Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Sept. 10 and Sept. 17. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat or vulnerability analysis. For the most current information, please refer to your Firepower Management Center, Snort.org, or ClamAV.net.
For each threat described below, this blog post only lists 25 of the associated file hashes and up to 25 IOCs for each category. An accompanying JSON file can be found here that includes the complete list of file hashes, as well as all other IOCs from this post. A visual depiction of the MITRE ATT&CK techniques associated with each threat is also shown. In these images, the brightness of the technique indicates how prevalent it is across all threat files where dynamic analysis was conducted. There are five distinct shades that are used, with the darkest indicating that no files exhibited technique behavior and the brightest indicating that technique behavior was observed from 75 percent or more of the files.
The most prevalent threats highlighted in this roundup are:
Threat Name
Type
Description
Win.Trojan.Autoit-9891607-0
Trojan
This signature covers malware leveraging the well-known AutoIT automation tool, widely used by system administrators. AutoIT exposes a rich scripting language that allows the adversary to write fully functional malicious software. This family will install itself on the system and contact a C2 server to receive additional instructions or download follow-on payloads.
Win.Malware.Zusy-9892604-0
Malware
Zusy, also known as TinyBanker or Tinba, is a trojan that uses man-in-the-middle attacks to steal banking information. When executed, it injects itself into legitimate Windows processes such as "explorer.exe" and "winver.exe." When the user accesses a banking website, it displays a form to trick the user into submitting personal information.
Win.Malware.Razy-9891835-0
Malware
Razy is oftentimes a generic detection name for a Windows trojan. It collects sensitive information — sometimes including screenshots — from the infected host and encrypts the data, eventually sending it to a C2 server. The samples modify auto-execute functionality by setting and creating a value in the registry for persistence.
Win.Packed.NetWire-9891837-1
Packed
NetWire is a remote access trojan (RAT) that allows attackers to execute commands on the infected host, log keystrokes, interact with a webcam, remote desktop, and read data from connected USB devices. NetWire is commonly delivered through Microsoft Office documents with macros, sent as attachments on malicious emails.
Win.Packed.Lokibot-9891839-0
Packed
Lokibot is an information-stealing malware designed to siphon off sensitive information stored on an infected device. It is modular in nature, supporting the ability to steal sensitive information from several popular applications. It is commonly pushed via malicious documents delivered via spam emails.
Win.Packed.Tofsee-9892915-1
Packed
Tofsee is multi-purpose malware that features a number of modules used to carry out various activities such as sending spam messages, conducting click fraud, mining cryptocurrency, and more. Infected systems become part of the Tofsee spam botnet and are used to send large volumes of spam messages to infect additional systems and increase the size of the botnet under the operator's control.
Win.Dropper.Gh0stRAT-9892254-0
Dropper
Gh0stRAT is a well-known family of remote access trojans designed to provide an attacker with complete control over an infected system. This trojan can monitor keystrokes, collect video footage from the victim's webcam, and download follow-on malware. The source code for Gh0stRAT has been publicly available on the internet for years, significantly lowering the barrier for actors to modify and reuse the code in new attacks.
Win.Virus.Ramnit-9892317-0
Virus
Ramnit is a banking trojan that monitors web browser activity on an infected machine and collects login information from financial websites. It also steals browser cookies and attempts to hide from popular antivirus software.
Win.Dropper.Remcos-9892963-1
Dropper
Remcos is a remote access trojan (RAT) that allows attackers to execute commands on the infected host, log keystrokes, interact with a webcam, and capture screenshots. This malware is commonly delivered through Microsoft Office documents with macros, sent as attachments on malicious emails.
Threat Breakdown
Win.Trojan.Autoit-9891607-0
Indicators of Compromise
IOCs collected from dynamic analysis of 26 samples
<HKCU>\SOFTWARE\FARLABUNINSTALLER\FARLABUNINSTALLER
Value Name: key
3
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\FARLABUNINSTALLER.EXE_IS1
Value Name: Inno Setup: Setup Version
3
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\FARLABUNINSTALLER.EXE_IS1
Value Name: Inno Setup: App Path
3
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\FARLABUNINSTALLER.EXE_IS1
Value Name: InstallLocation
3
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\FARLABUNINSTALLER.EXE_IS1
Value Name: Inno Setup: Icon Group
3
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\FARLABUNINSTALLER.EXE_IS1
Value Name: Inno Setup: User
3
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\FARLABUNINSTALLER.EXE_IS1
Value Name: Inno Setup: Selected Tasks
3
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\FARLABUNINSTALLER.EXE_IS1
Value Name: Inno Setup: Deselected Tasks
3
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\FARLABUNINSTALLER.EXE_IS1
Value Name: Inno Setup: Language
3
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\FARLABUNINSTALLER.EXE_IS1
Value Name: DisplayName
3
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\FARLABUNINSTALLER.EXE_IS1
Value Name: DisplayIcon
3
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\FARLABUNINSTALLER.EXE_IS1
Value Name: UninstallString
3
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\FARLABUNINSTALLER.EXE_IS1
Value Name: QuietUninstallString
3
Mutexes
Occurrences
NVIDIA OpenGL Driver An application has requested more GPU memory than is available in the system. The application will now be closed. Error code: 6 Would you like to visit http://nvidia.custhelp.com/app/answers/detail/a_id/3553 for help?
