ESET Turla PowerShell May 2019

Turla RPC backdoors can upload files from victim machines.

Turla surveys a system upon check-in to discover information in the Windows Registry with the reg query command. Turla has also retrieved PowerShell payloads hidden in Registry keys as well as checking keys associated with null session named pipes .

Turla surveys a system upon check-in to discover network configuration details using the arp -a, nbtstat -n, net config, ipconfig /all, and route commands, as well as NBTscan. Turla RPC backdoors have also retrieved registered RPC interface information from process memory.

Turla RPC backdoors can collect files from USB thumb drives.

PowerStallion uses a XOR cipher to encrypt command output written to its OneDrive C2 server.

Turla has used encryption (including salted 3DES via PowerSploit's Out-EncryptedScript.ps1), random variable names, and base64 encoding to obfuscate PowerShell commands and payloads.

Turla has used the Registry to store encrypted and encoded payloads.

Turla surveys a system upon check-in to discover active local network connections using the netstat -an, net use, net file, and net session commands. Turla RPC backdoors have also enumerated the IPv4 TCP connection table via the GetTcpTable2 API call.

Turla has also used PowerSploit's Invoke-ReflectivePEInjection.ps1 to reflectively load a PowerShell payload into a random process on the victim system.

Turla surveys a system upon check-in to discover running processes using the tasklist /v command. Turla RPC backdoors have also enumerated processes associated with specific open ports or named pipes.

PowerStallion has been used to monitor process lists.

PowerStallion uses PowerShell loops to iteratively check for available commands in its OneDrive C2 server.

Turla has used PowerShell to execute commands/scripts, in some cases via a custom executable or code from Empire's PSInject. Turla has also used PowerShell scripts to load and execute malware in memory.

Turla RPC backdoors have used cmd.exe to execute commands.

PowerStallion modifies the MAC times of its local log files to match that of the victim's desktop.ini file.

Turla surveys a system upon check-in to discover files in specific locations on the hard disk %TEMP% directory, the current user's desktop, the Program Files directory, and Recent. Turla RPC backdoors have also searched for files matching the lPH*.dll pattern.

Turla RPC backdoors have included local UPnP RPC proxies.

PowerStallion uses Microsoft OneDrive as a C2 server via a network drive mapped with net use.

Turla and its RPC backdoors have used APIs calls for various tasks related to subverting AMSI and accessing then executing commands through RPC and/or named pipes.

Turla has modified Registry values to store payloads.

Turla RPC backdoors can impersonate or steal process tokens before executing commands.

Turla has used a custom decryption routine, which pulls key and salt values from other artifacts such as a WMI filter or PowerShell Profile, to decode encrypted PowerShell payloads.

Turla has used WMI event filters and consumers to establish persistence.

Turla has used PowerShell profiles to maintain persistence on an infected machine.

Turla RPC backdoors can be used to transfer files to/from victim machines on the local network.

Turla has used a AMSI bypass, which patches the in-memory amsi.dll, in PowerShell scripts to bypass Windows antimalware products.