Trade with caution – bad guys are stealing

MITRE Techniques

• [T1203] Exploitation for Client Execution – Benign windows process is dropping new PE files. “Benign windows process is dropping new PE files”
• [T1574.002] DLL Side-Loading – DLL Side-Loading. “Tries to load missing DLLs”
• [T1055] Privilege Escalation – Injects code into the Windows Explorer. “Injects code into the Windows Explorer”
• [T1036] Defense Evasion – Creates files inside the user directory. “Creates files inside the user directory”
• [T1070.004] File Deletion – Deletes itself after installation. “Deletes itself after installation”
• [T1497] Virtualization/Sandbox Evasion – Checks for kernel code integrity. “Checks for kernel code integrity”
• [T1564.001] Hidden Files and Directories – Hides that the sample has been downloaded from the Internet. “Hides that the sample has been downloaded from the Internet”
• [T1010] Discovery – Application Window Discovery. “Application Window Discovery”
• [T1057] Process Discovery – Verifies the name of parent process. “Verifies the name of parent process”
• [T1082] System Information Discovery – Gathers system OS version info. “Gathers system OS version info”
• [T1518.001] Security Software Discovery – Checks if the current machine is a virtual machine. “Checks if the current machine is a virtual machine”; Checks if the current process is being debugged. “Checks if the current process is being debugged”
• [T1071] Application Layer Protocol: Web protocol – Posts data to web server. “Posts data to web server”; C2 URLs/IPs found in malware configuration. “C2 URLs/IPs found in malware configuration”
• [T1095] Non-Application Layer Protocol – Tries to download or post to a non-existing http route. “Tries to download or post to a non-existing http route”
• [T1105] Ingress Tool Transfer – Some HTTP requests failed with 404. Part of communication protocol. “Some HTTP requests failed with 404. Part of communication protocol”