 javaScript代码’
- [T1547] Boot or Logon Autostart Execution – Creation of scheduled tasks and system startup items (MicrosoftEdgeUpdateTaskMachineCoreXUI) for persistence. Quote: ‘设置名为MicrosoftEdgeUpdateTaskMachineCoreXUI的计划任务’
- [T1105] Ingress Tool Transfer – JavaScript downloads and writes additional payloads (lure PDF and DismCore.dll) to disk from remote URLs. Quote: ‘下载诱饵文件到C:UsersPublicDrone_Information.pdf… 写入C:ProgramData… DismCore.dll’
- [T1027] Obfuscated Files or Information – Multi-layer JavaScript obfuscation, custom decoding (character flip, replacements, hex conversion, base64) to hide payloads. Quote: ‘第二层JavaScript混淆代码… 解码过程：翻转字符，替换$为4，替换!为1，转为十六进制，转为字符串，base64解码’
- [T1041] Exfiltration Over C2 Channel – Encrypted communications to C2 using AES/HMAC and POST via WinHTTP, checkin/action fields matching Mythic agent telemetry. Quote: ‘使用到 aes_hmac 加密通信内容… 使用WinHTTP API ，以POST方法发送数据… “action”:”checkin”… 与开源Mythic远控木马一致.’
Indicators of Compromise
- [Domains] malicious landing pages/C2 and hosting – funen.org, lymetrax.org (and other listed domains such as snugluxe.org, tamolwebtech.org)
- [URLs] lure pages and PHP endpoints – https://tamolwebtech.org/bIHTfcVHegEoMrv/WCcod7JY3zwUpDH.php, https://caapakistaan.com/ncUiihbouibCIOWoin983oi/Unit-942-Drone-Info-MAK3.html
- [Cloudfront C2] C2 data endpoint – d11d6t6zp1jvtm.cloudfront.net/data
- [File names] lure and payload filenames – DismCore.dll (Mythic RAT), Drone_Information.pdf.msc, Aviation_Telecom_Collaboration_Proposal_Template.xlsx.msc
- [File hashes] malware sample hashes – DismCore.dll: 8b0ae47f442a7bf71d8973bc7f3deca7; Drone_Information.pdf.msc: dd802736eeb826079fa8a0cd08d74c0e (and 1 more hash f0c8db7847e5593579d33018f90de8df)
Read more: https://www.ctfiot.com/269659.html