Rancor Unit42 June 2018

PLAINTEE uses the ipconfig /all command to gather the victim’s IP address.

Rancor launched a scheduled task to gain persistence using the schtasks /create /sc command.

PLAINTEE performs the tasklist command to list running processes.

Rancor has used cmd.exe to execute commmands.

PLAINTEE uses cmd.exe to execute commands on the victim’s machine.

Rancor has used VBS scripts as well as embedded macros for execution.

Rancor has used HTTP for C2.

PLAINTEE collects general system enumeration data about the infected machine and checks the OS version.

DDKONG lists files on the victim’s machine.

Rancor has downloaded additional malware, including by using certutil.

DDKONG downloads and uploads files on the victim’s machine.

PLAINTEE has downloaded and executed additional plugins.

PLAINTEE uses reg add to add a Registry Run key for persistence.

DDKONG decodes an embedded configuration using XOR.

Rancor attempted to get users to click on an embedded macro within a Microsoft Office Excel document to launch their malware.

Rancor has used msiexec to download and execute malicious installer files over HTTP.

DDKONG uses Rundll32 to ensure only a single instance of itself is running at once.

PLAINTEE gains persistence by adding the Registry key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce.

An older variant of PLAINTEE performs UAC bypass.

Rancor has attached a malicious document to an email to gain initial access.

PLAINTEE encodes C2 beacons using XOR.