Lyceum .NET DNS Backdoor

MITRE Techniques

• [T1059] Command and Scripting Interpreter – The macro-enabled Word document triggers AutoOpen() to reveal content and later executes commands via a command execution routine: ‘Once the user enables the macro content, the following AutoOpen() function is executed’ and ‘cmd.exe /c ‘
• [T1055] Process Injection – The backdoor code writes a PE file (DnsSystem.exe) into the Startup folder to maintain persistence and execute via the macro chain: ‘The PE file is then further written into the Startup folder in order to maintain persistence via the macro code’
• [T1562] Disable or Modify Tools – Attackers use anti-analysis tricks and re-packaging to evade security solutions and complicate static analysis: ‘Attackers continuously embrace new anti-analysis tricks to evade security solutions; re-packaging of malware makes static analysis even more challenging.’
• [T1010] Application Window Discovery – The campaign generates a BotID based on the Windows username, revealing local system information used for targeting: ‘Next, the Form Load function generates a unique BotID depending on the current Windows username.’
• [T1018] Remote System Discovery – The DNS-based C2 flow leverages an attacker-controlled DNS server and uses DNS queries to fetch control data: ‘Initialize Attacker-Controlled DNS Server’ and ‘The BeginDigIt function then executes the main DNS resolver function DigIt.’
• [T1057] Process Discovery – The BotID and command-processing flow reflect discovery of local system context to tailor commands: ‘Generates a unique BotID depending on the current Windows username’ and subsequent TXT-record command parsing.
• [T1518] Security Software Discovery – Cloud sandbox/defensive tooling interactions are noted as detection occurs during analysis: ‘The Zscaler Cloud Sandbox successfully detected the malware.’
• [T1071] Application Layer Protocol – DNS is used as the C2 channel: ‘The DNS protocol for command and control (C2) communication which increases stealth’ and ‘the backdoor communicates via DNS TXT/A records.’”