Possible Pakistan-nexus Backdoor Targeting Afghanistan

MITRE Techniques

• [T1574.002] DLL Side-Loading – The malicious library was loaded by a renamed legitimate executable to execute the backdoor [‘a malicious library that is side-loaded by the renamed executable’]
• [T1547.001] Registry Run Keys / Startup Folder – Persistence was created through the current user Run key [‘Persistent execution is established using the common registry run key HKCUSoftwareMicrosoftWindowsCurrentVersionRun’]
• [T1036.005] Match Legitimate Resource Name or Location – The malicious executable was disguised as a legitimate Windows component by using the name ApplicationFrameHost.exe [‘The executable is a legitimate executable (ApplicationFrameHost.exe, a Windows executable)’]
• [T1497.001] System Checks – The backdoor performed anti-debugging and anti-analysis checks before executing its main logic [‘It detects debuggers’, ‘It performs timing and integrity checks’]
• [T1057] Process Discovery – The malware enumerated running tools and system processes as part of analysis avoidance and command handling [‘It detects the presence of common analysis tools: ida.exe, ida64.exe, x64dbg.exe, x32dbg.exe, windbg.exe, ollydbg.exe’]
• [T1005] Data from Local System – The backdoor collected local system information such as CPU, memory, disks, network information, and uptime [‘Send system profile (cpu, memory, disks, network information, uptime)’]
• [T1082] System Information Discovery – The first beacon included OS version and machine identity data [‘machineName’, ‘osVersion’, ‘clientId’]
• [T1105] Ingress Tool Transfer – The C2 supported file upload and download operations between victim and operator [‘Read files in chunks (download victim -> C2)’, ‘File upload (C2-> victim) as a .tmp’]
• [T1059.003] Windows Command Shell – The malware launched cmd.exe for command execution and hidden shell interaction [‘Uses “cmd.exe /c start” for non-executables’, ‘Spawns hidden cmd with anonymous pipes’]
• [T1569.002] Service Execution – The backdoor created a shell-like execution environment to run commands on the victim system [‘Create a shell’]
• [T1033] System Owner/User Discovery – The decoy document exposed names and personnel details that could support targeted operations [‘List of Officials’, ‘a list of individual names and their corresponding position name, salary, department, and phone number’]