ESET ComRAT May 2020

ComRAT can check the default browser by querying HKCR\http\shell\open\command.

Turla surveys a system upon check-in to discover network configuration details using the arp -a, nbtstat -n, net config, ipconfig /all, and route commands, as well as NBTscan. Turla RPC backdoors have also retrieved registered RPC interface information from process memory.

Turla has used tracert to check internet connectivity.

Turla surveys a system upon check-in to discover remote systems on a local network using the net view and net view /DOMAIN commands. Turla has also used net group "Domain Computers" /domain, net group "Domain Controllers" /domain, and net group "Exchange Servers" /domain to enumerate domain computers, including the organization's DC and Exchange Server.

ComRAT has encrypted its virtual file system using AES-256 in XTS mode.

ComRAT has embedded a XOR encrypted communications module inside the orchestrator module.

ComRAT has used encryption and base64 to obfuscate its orchestrator code in the Registry. ComRAT has also used encoded PowerShell scripts.

ComRAT has stored encrypted orchestrator code and payloads in the Registry.

ComRAT has been programmed to sleep outside local business hours (9 to 5, Monday to Friday).

ComRAT has used a task name associated with Windows SQM Consolidator.

Turla surveys a system upon check-in to discover active local network connections using the netstat -an, net use, net file, and net session commands. Turla RPC backdoors have also enumerated the IPv4 TCP connection table via the GetTcpTable2 API call.

ComRAT has used a scheduled task to launch its PowerShell loader.

ComRAT has injected its orchestrator DLL into explorer.exe. ComRAT has also injected its communications module into the victim's default browser to make C2 connections appear less suspicious as all network connections will be initiated by the browser process.

ComRAT has used PowerShell to load itself every time a user logs in to the system. ComRAT can execute PowerShell scripts loaded into memory or from the file system.

ComRAT has used cmd.exe to execute commands.

Turla has used net localgroup and net localgroup Administrators to enumerate group information, including members of the local administrators group.

Turla has used net group "Domain Admins" /domain to identify domain administrators.

ComRAT has used HTTP requests for command and control.

ComRAT can use email attachments for command and control.

Turla surveys a system upon check-in to discover operating system configuration details using the systeminfo and set commands.

Turla surveys a system upon check-in to discover files in specific locations on the hard disk %TEMP% directory, the current user's desktop, the Program Files directory, and Recent. Turla RPC backdoors have also searched for files matching the lPH*.dll pattern.

Turla has used net user to enumerate local accounts on the system.

Turla has used net user /domain to enumerate domain accounts.

ComRAT has the ability to use the Gmail web UI to receive commands and exfiltrate information.

ComRAT can load a PE file from memory or the file system and execute it with CreateProcessW.

ComRAT has modified Registry values to store encrypted orchestrator code and payloads.

Turla has used fsutil fsinfo drives to list connected drives.

ComRAT has used unique per machine passwords to decrypt the orchestrator payload and a hardcoded XOR key to decrypt its communications module. ComRAT has also used a unique password to decrypt the file used for its hidden file system.

Turla has infected victims using watering holes.

Turla has used net accounts and net accounts /domain to acquire password policy information.

Turla has used a custom .NET tool to collect documents from an organization's internal central database.

ComRAT can check the victim's default browser to determine which process to inject its communications module into.

Turla has obtained information on security software, including security logging information that may indicate whether their malware has been detected.

ComRAT has used a portable FAT16 partition image placed in %TEMP% as a hidden file system.

Turla has used WebDAV to upload stolen USB files to a cloud drive. Turla has also exfiltrated stolen files to OneDrive and 4shared.

ComRAT can use SSL/TLS encryption for its HTTP-based C2 channel. ComRAT has used public key cryptography with RSA and AES encrypted email attachments for its Gmail C2 channel.

Turla surveys a system upon check-in to discover Group Policy details using the gpresult command.