Trend Micro Waterbear December 2019

Waterbear can query the Registry key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSDTC\MTxOCI" to see if the value `OracleOcilib` exists.

Waterbear can scramble functions not to be executed again with random values.

Waterbear has used RC4 encrypted shellcode and encrypted functions.

Waterbear can use API hooks on `GetExtendedTcpTable` to retrieve a table containing a list of TCP endpoints available to the application.

Waterbear can inject decrypted shellcode into the LanmanServer service.

Waterbear can use thread injection to inject shellcode into the process of security software.

Waterbear can identify the process for a specific security product.

Waterbear can receive and load executables from remote C2 servers.

Waterbear can leverage API functions for execution.

Waterbear has deleted certain values from the Registry to load a malicious DLL.

Waterbear has the ability to decrypt its RC4 encrypted payload for execution.

Waterbear can find the presence of a specific security software.

BlackTech has used DLL side loading by giving DLLs hardcoded names and placing them in searched directories.

Waterbear has used DLL side loading to import and load a malicious DLL loader.

Waterbear can hook the ZwOpenProcess and GetExtendedTcpTable APIs called by the process of a security product to hide PIDs and TCP records from detection.