Elastic Security Labs observed new PIKABOT campaigns, including an updated version. PIKABOT is a widely deployed loader malicious actors utilize to distribute additional payloads.

PIKABOT at a glance

Key takeaways

PIKABOT campaign overview

PIKABOT loader

Loader stage 1

Loader stage 2

Anti-debugging

Execution

PIKABOT core

Obfuscation 

String Decryption

Initial Collection

Config

Network

Bot Functionality

Malware and MITRE ATT&CK

Tactics

Techniques

Detecting malware

Prevention

YARA

Observations

References

Appendix

PIKABOT, I choose you!

Explore JOKERSPY, a recently discovered campaign that targets financial institutions with Python backdoors. This article covers reconnaissance, attack patterns, and methods of identifying JOKERSPY in your network.

Preamble

Overview

Analysis

The xcc binary

XCode artifacts

Abusing TCC

Initial access

Deployed cryptographic libraries

The sh.py backdoor

Swiftbelt

Diamond Model

Observed tactics and techniques

MITRE ATT&CK Tactics

MITRE ATT&CK Techniques / Sub techniques

Detection logic

An overview of JOKERSPY, discovered in June 2023, which deployed custom and open source macOS tools to exploit a cryptocurrency exchange located in Japan.

Initial research exposing JOKERSPY

Elastic Security Labs has discovered the P8LOADER, POWERSEAL, and SPECTRALVIPER malware families targeting a national Vietnamese agribusiness. REF2754 shares malware and motivational elements of the REF4322 and APT32 activity groups.

Execution flow

SPECTRALVIPER code analysis

Launch

Pipe mode

HTTP mode

Commands

Defense evasion

Code obfuscation

String obfuscation

Summary

P8LOADER

Discovery

POWERSEAL code analysis

Launch PowerShell

Campaign and adversary modeling

Victimology

Campaign analysis

Campaign associations

Diamond model

Observed adversary tactics and techniques

Techniques / Sub techniques

Preventions

Elastic Security Labs has discovered the SPECTRALVIPER malware targeting a national Vietnamese agribusiness.

Elastic charms SPECTRALVIPER

Elastic Security discovered PHOREAL malware, which is targeting Southeast Asia financial organizations, particularly those in the Vietnamese financial sector.

What is the threat?

What is the impact?

What is Elastic doing about it?

Investigation Details

Adversary Assessment Justification

Conclusion

YARA Rules

Defensive Recommendations

Observables

Artifacts

PHOREAL Malware Targets the Southeast Asian Financial Sector

The Elastic Security Labs team has been tracking REF2731, an 5-stage intrusion set involving the PARALLAX loader and the NETWIRE RAT.

Key Takeaways

Execution Flow (PARALLAX loader)

First Stage (lure/macro)

Second Stage (MsiDb.exe)

Third Stage (shellcode)

Fourth Stage

Fifth Stage

Campaign Analysis

Campaign 1

Lure Documents

Macro

Network Infrastructure

Campaign 1 Indicators

Campaign 2

Campaign 2 Indicators

Campaign Intersections

The Pyramid of Pain

The SEPTTON Domain

marketforce666

gaza666

Observed Adversary Tactics and Techniques

Detection

Detection Logic

PARALLAX Payload Extractor

Indicators

REF2731 intrusion set, campaigns, and malware observations

Exploring the REF2731 Intrusion Set

Elastic Security verifies new destructive malware targeting Ukraine: Operation Bleeding Bear

Stage 1: WhisperGate MBR payload

Malware analysis breakdown (Stages 1-4)

Stage 2/3: Discord downloader and injector

Final stage: File corruptor

MBR protection with Elastic Security

Observing WhisperGate in Elastic Security

Alert breakdown and defensive recommendations

Endpoint Security Integration Alerts

Stage 1 - MBR Wiper

Stage 2 - Downloader

Stage 3 + Stage 4 - Injector/File Corruptor

Prebuilt Detection Engine Alerts

Hunting queries

MITRE ATT&CK

Operation Bleeding Bear

Elastic Security observed a ransomware and extortion campaign leveraging a combination of offensive security tools, LOLBAS, and exploits to deliver the CUBA ransomware malware.

Initial Access

Access Broker

Remotely Exploitable Vulnerability

Establish Foothold

afk.ttf

add2.exe

Remote Access Tools

SystemBC

GoToAssist

NetSupport

Cobalt Strike

BUGHATCH

Credential Harvesting, Internal Reconnaissance, and Lateral Movement

Meterpreter

Mimikatz

Zerologon Exploit

PsExec

Using LOLBAS

Data Exfiltration

Defense Evasion and Actions on the Objective

DefenderControl.exe

CUBA Ransomware

Techniques / Sub Techniques

CUBA Ransomware Campaign Analysis

Our Elastic Security research team has focused on advanced techniques used in a Malaysian-focused APT campaign. Learn who’s behind it, how the attack works, observed MITRE attack® techniques, and indicators of compromise.

Anatomy of the attack

Embedded DLLs

DLL side-loading a backdoor

Second stage backdoor

Possible APT40/Leviathan connection

MITRE ATT&CK® techniques

Indicators of Compromise (IOCs)

File names and paths

Registry keys

URLs

HTTPS certificate

Hashes

A close look at the advanced techniques used in a Malaysian-focused APT campaign

Campaign research and analysis of an observed FORMBOOK intrusion attempt.

Details

Testing phase

Request Details.docx

Pope.txt

Comres.cab and 1.doc.inf

Production phase

Profile.rar

document.docx

Profile.html

Dropper

FORMBOOK Binary

Generic phase

Email header

File hashes

IP addresses

Resource development

Detections

YARA rule

FORMBOOK Adopts CAB-less Approach

Learn how Elastic Endpoint Security's behavior-based protections prevented a targeted ransomware attack on multiple endpoints.

주제

캠페인

2024년 2월 24일

새로운 PIKABOT 캠페인 분석

JOKERSPY를 폭로하는 초기 연구

Elastic, SPECTRALVIPER를 사로잡다

PHOREAL 멀웨어, 동남아 금융 부문을 노리다

REF2731 침입 세트 살펴보기

출혈 곰 작전

CUBA 랜섬웨어 캠페인 분석

말레이시아를 겨냥한 APT 캠페인에 사용된 고급 기법 자세히 살펴보기

폼북, CAB 없는 접근 방식 채택

랜섬웨어, 중단됨: 소디노키비와 공급망