An NCC Group analysis dives into the D0nut extortion group’s TTPs, detailing how they used Cobalt Strike, BYOVD, GPO modifications, RDP, and Rclone-based exfiltration to deploy ransomware. The report links potential ties to HelloXD and other groups like Hive/Ragnar Locker while highlighting rapid encryption across on-prem and hypervisor environments. #D0nut #HelloXD #Hive #RagnarLocker #CobaltStrike #SystemBC #BYOVD #RDP #Rclone #SFTP #xd.exe #wxd7.exe #ESXi #NCCGroup
Keypoints
- D0nut heavily uses Cobalt Strike Beacons to move laterally within the network.
- SystemBC is deployed to establish persistence across the environment.
- A pre-existing GPO is modified to disable Windows Defender and hinder security tooling.
- BYOVD (Bring Your Own Vulnerable Driver) is used to terminate AV/EDR processes.
- RDP is used for lateral movement and data targeting; data exfiltration is performed via Rclone to an SFTP server.
- Ransomware (xd.exe/wxd7.exe) encrypts endpoints, including ESXi-hosted VMs, after data exfiltration.
MITRE Techniques
- [T1059.001] PowerShell – PowerShell was utilized to execute malicious commands. ‘PowerShell was utilized to execute malicious commands.’
- [T1569.002] System Services: Service Execution – Cobalt Strike remotely created temporary services to execute its payload. ‘A service was installed in the system.’
- [T1569.002] System Services: Service Execution – PsExec creates a service to perform its execution. ‘Service Type: user mode service’
- [T1547.001] Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder – SystemBC created a run key entry to establish persistence. ‘powershell.exe -windowstyle hidden -Command …’
- [T1055.002] Process Injection: Portable Executable Injection – def.exe achieved privilege escalation through process injection. ‘process injection…’
- [T1562.001] Impair Defenses: Disable or Modify Tools – The threat actor modified a legitimate GPO to disable Windows Defender functionality. ‘registry configurations to a pre-existing GPO that would disable detection and prevention functionality of Windows Defender.’
- [T1562.001] Impair Defenses: Disable or Modify Tools – def.exe and d.dll were deployed to terminate EDR and AV services. ‘def.exe and d.dll were deployed to terminate EDR and AV services.’
- [T1021.002] SMB/Admin Windows Shares – Cobalt Strike targeted SMB shares for lateral movement. ‘SMB shares for lateral movement’
- [T1021.002] SMB/Admin Windows Shares – PsExec uses SMB shares to execute processes on remote hosts. ‘PsExec uses SMB shares to execute processes on remote hosts’
- [T1021.001] Remote Desktop Protocol – RDP was used to establish sessions to other hosts on the network. ‘Remote Desktop Protocol (RDP) session was established’
- [T1090.002] Proxy: External Proxy – SystemBC communicates with its C2 server via proxies. ‘via proxies’
- [T1048.002] Exfiltration Over Asymmetric Encrypted Non-C2 Protocol – The threat actor exfiltrated data to an SFTP server. ‘exfiltrated data to an SFTP server’
- [T1490] Inhibit System Recovery – Volume shadow copies for a file server were deleted prior to encryption from the ransomware. ‘Volume shadow copies … were purged’
- [T1486] Data Encrypted for Impact – Ransomware was deployed to the estate and impacted both servers and user workstations. ‘Ransomware was deployed to workstations and servers’
- [T1486] Data Encrypted for Impact – Virtual machines hosted on an ESXi server were encrypted at the hypervisor level. ‘ESXi server was impacted, resulting in hosted virtual machines suffering encryption at the hypervisor level.’
Indicators of Compromise
- [URL] Hosted ransomware executable – hxxp[:]//ix[.]io/4uD0
- [IP:PORT] SystemBC C2 – 85.239.52[.]7:4001, 194.87.111[.]29:4001
- [IP Address] SFTP server – 83.149.93[.]150
- [SHA1] Ransomware wxd7.exe – eb876e23dbbfe44c7406fcc7f557ee772894cc0b
- [SHA1] SystemBC explorer.exe – d4832169535e5d91b91093075f3b10b96973a250
- [SHA1] def.exe – 550cd82011df93cc89dc0431fa13150707d6aca2
- [SHA1] RTCore.sys – f6f11ad2cd2b0cf95ed42324876bee1d83e01775
- [File Path] Ransomware executables – C:ProgramDataxd.exe, C:tempxd.exe, C:storagexd.exe, C:Tempwxd7.exe, C:ProgramDatawxd7.exe, C:storagewxd7.exe, C:StorageReportswxd7.exe
- [File Path] SystemBC – C:ProgramDataexplorer.exe
- [File Path] Rclone – C:StorageReportsScheduledexplorer.exe
- [File Path] def.exe, d.dll – C:ProgramDatadef.exe, C:tempdef.exe, C:ProgramDatad.dll, C:tempd.dll
Read more: https://research.nccgroup.com/2023/11/06/d0nut-encrypt-me-i-have-a-wife-and-no-backups/