LunarWeb and LunarMail were used to compromise a European MFA and its diplomatic missions.
Analyzers don't know the password, but the file sizes match the Stage 1 loader and Stage 2 blob with the LunarWeb backdoor.
Execution T1047 Windows Management Instrumentation LunarWeb obtains system information by using WMI queries.
T1547 Boot or Logon Autostart Execution A LunarWeb loader is persisted as a Group Policy extension.
T1574 Hijack Execution Flow A LunarWeb loader is persisted by replacing the system DLL tapiperf.
Defense Evasion T1027 Obfuscated Files or Information LunarWeb and LunarMail are AES-256 encrypted on disk.
005 Masquerading: Match Legitimate Name or Location Filenames used by LunarWeb and LunarMail loading chains mimic legitimate files.
004 Indicator Removal: File Deletion LunarWeb and LunarMail can uninstall themselves by deleting their loading chain.
T1140 Deobfuscate/Decode Files or Information LunarWeb and LunarMail decrypt their strings using RC4. T1480.
T1620 Reflective Code Loading LunarWeb and LunarMail are executed using a reflective loader.
T1082 System Information Discovery LunarWeb retrieves system information such as OS version, BIOS version, domain name, and environment variables.
001 Software Discovery: Security Software Discovery LunarWeb discovers installed security solutions via the WMI query wmic /Namespace:rootSecurityCenter2 Path AntiVirusProduct Get *. Collection T1005 LunarWeb and LunarMail use a statically linked Zlib library for compression of collected data.
002 Archive Collected Data: Archive via Library LunarWeb and LunarMail use a statically linked Zlib library for the compression of collected data.
002 Data Obfuscation: Steganography LunarWeb can receive commands hidden in JPG or GIF images.
003 Data Obfuscation: Protocol Impersonation LunarWeb impersonates legitimate domains in C&C communications by using a fake Host header and known URIs.
001 Data Encoding: Standard Encoding LunarWeb may receive base64-encoded data from the C&C server.
002 Encrypted Channel: Asymmetric Cryptography LunarWeb and LunarMail encrypt the AES key used in C&C communications using RSA-4096.
Exfiltration T1020 Automated Exfiltration LunarWeb and LunarMail automatically exfiltrate collected data to the C&C server.
T1030 Data Transfer Size Limits LunarWeb splits exfiltrated data above 1.33 MB into multiple smaller chunks.
T1041 Exfiltration Over C2 Channel LunarWeb and LunarMail exfiltrate data over the C&C channel.
This Cyber News was published on cybersecuritynews.com. Publication date: Wed, 15 May 2024 13:40:04 +0000