DCRAT Impersonating the Colombian Government

MITRE Techniques

• [T1059.005] Command and Scripting Interpreter: Visual Basic – The attack uses an obfuscated VBS file downloaded from a pastebin-like service to execute subsequent payload stages (‘The ZIP attachment contains a bat file which will drop an obfuscated vbs file from a pastebin like website to C:WindowsTemp’).
• [T1027] Obfuscated Files or Information – The VBScript and PowerShell code are heavily obfuscated and base64 encoded to evade detection (‘The vbs file is heavily obfuscated and is made to trick analysts and systems’).
• [T1140] Deobfuscate/Decode Files or Information – The malware decodes base64-encoded scripts and extracts hidden data from an image using steganography (‘This script sets a reversed URL as a variable and points it to an image which contains data hidden with base64’).
• [T1105] Ingress Tool Transfer – The final payload is downloaded from a remote URL embedded within steganographic image data (‘…invoke a .NET library to download the third and final payload from the reversed URL to C:UsersPublicDownloads’).
• [T1071.001] Application Layer Protocol: Web Protocols – The malware communicates with a hardcoded C2 server or can retrieve the C2 address from a remote URL (‘the RAT enters an infinite loop, continuously attempting to connect to its command-and-control (C2) server’).
• [T1218.005] Signed Binary Proxy Execution: Mshta – The malware uses cmd and schtasks commands to create persistence and execute decoded payloads (‘…spawns a hidden cmd process to execute a base64-decoded command string… schtasks /create …’).
• [T1543.003] Create or Modify System Process: Windows Service – Persistence is created through scheduled tasks or registry run keys depending on user privileges (‘…register the malware binary as a scheduled task for persistence… creates a registry entry under HKCU if admin privileges are not present’).
• [T1574.001] Hijack Execution Flow: DLL Search Order Hijacking – AMSI bypass attempts are made by patching amsi.dll in memory to disable scanning (‘The function proceeds to load amsi.dll into memory and retrieves the address of the AmsiScanBuffer function… inject a patch into this memory location’).
• [T1547.001] Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder – Registry modifications ensure execution on user logon (‘…creates a registry entry under HKCUSOFTWAREMicrosoftWindowsCurrentVersionRun…’).
• [T1083] File and Directory Discovery – The malware compares paths and enumerates running processes to terminate those running from specific folders (‘…iterates through all running processes and terminates any that are executing from the Install_Folder location’).