Procedure examples

BOOKWORM has modified HTTP POST requests to resemble legitimate communications.

BOOKWORM has been delivered using self-extracting RAR archives.

BOOKWORM has utilized Base64 encoding to obfuscate its payload.

BOOKWORM has obtained the username from an infected host.

BOOKWORM has created services that attempt to resemble legitimate services to include a service named `Microsoft Windows DeviceSync Service`.

BOOKWORM has used its KBLogger.dll module to capture keystrokes and stored them in a folder.

BOOKWORM has modified file timestamps from the export address table (EAT) to make it difficult to discern when the module was created.

BOOKWORM has communicated with its C2 via HTTP POST requests.

BOOKWORM has used various Windows API calls during execution and defense evasion. BOOKWORM has created a buffer on the heap using `HeapCreate` and `HeapAlloc` which allows for copying of shell code and then execution on the heap is initiated through callback function of legitimate API functions such as `EnumChildWindows` or `EnumSystemLanguageGroupsA`.

BOOKWORM has modified Registry key values as part of its created service `DeviceSync`.

BOOKWORM has used its KBLogger.dll module to steal data saved to the clipboard.

BOOKWORM has decoded its Base64 encoded payload prior to execution. BOOKWORM has also encrypted files with RC4 and has decrypted its payload prior to execution.

BOOKWORM has created a service named `Microsoft Windows DeviceSync Service` at `HKLM\SYSTEM\CurrentControlSet\Services\DeviceSync\` to trigger execution when the system starts and to maintain persistence.

BOOKWORM has used valid legitimate digital signatures and certificates to evade detection.

BOOKWORM has created a hidden window when conducting key logging and clipboard theft through its KBLogger.dll module.

BOOKWORM has used encryption and compression algorithms to obfuscate the traffic between the system and C2 server, methods observed included RC4, AES, XOR with 0x5a, and LZO.

BOOKWORM has used DLL side-loading to execute the malicious payload. BOOKWORM has also side-loaded DLL components into a legitimate process, including Microsoft Malware Protection `MsMpEng.exe` and Kaspersky Anti-Virus `ushata.exe`.