Elastic Security discovered PHOREAL malware, which is targeting Southeast Asia financial organizations, particularly those in the Vietnamese financial sector.

Preamble

What is the threat?

What is the impact?

What is Elastic doing about it?

Investigation Details

Analysis

Adversary Assessment Justification

Conclusion

YARA Rules

Defensive Recommendations

References

Observables

Artifacts

PHOREAL Malware Targets the Southeast Asian Financial Sector

The Elastic Container Project provides a single shell script that will allow you to stand up and manage an entire Elastic Stack using Docker. This open source project enables rapid deployment for testing use cases.

The Elastic Stack

Elasticsearch

Kibana

The Elastic Agent

The Elastic Container Project

Introduction

Prerequisites

macOS

Linux

Cloning the project repository

Setting credentials

The shell script

Stage

Start

Stop

Destroy

Restart

Restarting all Elastic Stack components.

Name Command State Ports

Status

Clear

Help

Getting Started

Updating variables

Starting the Elastic Stack

Accessing the Elastic Stack

Enabling the Platinum Features

Creating a Fleet policy

Enabling Elastic’s Prebuilt Detection Rules

Enrolling an Elastic Agent

Test fire some malware

Summary

Using Docker to stand up the Elastic Stack

The Elastic Container Project for Security Research

Elastic Security Labs outlines the steps collect and analyze the various stages of the REF4526 intrusion set. This intrusion set uses a creative approach of Unicode icons in Powershell scripts to install a loader, a dropper, and RAT implants.

Key takeaways

Loader phase

Dropper phase

RAT phase

Activity clusters

Collecting and parsing network data

Loader and Dropper

Diamond Model

Observed adversary tactics and techniques

Tactics

Techniques / Sub techniques

Detection logic

Behavior rules

Hunting queries

KQL query

EQL query

Elastic Security Labs identified an interesting approach to frustrate the detection of the YIPPHB dropper and RAT implants.

Doing time with the YIPPHB dropper

Elastic Security Labs details the use of open source data collection and the Elastic Stack to analyze the ICEDID botnet C2 infrastructure.

Initial access

Command and control

Persistence

Core functionality

ICEDID configuration extractor

TLS certificate pinning

Dataset

JARM / JA3S

ICEDID implant defense

Importing into Elasticsearch

Detections and preventions

Preventions

YARA

Indicators

ICEDIDs network infrastructure is alive and well

Part 2 - Extracting configurations from Cobalt Strike implant beacons.

Cobalt Strike Configuration Extractor

Setting up the Cobalt Strike Configuration Extractor

Viewing the atomic indicators of the CS beacon configuration

Viewing the process-inject.stub field

Viewing Cobalt Strike watermark

Putting Analysis to Action

This time at full speed

Extracting Cobalt Strike Beacon Configurations

Elastic Security observed a ransomware and extortion campaign leveraging a combination of offensive security tools, LOLBAS, and exploits to deliver the CUBA ransomware malware.

Key Takeaways

Initial Access

Access Broker

Remotely Exploitable Vulnerability

Establish Foothold

afk.ttf

add2.exe

Remote Access Tools

SystemBC

GoToAssist

NetSupport

Cobalt Strike

BUGHATCH

Credential Harvesting, Internal Reconnaissance, and Lateral Movement

Meterpreter

Mimikatz

Zerologon Exploit

PsExec

Using LOLBAS

Data Exfiltration

Defense Evasion and Actions on the Objective

DefenderControl.exe

CUBA Ransomware

Observed Adversary Tactics and Techniques

Techniques / Sub Techniques

Detection

Observations

CUBA Ransomware Campaign Analysis

The Deimos implant was first reported in 2020 and has been in active development; employing advanced analysis countermeasures to frustrate analysis. This post details the campaign TTPs through the malware indicators.

Overview

Details

The Pyramid of Pain

File Hashes

IP Addresses

Resource Development

Command and Control Phase

Main Loop

Tools

TTPs

Impact

Detection Logic

New Detection Rules

Hunting Queries

Going Coast to Coast - Climbing the Pyramid with the Deimos Implant

Campaign research and analysis of an observed FORMBOOK intrusion attempt.

Testing phase

Request Details.docx

Pope.txt

Comres.cab and 1.doc.inf

Production phase

Profile.rar

document.docx

Profile.html

Dropper

FORMBOOK Binary

Generic phase

Campaign analysis

Email header

File hashes

IP addresses

Resource development

Victimology

Detections

YARA rule

FORMBOOK Adopts CAB-less Approach

The Mozi botnet is an ongoing malware campaign targeting unsecured and vulnerable networking devices. This post will showcase the analyst journey of collecting, analyzing, and operationalizing threat data from the Mozi botnet.

Collection

Unpacking

Storing threat data in the Elastic Stack

Create the Ingest Node Pipeline

Exploring the propagation mechanism

Mitigation

Additional resources

Collecting and operationalizing threat data from the Mozi botnet

Part 1 - Processes and technology needed to extract Cobalt Strike implant beacons

The Fleet Policy

Collecting the Beacon

Next Steps

Collecting Cobalt Strike Beacons with the Elastic Stack

作者

Derek Ditch

文章

PHOREAL 恶意软件攻击东南亚金融领域

用于安全研究的 Elastic 容器项目

YIPPHB 投放器的分析

ICEDIDs 网络基础设施依然存在

提取 Cobalt Strike Beacon 配置

CUBA 勒索软件活动分析

横跨东西海岸 - 使用 Deimos 植入程序攀登金字塔

FORMBOOK 采用无 CAB 方法

从 Mozi botnet 收集和运营威胁数据

使用 Elastic Stack 收集 Cobalt Strike 信标