ATT&CK SoftwareEpic

Epic

S0091

Malware.View on attack.mitre.org

About this malware

Epic is a backdoor that has been used by Turla.

Techniques used22

Privilege Escalation1

T1055.011Extra Window Memory Injection

Stealth3

T1027Obfuscated Files or Information T1055.011Extra Window Memory Injection T1070.004File Deletion

Defense Impairment1

T1553.002Code Signing

Discovery14

T1007System Service Discovery T1012Query Registry T1016System Network Configuration Discovery T1018Remote System Discovery T1033System Owner/User Discovery T1049System Network Connections Discovery T1057Process Discovery T1069.001Local Groups T1082System Information Discovery T1083File and Directory Discovery T1087.001Local Account T1124System Time Discovery T1518.001Security Software Discovery T1680Local Storage Discovery

Collection2

T1560Archive Collected Data T1560.002Archive via Library

Command and Control2

T1071.001Web Protocols T1573.001Symmetric Cryptography

Procedure examples22

Technique	Procedure example
T1007 System Service Discovery	Epic uses the `tasklist /svc` command to list the services on the system. Kaspersky Turla
T1012 Query Registry	Epic uses the `rem reg query` command to obtain values from Registry keys. Kaspersky Turla
T1016 System Network Configuration Discovery	Epic uses the `nbtstat -n` and `nbtstat -s` commands on the victim’s machine. Kaspersky Turla
T1018 Remote System Discovery	Epic uses the `net view` command on the victim’s machine. Kaspersky Turla
T1027 Obfuscated Files or Information	Epic heavily obfuscates its code to make analysis more difficult. Kaspersky Turla
T1033 System Owner/User Discovery	Epic collects the user name from the victim’s machine. Kaspersky Turla Aug 2014
T1049 System Network Connections Discovery	Epic uses the `net use`, `net session`, and `netstat` commands to gather information on network connections. Kaspersky Turla Kaspersky Turla Aug 2014
T1055.011 Extra Window Memory Injection	Epic has overwritten the function pointer in the extra window memory of Explorer's Shell_TrayWnd in order to execute malicious code in the context of the explorer.exe process. ESET Recon Snake Nest
T1057 Process Discovery	Epic uses the `tasklist /v` command to obtain a list of processes. Kaspersky Turla Kaspersky Turla Aug 2014
T1069.001 Local Groups	Epic gathers information on local group names. Kaspersky Turla Aug 2014
T1070.004 File Deletion	Epic has a command to delete a file from the machine. Kaspersky Turla Aug 2014
T1071.001 Web Protocols	Epic uses HTTP and HTTPS for C2 communications. Kaspersky Turla Kaspersky Turla Aug 2014
T1082 System Information Discovery	Epic collects the OS version, hardware information, computer name, available system memory status, and system and user language settings. Kaspersky Turla Aug 2014
T1083 File and Directory Discovery	Epic recursively searches for all .doc files on the system and collects a directory listing of the Desktop, %TEMP%, and %WINDOWS%\Temp directories. Kaspersky Turla Kaspersky Turla Aug 2014
T1087.001 Local Account	Epic gathers a list of all user accounts, privilege classes, and time of last logon. Kaspersky Turla Aug 2014

View all 22 procedure examples

Groups that use it1

Campaigns0

None recorded.

References1

Kaspersky Turla Open source
Kaspersky Lab's Global Research and Analysis Team. (2014, August 7). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroburos. Retrieved December 11, 2014.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.