Elastic Security Labs observed new PIKABOT campaigns, including an updated version. PIKABOT is a widely deployed loader malicious actors utilize to distribute additional payloads.

PIKABOT at a glance

Key takeaways

PIKABOT campaign overview

PIKABOT loader

Loader stage 1

Loader stage 2

Anti-debugging

Execution

PIKABOT core

Obfuscation 

String Decryption

Initial Collection

Config

Network

Bot Functionality

Malware and MITRE ATT&CK

Tactics

Techniques

Detecting malware

Prevention

YARA

Observations

References

Appendix

PIKABOT, I choose you!

Explore JOKERSPY, a recently discovered campaign that targets financial institutions with Python backdoors. This article covers reconnaissance, attack patterns, and methods of identifying JOKERSPY in your network.

Preamble

Overview

Analysis

The xcc binary

XCode artifacts

Abusing TCC

Initial access

Deployed cryptographic libraries

The sh.py backdoor

Swiftbelt

Diamond Model

Observed tactics and techniques

MITRE ATT&CK Tactics

MITRE ATT&CK Techniques / Sub techniques

Detection logic

An overview of JOKERSPY, discovered in June 2023, which deployed custom and open source macOS tools to exploit a cryptocurrency exchange located in Japan.

Initial research exposing JOKERSPY

Elastic Security Labs has discovered the P8LOADER, POWERSEAL, and SPECTRALVIPER malware families targeting a national Vietnamese agribusiness. REF2754 shares malware and motivational elements of the REF4322 and APT32 activity groups.

Execution flow

SPECTRALVIPER code analysis

Launch

Pipe mode

HTTP mode

Commands

Defense evasion

Code obfuscation

String obfuscation

Summary

P8LOADER

Discovery

POWERSEAL code analysis

Launch PowerShell

Campaign and adversary modeling

Victimology

Campaign analysis

Campaign associations

Diamond model

Observed adversary tactics and techniques

Techniques / Sub techniques

Preventions

Elastic Security Labs has discovered the SPECTRALVIPER malware targeting a national Vietnamese agribusiness.

Elastic charms SPECTRALVIPER

Elastic Security discovered PHOREAL malware, which is targeting Southeast Asia financial organizations, particularly those in the Vietnamese financial sector.

What is the threat?

What is the impact?

What is Elastic doing about it?

Investigation Details

Adversary Assessment Justification

Conclusion

YARA Rules

Defensive Recommendations

Observables

Artifacts

PHOREAL Malware Targets the Southeast Asian Financial Sector

The Elastic Security Labs team has been tracking REF2731, an 5-stage intrusion set involving the PARALLAX loader and the NETWIRE RAT.

Key Takeaways

Execution Flow (PARALLAX loader)

First Stage (lure/macro)

Second Stage (MsiDb.exe)

Third Stage (shellcode)

Fourth Stage

Fifth Stage

Campaign Analysis

Campaign 1

Lure Documents

Macro

Network Infrastructure

Campaign 1 Indicators

Campaign 2

Campaign 2 Indicators

Campaign Intersections

The Pyramid of Pain

The SEPTTON Domain

marketforce666

gaza666

Observed Adversary Tactics and Techniques

Detection

Detection Logic

PARALLAX Payload Extractor

Indicators

REF2731 intrusion set, campaigns, and malware observations

Exploring the REF2731 Intrusion Set

Elastic Security verifies new destructive malware targeting Ukraine: Operation Bleeding Bear

Stage 1: WhisperGate MBR payload

Malware analysis breakdown (Stages 1-4)

Stage 2/3: Discord downloader and injector

Final stage: File corruptor

MBR protection with Elastic Security

Observing WhisperGate in Elastic Security

Alert breakdown and defensive recommendations

Endpoint Security Integration Alerts

Stage 1 - MBR Wiper

Stage 2 - Downloader

Stage 3 + Stage 4 - Injector/File Corruptor

Prebuilt Detection Engine Alerts

Hunting queries

MITRE ATT&CK

Operation Bleeding Bear

Elastic Security observed a ransomware and extortion campaign leveraging a combination of offensive security tools, LOLBAS, and exploits to deliver the CUBA ransomware malware.

Initial Access

Access Broker

Remotely Exploitable Vulnerability

Establish Foothold

afk.ttf

add2.exe

Remote Access Tools

SystemBC

GoToAssist

NetSupport

Cobalt Strike

BUGHATCH

Credential Harvesting, Internal Reconnaissance, and Lateral Movement

Meterpreter

Mimikatz

Zerologon Exploit

PsExec

Using LOLBAS

Data Exfiltration

Defense Evasion and Actions on the Objective

DefenderControl.exe

CUBA Ransomware

Techniques / Sub Techniques

CUBA Ransomware Campaign Analysis

Our Elastic Security research team has focused on advanced techniques used in a Malaysian-focused APT campaign. Learn who’s behind it, how the attack works, observed MITRE attack® techniques, and indicators of compromise.

Anatomy of the attack

Embedded DLLs

DLL side-loading a backdoor

Second stage backdoor

Possible APT40/Leviathan connection

MITRE ATT&CK® techniques

Indicators of Compromise (IOCs)

File names and paths

Registry keys

URLs

HTTPS certificate

Hashes

A close look at the advanced techniques used in a Malaysian-focused APT campaign

Campaign research and analysis of an observed FORMBOOK intrusion attempt.

Details

Testing phase

Request Details.docx

Pope.txt

Comres.cab and 1.doc.inf

Production phase

Profile.rar

document.docx

Profile.html

Dropper

FORMBOOK Binary

Generic phase

Email header

File hashes

IP addresses

Resource development

Detections

YARA rule

FORMBOOK Adopts CAB-less Approach

Learn how Elastic Endpoint Security's behavior-based protections prevented a targeted ransomware attack on multiple endpoints.

Thema

Kampagnen

24. Februar 2024

PIKABOT, ich wähle Sie!

Erste Untersuchungen entlarven JOKERSPY

Elastische Anhänger SPECTRALVIPER

PHOREAL-Malware zielt auf den südostasiatischen Finanzsektor ab

Erkundung des REF2731 Intrusion Set

Operation Blutender Bär

Analyse der CUBA Ransomware-Kampagne

Ein genauer Blick auf die fortschrittlichen Techniken, die in einer auf Malaysia fokussierten APT-Kampagne verwendet werden

FORMBOOK verfolgt CAB-losen Ansatz

Ransomware, unterbrochen: Sodinokibi und die Lieferkette