The example involves a user who tried to download an unauthorized version of TeamViewer (an app that has actually been used as camouflage for trojan spyware before).
The user downloaded a malicious file disguised as a crack installer for the application.
After downloading and executing these files, one of the child processes created other files and the executable setup.exe/setup-installv1.3.exe, which was extracted from 320yea_Teamviewer_15206.zip via WinRAR.exe. This file seems to be the source of most of the downloaded malicious files.
Afterward, the file aae15d524bc2.exe was dropped and executed via Command Prompt. It then spawned a file, C:Users{username}DocumentsetiKyTN_F_nmvAb2DF0BYeIk.exe, which sequentially initiated the BITS admin download.
BITS admin is a command-line tool that can help monitor progress and create, download, and upload jobs. The tool also allows a user to obtain arbitrary files from the internet, a feature that attackers can abuse.
Analysts also observed that information in the browser’s credential store was taken by the attacker.
Specifically, the stored data in C:Users{username}AppDataLocalMicrosoftEdgeUser DataDefaultLogin was copied. Credentials stored in browsers are often critical personal data that could be leveraged by attackers to gain access into personal, business, or financial accounts. Attackers can even compile and sell this information in underground markets.
To maintain persistence, an executable file was entered in the AutoStart registry and a scheduled task was created:
Create scheduled task: C:WindowsSystem32schtasks.exe /create /f/sc onlogon /rl highest /tn”services64″/tr ‘”C:Users{username}AppDataRoamingservices64.exe”‘
AutoStart registry: HKCUSOFTWAREMicrosoftWindowsCurrentVersionRunprun:C:WINDOWSPublicGamingprun.exe
As previously mentioned, these cases come about because users search for free applications and trust that someone is going to put the cracked or stolen full version online as a gesture of good will. But, attackers simply take advantage of those who download these files.
Following the execution of setup_x86_x64_install.exe, it created and executed a new file named setup_installer.exe that dropped several files and queried several domains.
Sign Up For Threat Alerts
Jul 04, 2023
Rhysida Ransomware RaaS Crawls Out of Crimeware...
The Rhysida ransomware-as-a-service (RaaS) group has gone from a dubious newcomer to a fully-fledged ransomware...
Jun 26, 2023
Operation Magalenha – Long-Running Campaign Pursues Portuguese...
The attackers can steal credentials and exfiltrate users' data and personal information, which can be...
Apr 24, 2023
Lazarus Group Adds Linux Malware to Arsenal...
Researchers have discovered a new campaign conducted by Lazarus, known as "Operation DreamJob," which targets...
Apr 23, 2023
Additional IOCs for 3cx breach
Recently an unexpected malicious activity emanating from a legitimate, signed binary, 3CXDesktopApp was observed.
Apr 23, 2023
Ex-Conti and FIN7 Actors Collaborate with New...
IBM Security X-Force recently discovered a new malware family Analysts have called "Domino," which Analysts...
Apr 20, 2023
AuKill EDR killer malware abuses Process Explorer...
The AuKill tool abuses an outdated version of the driver used by version 16.32 of...
Apr 20, 2023
Fake Chrome updates spread malware
A campaign running since the end of last year is using hacked sites to push...
Apr 20, 2023
QBot using new attack vector in its...
QBot, also known as QakBot, previously operated as a banking trojan and has since transformed...
Apr 20, 2023
CrossLock Ransomware Emerges: New Golang – Based...
The CrossLock ransomware employs the double extortion technique to increase the likelihood of payment from...
Apr 20, 2023
Windows Zero-Day Vulnerability CVE-2023-28252 Exploited by Nokoyawa...
A zero-day vulnerability in the Microsoft Windows system, which also affects Windows 11, has been...
Apr 18, 2023
Additional IOcs for 3cx breach
Recently an unexpected malicious activity emanating from a legitimate, signed binary, 3CXDesktopApp was observed. As...
Apr 18, 2023
Additional IOcs for 3cx breach
Recently an unexpected malicious activity emanating from a legitimate, signed binary, 3CXDesktopApp was observed. As...
Apr 18, 2023
APT36 Expands Interest Within Indian Education Sector
Symantec described UPS in 2016 report as Buckeye (also known as APT3 Gothic Panda UPS...
Apr 17, 2023
ChinaZ DDoS Bot Malware Distributed To Linux...
The ChinaZ DDoS bot malware was discovered targeting Linux systems while a version for Microsoft...
Apr 16, 2023
Resurgence Of The Mexals Cryptojacking Campaign
The Mexals crypto jacking campaign has been in operation since at least 2021 and continues...