Mandiant UNC3890 Aug 2022

SUGARUSH has checked for internet connectivity from an infected host before attempting to establish a new TCP connection.

SUGARDUMP's scheduled task has been named `MicrosoftInternetExplorerCrashRepoeterTaskMachineUA` or `MicrosoftEdgeCrashRepoeterTaskMachineUA`, depending on the Windows OS version.

SUGARDUMP has been named `CrashReporter.exe` to appear as a legitimate Mozilla executable.

SUGARDUMP has sent stolen credentials and other data to its C2 server.

SUGARDUMP has created scheduled tasks called `MicrosoftInternetExplorerCrashRepoeterTaskMachineUA` and `MicrosoftEdgeCrashRepoeterTaskMachineUA`, which were configured to execute `CrashReporter.exe` during user logon.

SUGARUSH has used `cmd` for execution on an infected host.

A SUGARDUMP variant has used HTTP for C2.

A SUGARDUMP variant used SMTP for C2.

SUGARDUMP has stored collected data under `%<malware_execution_folder>%\\CrashLog.txt`.

SUGARDUMP can search for and collect data from specific Chrome, Opera, Microsoft Edge, and Firefox files, including any folders that have the string `Profile` in its name.

SUGARUSH has used TCP for C2.

During C0010, UNC3890 actors downloaded tools and malware onto a compromised host.

During C0010, UNC3890 actors likely established a watering hole that was hosted on a login page of a legitimate Israeli shipping company that was active until at least November 2021.

Some SUGARDUMP variants required a user to enable a macro within a malicious .xls file for execution.

SUGARDUMP has collected browser bookmark and history information.

SUGARDUMP can identify Chrome, Opera, Edge Chromium, and Firefox browsers, including version number, on a compromised host.

SUGARUSH has created a service named `Service1` for persistence.

SUGARDUMP variants have harvested credentials from browsers such as Firefox, Chrome, Opera, and Edge.

SUGARDUMP has encrypted collected data using AES CBC mode and encoded it using Base64.

SUGARUSH has used port 4585 for a TCP connection to its C2.

For C0010, UNC3890 actors established domains that appeared to be legitimate services and entities, such as LinkedIn, Facebook, Office 365, and Pfizer.

During C0010, UNC3890 actors likely compromised the domain of a legitimate Israeli shipping company.

For C0010, UNC3890 actors used unique malware, including SUGARUSH and SUGARDUMP.

For C0010, UNC3890 actors obtained multiple publicly-available tools, including METASPLOIT, UNICORN, and NorthStar C2.

For C0010, UNC3890 actors staged malware on their infrastructure for direct download onto a compromised system.

For C0010, UNC3890 actors staged tools on their infrastructure to download directly onto a compromised system.

For C0010, the threat actors compromised the login page of a legitimate Israeli shipping company and likely established a watering hole that collected visitor information.