CrowdStrike Falcon® Platform Identifies Supply Chain Attack via a Trojanized Comm100 Chat Installer – crowdstrike.com

MITRE Techniques

• [T1195] Supply Chain Compromise – The attackers delivered malware via a signed Comm100 installer that could be downloaded from the company’s website as recently as the morning of September 29, 2022. ‘Malware was delivered via a signed Comm100 installer that could be downloaded from the company’s website as recently as the morning of September 29, 2022.’
• [T1105] Ingress Tool Transfer – The backdoor downloads and executes a second-stage script from URL http[:]//api.amazonawsreplay[.]com/livehelp/collect. ‘The backdoor downloads and executes a second-stage script from URL http[:]//api.amazonawsreplay[.]com/livehelp/collect.’
• [T1218] Signed Binary Proxy Execution – The attacker loaded a malicious DLL named MidlrtMd.dll executed by a legitimate copy of a Microsoft Metadata Merge Utility (mdmerge.exe) binary via DLL search-order hijacking. ‘executed by a legitimate copy of a Microsoft Metadata Merge Utility (mdmerge.exe) binary via DLL search-order hijacking.’
• [T1574.001] Hijack Execution Flow: DLL Search Order Hijacking – A loader DLL MidlrtMd.dll was loaded through DLL search-order hijacking using a legitimate mdmerge.exe binary. ‘via DLL search-order hijacking.’
• [T1059.003] Windows Command Shell – The backdoor provides remote shell functionality by spawning a new instance of cmd.exe. ‘spawning a new instance of cmd.exe.’
• [T1082] System Information Discovery – The backdoor gathers host information before providing the actor with remote shell functionality. ‘gathers host information before providing the actor with remote shell functionality by spawning a new instance of cmd.exe.’
• [T1027] Obfuscated/Encrypted Files and Information – The second-stage script consists of obfuscated JS containing a backdoor and RC4-encrypted payload. ‘The second-stage script consists of obfuscated JS containing a backdoor that gathers host information before providing the actor with remote shell functionality by spawning a new instance of cmd.exe.’
• [T1055] Process Injection – The decrypted payload injects an embedded payload into a new instance of notepad.exe. ‘injected into an embedded payload into a new instance of notepad.exe.’
• [T1071.001] Web Protocols – C2 communications to api.amazonawsreplay[.]com and related domains. ‘C2 domain-naming convention using Microsoft and Amazon-themed domains along with api. subdomains’ and ‘The backdoor connects to the malicious C2 domain api.microsoftfileapis[.]com.’