ZenRAT: Malware Brings More Chaos Than Calm  | Proofpoint US

MITRE Techniques

• [T1036] Masquerading – The installer masquerades as Speccy and is claimed to be signed by Tim Kosse; digital signature is not valid. “the installer is claiming to be Piriform’s Speccy …” and “the installer has an invalid digital signature, and claims to have been signed by Tim Kosse”
• [T1082] System Information Discovery – Upon execution, it uses WMI queries and other system tools to gather information about the host: CPU Name, GPU Name, OS Version, Installed RAM, IP address and Gateway, Installed Antivirus, Installed Applications
• [T1055] Process Injection – It injects into PID 2680 (regasm.exe) with an argument shown in the data structure
• [T1555.001] Credentials in Web Browsers – ZenRAT collects browser data/credentials and exfiltrates in Data.zip (InstalledApps.txt, SysInfo.txt)
• [T1041] Exfiltration – Data.zip containing system info and browser data is sent to the C2; “ZenRAT was observed sending this information back to its C2 server along with stolen browser data/credentials in a zip file called Data.zip”
• [T1070] Indicator Removal on Host – The installer creates a hidden .cmd that launches a self-deletion loop for itself and the installer
• [T1497] Virtualization/Sandbox Evasion – Anti-VM checks (IsDetectVM) and related process checks
• [T1027] Obfuscated/Compressed Files and Information – Data is encrypted with AES-256-CBC for module data transfers; “The data transferred … is encrypted using AES-256-CBC, in chunks of 50000 bytes”