Unit42 Agrius 2023

Agrius used tools such as Mimikatz to dump LSASS memory to capture credentials in victim environments.

Agrius dumped the SAM file on victim machines to capture credentials.

Agrius gathered data from database and other critical servers in victim environments, then used wiping mechanisms as an anti-analysis and anti-forensics mechanism.

Agrius used the tool NBTscan to scan for remote, accessible hosts in victim environments.

Agrius tunnels RDP traffic through deployed web shells to access victim environments via compromised accounts. Agrius used the Plink tool to tunnel RDP connections for remote access and lateral movement in victim environments.

MultiLayer Wiper contains two binaries in its resources section, MultiList and MultiWip. MultiLayer Wiper drops and executes each of these items when run, then deletes them after execution.

Agrius used the Plink tool for tunneling and connections to remote machines, renaming it systems.exe in some instances.

Agrius exfiltrated staged data using tools such as Putty and WinSCP, communicating with command and control servers.

Agrius used the open-source port scanner WinEggDrop to perform detailed scans of hosts of interest in victim networks.

MultiLayer Wiper creates a malicious scheduled task that launches a batch file to remove Windows Event Logs.

MultiLayer Wiper uses a batch script launched via a scheduled task to delete Windows Event Logs.

MultiLayer Wiper uses a batch script to clear file system cache memory via the ProcessIdleTasks export in advapi32.dll as an anti-analysis and anti-forensics technique.

MultiLayer Wiper uses a batch file, remover.bat to delete malware artifacts and the batch file itself during execution.

MultiLayer Wiper changes timestamps of overwritten files to either 1601.1.1 for NTFS filesystems, or 1980.1.1 for all other filesystems.

Agrius has used the folder, C:\\windows\\temp\\s\\, to stage data for exfiltration.

Agrius attempted to acquire valid credentials for victim environments through various means to enable follow-on lateral movement.

MultiLayer Wiper generates a list of all files and paths on the fixed drives of an infected system, enumerating all files on the system except specific folders defined in a hardcoded list.

Agrius engaged in various brute forcing activities via SMB in victim environments.

Agrius engaged in password spraying via SMB in victim environments.

Agrius used a custom tool, sql.net4.exe, to query SQL databases and then identify and extract personally identifiable information.

MultiLayer Wiper deletes files on network drives, but corrupts and overwrites with random data files stored locally.

MultiLayer Wiper wipes the boot sector of infected systems to inhibit system recovery.

BFG Agonizer wipes the boot sector of infected machines to inhibit system recovery.

MultiLayer Wiper reboots the infected system following wiping and related tasks to prevent system recovery.

BFG Agonizer uses elevated privileges to call NtRaiseHardError to induce a "blue screen of death" on infected systems, causing a system crash. Once shut down, the system is no longer bootable.

BFG Agonizer uses DLL unhooking to remove user mode inline hooks that security solutions often implement. BFG Agonizer also uses IAT unhooking to remove user-mode IAT hooks that security solutions also use.

Agrius used 7zip to archive extracted data in preparation for exfiltration.

BFG Agonizer retrieves a device handle to \\\\.\\PhysicalDrive0 to wipe the boot sector of a given disk.

MultiLayer Wiper opens a handle to \\\\\\\\.\\\\PhysicalDrive0 and wipes the first 512 bytes of data from this location, removing the boot sector.

MultiLayer Wiper changes the original path information of deleted files to make recovery efforts more difficult.

Agrius used several mechanisms to try to disable security tools. Agrius attempted to modify EDR-related services to disable auto-start on system reboot. Agrius used a publicly available driver, GMER64.sys typically used for anti-rootkit functionality, to selectively stop and remove security software processes.

MultiLayer Wiper removes the Volume Shadow Copy (VSS) service from infected devices along with all present shadow copies.

MultiLayer Wiper removes Windows event logs during execution.