F-Secure CozyDuke

CozyCar has executed Mimikatz to harvest stored credentials from the victim and further victim penetration.

Password stealer and NTLM stealer modules in CozyCar harvest stored credentials from the victim, including credentials used as part of Windows NTLM user authentication.

The payload of CozyCar is encrypted with simple XOR with a rotating key. The CozyCar configuration file has been encrypted with RC4 keys.

The CozyCar dropper has masqueraded a copy of the infected system's rundll32.exe executable that was moved to the malware's install directory and renamed according to a predefined configuration file.

One persistence mechanism used by CozyCar is to register itself as a scheduled task.

A module in CozyCar allows arbitrary commands to be executed by invoking C:\Windows\System32\cmd.exe.

CozyCar's main method of communicating with its C2 servers is using HTTP or HTTPS.

A system info module in CozyCar gathers information on the victim host’s configuration.

CozyCar uses Twitter as a backup C2 channel to Twitter accounts specified in its configuration file.

The CozyCar dropper copies the system file rundll32.exe to the install location for the malware, then uses the copy of rundll32.exe to load and execute the main CozyCar component.

Some versions of CozyCar will check to ensure it is not being executed inside a virtual machine or a known malware analysis sandbox environment. If it detects that it is, it will exit.

The main CozyCar dropper checks whether the victim has an anti-virus product installed. If the installed product is on a predetermined list, the dropper will exit.

One persistence mechanism used by CozyCar is to register itself as a Windows service.

One persistence mechanism used by CozyCar is to set itself to be executed at system startup by adding a Registry value under one of the following Registry keys: <br>HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ <br>HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ <br>HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run <br>HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run