Unit 42 DarkHydrus July 2018

RogueRobin gathers the IP address and domain from the victim’s machine.

The PowerShell script with the RogueRobin payload was obfuscated using the COMPRESS technique in `Invoke-Obfuscation`.

RogueRobin collects the victim’s username and whether that user is an admin.

RogueRobin uses various WMI queries to check if the sample is running in a sandbox.

RogueRobin checks the running processes for evidence it may be running in a sandbox environment. It specifically enumerates processes for Wireshark and Sysinternals.

DarkHydrus leveraged PowerShell to download and execute additional scripts for execution.

RogueRobin uses a command prompt to run a PowerShell script from Excel. To assist in establishing persistence, RogueRobin creates %APPDATA%\OneDrive.bat and saves the following string to it:powershell.exe -WindowStyle Hidden -exec bypass -File “%APPDATA%\OneDrive.ps1”.

RogueRobin uses Windows Script Components.

RogueRobin gathers BIOS versions and manufacturers, the number of CPU cores, the total physical memory, and the computer name.

RogueRobin can save a new file to the system from the C2 server.

RogueRobin has a command named $screenshot that may be responsible for taking screenshots of the victim machine.

RogueRobin base64 encodes strings that are sent to the C2 over its DNS tunnel.

DarkHydrus has sent malware that required users to hit the enable button in Microsoft Excel to allow an .iqy file to be downloaded.

RogueRobin uses WMI to check BIOS version for VBOX, bochs, qemu, virtualbox, and vm to check for evidence that the script might be executing within an analysis environment.

RogueRobin enumerates running processes to search for Wireshark and Windows Sysinternals suite.

RogueRobin created a shortcut in the Windows startup folder to launch a PowerShell script each time the user logs in to establish persistence.

RogueRobin establishes persistence by creating a shortcut (.LNK file) in the Windows startup folder to run a script each time the user logs in.

DarkHydrus has used -WindowStyle Hidden to conceal PowerShell windows.

DarkHydrus has sent spearphishing emails with password-protected RAR archives containing malicious Excel Web Query files (.iqy). The group has also sent spearphishing emails that contained malicious Microsoft Office documents that use the “attachedTemplate” technique to load a template from a remote server.

DarkHydrus has obtained and used tools such as Mimikatz, Empire, and Cobalt Strike.