Keypoints
- Three tools comprise a related activity cluster: Agent Racoon backdoor, Ntospy Network Provider DLL, and a Mimilite variant of Mimikatz.
- Ntospy implements a Network Provider module to hijack authentication and steal credentials, using specific file paths and a credman registry entry.
- Agent Racoon uses a DNS-based covert channel for C2 and supports backdoor actions like command execution and file transfer.
- Mimilite dumps credentials and exfiltrates data (emails, Roaming Profile) using PowerShell and other utilities; exfiltration includes PSTs and compressed archives.
- Attack patterns include masquerading as legitimate Microsoft Update files, use of scheduled tasks for persistence, and obfuscated/encoded C2 domains.
- MITRE mapping covers OS credential dumping, network provider abuse, DNS-based C2, data exfiltration over C2, and various defense-evasion techniques.
MITRE Techniques
- [T1003] OS Credential Dumping – Credential dumping performed via Ntospy Network Provider DLL to harvest credentials during authentication. Quote: “…hijack the authentication process, to get access to the user credentials every time the victim attempts to authenticate to the system.”
- [T1556.008] Modify Authentication Process: Network Provider DLL – The threat registers a new Network Provider named credman to hijack credentials. Quote: “registers a new Network Provider called credman.”
- [T1027.009] Obfuscated Files or Information: Embedded Payloads – Some samples store credentials in a Microsoft Update Package-like path with plain text or encrypted paths to evade detection. Quote: “files with .msu extensions masquerade as Microsoft Update Package.”
- [T1036.005] Masquerading: Match Legitimate Name or Location – DLLs and file paths masquerade as legitimate system/Windows components (e.g., ntoskrnl.dll, .msu names). Quote: “abusing the Microsoft Update Package extension”
- [T1041] Exfiltration Over C2 Channel – Data, including emails and Roaming Profiles, exfiltrated over DNS/C2 channels and web services. Quote: “Exfiltrate confidential information”
- [T1046] Network Service Discovery – Network scanning and discovery to support C2 and data theft. Quote: “network scan”
- [T1047] Windows Management Instrumentation – Use context around MS Exchange Server environment for authentication-related activity (Windows management utilities context). Quote: “in an MS Exchange Server environment.”
- [T1053.005] Scheduled Task/Job: Scheduled Task – Persistence achieved via scheduled tasks. Quote: “the threat was executed by using scheduled tasks.”
- [T1059.001] Command and Scripting Interpreter: PowerShell – PowerShell usage for email collection and related operations. Quote: “PowerShell snap-ins to dump the emails.”
- [T1059.003] Command and Scripting Interpreter: Windows Command Shell – Command-line tooling used during operations (e.g., RAR/compression and scanning). Quote: “command-line RAR tool”
- [T1070.004] Indicator Removal: File Deletion – Cleanup of the environment after sessions. Quote: “clean up the environment used during the session.”
- [T1573.001] Encrypted Channel: Symmetric Cryptography – All C2 communications encrypted with a stream cipher. Quote: “encryption of all the communication messages through Program.Util.RC.”
- [T1583.001] Acquire Infrastructure: Domains – Use of numerous C2 domains (e.g., geoinfocdn[.]com, geostatcdn[.]com). Quote: “C2 domains identified”
- [T1583.002] Acquire Infrastructure: DNS Server – DNS-based C2 communication with DNS subdomains and IDNA/Punycode. Quote: “The domain names follow the pattern below”
- [T1587.001] Develop Capabilities: Malware – Tools developed/customized for this cluster (Agent Racoon, Ntospy, Mimilite). Quote: “developed capabilities: malware”
- [T1560.001] Archive Collected Data: Archive via Utility – Exfiltration of Roaming Profile via 7-Zip and certutil-based staging. Quote: “standalone version of the 7-Zip tool”
- [T1112] Modify Registry – Registry key path for credman service. Quote: “HKLMSYSTEMCurrentControlSetServicescredman”
- [T1132.001] Data Encoding: Standard Encoding – Use of IDNA/Punycode for DNS domain encoding. Quote: “IDNA domain names with Punycode encoding”
- [T1134.001] Email Collection – Exfiltration of emails from Exchange via PowerShell. Quote: “Email Collection”
Indicators of Compromise
- [SHA256] – 2632bcd0715a7223bda1779e107087964037039e1576d2175acaf61d3759360f – File path C:WindowsTempinstall.bat (Context: Script activity linked to the initial Ntospy activity)
- [SHA256] – ae989e25a50a6faa3c5c487083cdb250dde5f0ecc0c57b554ab77761bdaed996 – File path C:WindowsTempinstall.bat (Context: Script/loader for payload)
- [File Path] – c:/programdata/microsoft/~ntuserdata.msu, c:/programdata/packag~1/windows 6.1-kb4537803.msu – File paths used to store stolen credentials
- [File Path] – c:/programdata/package cache/windows10.0-kb5009543-x64.msu, c:/programdata/package cache/windows10.0-kb5000736-x64.msu – Additional credential stores
- [Registry Key] – HKLMSYSTEMCurrentControlSetServicescredman – Registry path of the Network Provider
- [File Path] – C:WindowsSystem32ntoskrnl.dll, C:WindowsTempntoskrnl.dll – Network Provider module files
- [File Path] – c:/windows/temp/onedriveupdater.exe, c:/windows/system32/msmdlb.exe – Agent Racoon paths
- [Domain] – geoinfocdn[.]com, telemetry.geoinfocdn[.]com – C2 domains
- [Domain] – geostatcdn[.]com, telemetry.geostatcdn[.]com – Additional C2 domains
- [SHA256] – e30f8596f1beda8254cbe1ac7a75839f5fe6c332f45ebabff88aadbce3938a19, 1a4301019bdf42e7b2df801e04066a738d184deb22afcad9542127b0a31d5cfa – Ntospy DLL Modules
- [MD5] – b855dfde7f778f99a3724802715a0baa – Mimilite payload hash
Read more: https://unit42.paloaltonetworks.com/new-toolset-targets-middle-east-africa-usa/