3
Global\SetupLog
2
Global\WdsSetupLogInit
2
Global\h48yorbq6rm87zot
2
Global\ewzy5hgt3x5sof4v
2
Global\xmrigMUTEX31337
2
WininetConnectionMutex
2
Global\9fc058dc-b674-11ea-93f1-005056939927
1
MyIclpAp
1
Global\a556d5a1-0a9f-11ec-b5f8-00501e3ae7b6
1
IP Addresses contacted by malware. Does not indicate maliciousness
Occurrences
37[.]0[.]10[.]214
34
34[.]117[.]59[.]81
33
45[.]144[.]225[.]236
32
185[.]215[.]113[.]119
30
72[.]167[.]225[.]156
27
195[.]2[.]74[.]104
27
185[.]183[.]96[.]3
25
31[.]31[.]196[.]102
24
172[.]67[.]211[.]228
15
172[.]67[.]221[.]12
14
104[.]21[.]88[.]226
12
104[.]21[.]85[.]232
12
185[.]215[.]113[.]107
12
208[.]95[.]112[.]1
11
104[.]21[.]62[.]66
11
162[.]159[.]133[.]233
8
162[.]159[.]129[.]233
8
172[.]67[.]171[.]156
8
162[.]159[.]134[.]233
7
104[.]21[.]28[.]120
7
162[.]159[.]130[.]233
6
162[.]159[.]135[.]233
6
172[.]67[.]211[.]161
6
45[.]9[.]20[.]202
6
195[.]22[.]149[.]63
6
*See JSON for more IOCs
Domain Names contacted by malware. Does not indicate maliciousness
Cisco AMP for Endpoints protects users from a variety of malware functions with exploit prevention. Exploit prevention helps users defend endpoints from memory attacks commonly used by obfuscated malware and exploits. These exploits use certain features to bypass typical anti-virus software, but were blocked by AMP thanks to its advanced scanning capabilities, even protecting against zero-day vulnerabilities.
Process hollowing detected - (24727)
Process hollowing is a technique used by some programs to avoid static analysis. In typical usage, a process is started and its obfuscated or encrypted contents are unpacked into memory. The parent then manually sets up the first stages of launching a child process, but before launching it, the memory is cleared and filled in with the memory from the parent instead.
Crystalbit-Apple DLL double hijack was detected. During this attack, the adversary abuses two legitimate vendor applications, such as CrystalBit and Apple, as part of a dll double hijack attack chain that starts with a fraudulent software bundle and eventually leads to a persistent miner and in some cases spyware deployment.
Excessively long PowerShell command detected - (7055)
A PowerShell command with a very long command line argument that may indicate an obfuscated script has been detected. PowerShell is an extensible Windows scripting language present on all versions of Windows. Malware authors use PowerShell in an attempt to evade security software or other monitoring that is not tuned to detect PowerShell based threats.
Reverse tcp payload detected - (4945)
An exploit payload intended to connect back to an attacker controlled host using tcp has been detected.
A Microsoft Office process has started a windows utility. - (3980)
A process associated with Microsoft Office, such as EXCEL.exe, OUTLOOK.exe or WINWORD.exe, has started a Windows utility such as powershell.exe or cmd.exe. This is typical behavior of malicious documents executing additional scripts. This behavior is extremely suspicious and is associated with many malware different malware campaigns and families.
mshta.exe proxy execution detected - (2711)
mshta.exe is a trusted Windows utility used by adversaries to proxy execution of malicious .hta, Javascript or VBScript files. Since mshta.exe executes outside of the Internet Explorer's security context, it can bypass browser security settings. Various malware uses this technique to execute additional stages of infection.
CVE-2020-1472 exploit detected - (2455)
An attempt to exploit CVE-2020-1472 has been detected. Also known as "Zerologon". This is a privelege escalation vulnerability in Netlogon.
Expiro Malware detected - (1652)
Expiro malware is unique in that it infiltrates executable files on both 32- and 64-bit Windows systems by appending its viral code to the host. It can be used to install malicious browser extensions, lower browser security settings, and steal account credentials.
Dealply adware detected - (1264)
DealPly is adware, which claims to improve your online shopping experience. It is often bundled into other legitimate installers and is difficult to uninstall. It creates pop-up advertisements and injects advertisements on webpages. Adware has also been known to download and install malware.
Kovter injection detected - (840)
A process was injected into, most likely by an existing Kovter infection. Kovter is a click fraud Trojan that can also act as an information stealer. Kovter is also file-less malware meaning the malicious DLL is stored inside Windows registry and injected directly into memory using PowerShell. It can detect and report the usage of monitoring software such as wireshark and sandboxes to its C2. It spreads through malicious advertising and spam campaigns.
