Lazarus APT January 2022

Lazarus Group has used a custom hashing method to resolve APIs used in shellcode.

Lazarus Group has used multiple types of encryption and encoding for their payloads, including AES, Caracachs, RC4, XOR, Base64, and other tricks such as creating aliases in code for Native API function names.

Various Lazarus Group malware enumerates logged-on users.

A Lazarus Group malware sample performs reflective DLL injection.

Several Lazarus Group malware families gather a list of running processes on a victim system and send it to their C2 server. A Destover-like variant used by Lazarus Group also gathers process times.

Lazarus Group has used VBA and embedded macros in Word documents to execute malicious code.

Lazarus Group has restored malicious KernelCallbackTable code to its original state after the process execution flow has been hijacked.

Lazarus Group has conducted C2 over HTTP and HTTPS.

Several Lazarus Group malware families collect information on the type and version of the victim OS, as well as the victim computer name and CPU information.

Lazarus Group malware can use a common function to identify target files by their extension, and some also enumerate files and directories, including a Destover-like variant that lists files and gathers information for all drives.

Lazarus Group has used GitHub as C2, pulling hosted image payloads then committing command execution output to files in specific directories.

Lazarus Group has used multi-stage malware components that inject later stages into separate processes.

Lazarus Group has downloaded files, malware, and tools from its C2 onto a compromised host.

Lazarus Group has used the Windows API ObtainUserAgentString to obtain the User-Agent from a compromised host to connect to a C2 server. Lazarus Group has also used various, often lesser known, functions to perform various types of Discovery and Process Injection.

Lazarus Group has used shellcode within macros to decrypt and manually map DLLs and shellcode into memory at runtime.

Lazarus Group has attempted to get users to launch a malicious Microsoft Word attachment delivered via a spearphishing email.

Lazarus Group lnk files used for persistence have abused the Windows Update Client (wuauclt.exe) to execute a malicious DLL.

Lazarus Group has used mshta.exe to execute HTML pages downloaded by initial access documents.

Lazarus Group has maintained persistence by loading malicious code into a startup folder or by adding a Registry Run key.

Lazarus Group has digitally signed malware and utilities to evade detection.

Lazarus Group has used a VBA Macro to set its file attributes to System and Hidden and has named files with a dot prefix to hide them from the Finder application.

Lazarus Group has targeted victims with spearphishing emails containing malicious Microsoft Word documents.

Lazarus Group has abused the KernelCallbackTable to hijack process control flow and execute shellcode.

Lazarus Group has changed memory protection permissions then overwritten in memory DLL function code with shellcode, which was later executed via KernelCallbackTable hijacking. Lazarus Group has also used shellcode within macros to decrypt and manually map DLLs into memory at runtime.

A Destover-like variant used by Lazarus Group collects disk space information and sends it to its C2 server.