Trent

Security Analyst | Blue Team | Windows Engineer | Father | Lover of coffee and whiskey | Wishing we wouldn’t be a$$holes to one another | Opinions are my own

[Trent @tliffick]

Observed a new RMM tool in the wild today. I don't see this tool listed on https://t.co/i24emEBxrW
Miradore Online Client
MiradoreClient.exe

More IOCs found here:
https://t.co/RTdvxVzUZK

[Trent @tliffick]

@svch0st Thx Zach! Pls keep up the great work you’re doing for the community.

[Trent @tliffick]

@svch0st I’ve always enjoyed the DFIR reports you’ve worked on and wanted to ask what tooling you use to build the visual timelines for your investigations? I’m looking for suggestions on building quality visuals for our reports/write ups. Thx!

[Trent @tliffick]

Thanks @olafhartong for taking the time to chat with the team and I! I appreciate you sharing your experiences and helping to validate the path we're headed down.

[Trent @tliffick]

@__Root___User @UK_Daniel_Card

[Trent @tliffick]

IOCs can be found here:
https://t.co/Iy7qvh9cxj

[Trent @tliffick]

Seeing a large uptick in #Darkgate #malware over the past 48 hours.

.xlsx > wscript.exe > powershell.exe > certutil.exe | AutoHotKeys.exe | attrib.exe +h C:/\d{2,4}

.xlsx naming: \w{3,}-\w{4,6}-\w{3,8}\.xlsx
.vbs naming: EXCEL_OPEN_DOCUMENT.vbs

[Trent @tliffick]

@Max_Mal_ Thx, without coffee this morning it didn’t click it was the same .js file 🤦🏻‍♂️

[Trent @tliffick]

@Max_Mal_ @Max_Mal_ are you able to share the hash of the .js file?

[Trent @tliffick]

@LPCEightBall lol I know you are!

[Trent @tliffick]

damn, this one hurt 😂

[Trent @tliffick]

I’m curious if Qakbot will be around for a while or if it will follow Emotet’s path of a rise and fall…

[Microsoft Threat Intelligence @MsftSecIntel]

Microsoft has identified new Qakbot phishing campaigns following the August 2023 law enforcement disruption operation. The campaign began on December 11, was low in volume, and targeted the hospitality industry. Targets received a PDF from a user masquerading as an IRS employee.

[Trent @tliffick]

@Myrtus0x0 @greglesnewich Do you have any samples you can share? Thx!

[Trent @tliffick]

Great to see all the people at @qc_con this morning! I’m looking forward to the talks and meeting new people this weekend! #CyberSecurity

[MicahKBrown @micahkbrown]

Headed to Queen City Con this weekend. Use our code to save and stay on site https://t.co/VXTKlYEDAT

[mRr3b00t @UK_Daniel_Card]

we have an increase in exposed CISCO IOS deices

[Trent @tliffick]

File Writes (Sysmon 11):
.*\\%LocalAppData%\\Apps\\2\.0\\\w{8}\.\w{3}\.*
#ScreenConnect #Malware

ServiceCreation (Sysmon 13):
TargetObject: HKLM\System\CurrentControlSet\Services\ScreenConnect Client

[Trent @tliffick]

http://cuyahoga[.]gop dropping #ScreenConnect RAT
FILE INFO:
cayahoga.exe
6DE70ACD525961502A0C1989D12649A0
8FAEE738A834F3FD7BBF48580142AEF204E49154D7887807307797A19B4BBB84

DNSRequests:
instance-hl8yvy-relay[.]screenconnect[.]com
riper48915[.]screenconnect[.]com (download)

[Leo Sanders @LeoSandbox]

🤣🤣 Who did this? I’m crying
#gamedev #retrogame #indiedev

[Trent @tliffick]

@ABC7NY It’s been nearly 40 mins and @espn is still claiming “weather delay”. Come on, Man!