DHS CISA AA22-055A MuddyWater February 2022

Mori has obfuscated the FML.dll with 200MB of junk data.

STARWHALE can collect data from an infected local host.

Mori can read data from the Registry including from `HKLM\Software\NFC\IPA` and
`HKLM\Software\NFC\`.

STARWHALE has the ability to collect the IP address of an infected host.

STARWHALE has been obfuscated with hex-encoded strings.

STARWHALE can gather the username from an infected host.

PowGoop has disguised a PowerShell script as a .dat file (goopdate.dat).

PowGoop has used a DLL named Goopdate.dll to impersonate a legitimate Google update file.

STARWHALE can exfiltrate collected data to its C2 servers.

MuddyWater has used malware that leveraged WMI for execution and querying host information.

PowGoop has the ability to use PowerShell scripts to execute commands.

MuddyWater has used PowerShell for execution.

POWERSTATS uses PowerShell for obfuscation and execution.

MuddyWater has used JavaScript files to execute its POWERSTATS payload.

Mori can delete its DLL file and related files by Registry value.

STARWHALE has the ability to contact actor-controlled C2 servers via HTTP.

Mori can communicate using HTTP over IPv4 or IPv6 depending on a flag set.

Small Sieve can contact actor-controlled C2 servers by using the Telegram API over HTTPS.

Mori can use DNS tunneling to communicate with C2.

STARWHALE can gather the computer name of an infected host.

Mori can write data to `HKLM\Software\NFC\IPA` and `HKLM\Software\NFC\` and delete Registry values.

STARWHALE has the ability to hex-encode collected data from an infected host.

Mori can use Base64 encoded JSON libraries used in C2.

Small Sieve can use a custom hex byte swapping encoding scheme to obfuscate tasking traffic.

Mori can resolve networking APIs from strings that are ADD-encrypted.

PowGoop can decrypt PowerShell scripts for execution.

MuddyWater has exploited the Microsoft Exchange memory corruption vulnerability (CVE-2020-0688).

MuddyWater has attempted to get users to open malicious PDF attachment and to enable macros and launch malicious Microsoft Word documents delivered via spearphishing emails. Additionally, MuddyWater has used a Word document with a malicious Visual Basic for Applications (VBA) macro; when enabled, the CertificationKit.ini payload is constructed and executed.

STARWHALE has relied on victims opening a malicious Excel file for execution.

MuddyWater has exploited the Microsoft Netlogon vulnerability (CVE-2020-1472).

Mori can use `regsvr32.exe` for DLL execution.

STARWHALE can establish persistence by installing itself in the startup folder, whereas the GO variant has created a `HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OutlookM` registry key.

MuddyWater has used malware that has the capability to execute malicious code via COM, DCOM, and Outlook.

MuddyWater has compromised third parties and used compromised accounts to send spearphishing emails with targeted attachments to recipients. MuddyWater has also sent spearphishing emails with the attachment Cybersecurity.doc, which served as the primarily payload for the next stage.

PowGoop can receive encrypted commands from C2.

Small Sieve can use SSL/TLS for its HTTPS Telegram Bot API-based C2 channel.

MuddyWater maintains persistence on victim networks through side-loading dlls to trick legitimate programs into running malware.

PowGoop can side-load `Goopdate.dll` into `GoogleUpdate.exe`.